Configure VPN on Dedicated Server

[Alfred]

What is VPN ?

The use of both public and private networks to create a network connection is called a virtual private network (VPN). A VPN is the extension of a private network that encompasses links across shared or public networks like the Internet. With a VPN, you can send data between two computers across a shared or public network in a manner that emulates a point-to-point private link. Virtual private networking is the act of creating and configuring a virtual private network.
----------------------------------------------------------------------------------------------------------------------------------------------------------------

Basic VPN Requirement

*

User Permission. Enable a user to access the VPN. To do this, go to AD Users and Computers, select the user who need to access the VPN, click Dial-in. Check Allow access on the Remote Access Permission (Dial-in or VPN).
*

IP Configuration. The VPN server should have a static IP address and assign the arrange IP addresses to VPN clients. The VPN server must also be configured with DNS and WINS server addresses to assign to the VPN client during the connection.
*

Data Encryption. Data carried on the public network should be rendered unreadable to unauthorized clients on the network.
*

Protocol Support. The TCP/IP is common protocols used in the public network. The VPN also include IP, Internetwork Packet Exchange (IPX), NetBEUI and so on.
*

Firewall Ports. When you place a VPN server behind your firewall, be sure to enable IP protocol 47 (GRE) and TCP port 1723.
*

Interface(s) for VPN server. If your network doesn't have a router or the VPN is also a gateway, your computer must have at least two interfaces, one connecting to the Internet and another connecting to the LAN. If it is behind a router, you just need one NIC.
*

One interface for VPN client. The interface can be a dial-in modem, or a dedicated connection to the Internet.

================================================== =======================================

To Enable the Routing and Remote Access Service
1. Click Start, point to Administrative Tools, and then click Routing and Remote Access.
2. In the left pane of the console, click the server that matches the local server name.

If the icon has a red arrow in the lower-right corner, the Routing and Remote Access service is not enabled. Go to step 3.

If the icon has a green arrow pointing up in the lower-right corner, the service is enabled. If so, you may want to reconfigure the server. To reconfigure the server, you must first disable Routing and Remote Access. To do this, right-click the server, and then click Disable Routing and Remote Access. Click Yes when you are prompted with an informational message.
3. Right-click the server, and then click Configure and Enable Routing and Remote Access to start the Routing and Remote Access Server Setup Wizard. Click Next.
4. Click Remote access (dial-up or VPN) to permit remote computers to dial in or connect to this network through the Internet. Click Next.
5. Click VPN for virtual private access, or click Dial-up for dial-up access, depending on the role you want to assign to this server.
6. On the VPN Connection page, click the network interface that is connected to the Internet, and then click Next.
7. On the IP Address Assignment page, do one of the following:
• If a DHCP server will be used to assign addresses to remote clients, click Automatically, and then click Next. Go to step 8.
• To give remote clients addresses only from a pre-defined pool, click From a specified range of addresses.

NOTE: In most cases, the DHCP option is simpler to administer. However, if DHCP is not available, you must specify a range of static addresses. Click Next.

The wizard opens the Address Range Assignment page.
a. Click New.
b. In the Start IP address box, type the first IP address in the range of addresses that you want to use.
c. In the End IP address box, type the last IP address in the range.

Windows calculates the number of addresses automatically.
d. Click OK to return to the Address Range Assignment page.
e. Click Next.
8. Accept the default setting of No, use Routing and Remote Access to authenticate connection requests, and then click Next.
9. Click Finish to enable the Routing and Remote Access service and to configure the remote access server.
================================================== =======================================
To Set Up a Client for VPN Access
To set up a client for virtual private network (VPN) access, follow these steps on the client workstation.

NOTE: Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.
1. Click Start, click Control Panel, and then double-click Network Connections.
2. Under Network Tasks, click Create a new connection, and then click Next.
3. Click Connect to the network at my workplace to create the dial-up connection, and then click Next.
4. Click Virtual Private Network connection, and then click Next.
5. On the Connection Name page, type a descriptive name for this connection, and then click Next.
6. Do one of the following, and then click Next.
• If the computer is permanently connected to the Internet, click Do not dial the initial connection.
• If the computer connects to the Internet by way of an Internet service provider (ISP), click Automatically dial this initial connection, and then click the name of the connection to the ISP.
7. Type the IP address or the host name of the VPN server computer (for example, VPNServer.SampleDomain.com).
8. Do one of the following, and then click Next:
• If you want to allow any user who logs on to the workstation to have access to this dial-up connection, click Anyone's use.
• If you want this connection to be available only to the currently logged-on user, click My use only.
9. Click Finish to save the connection.

--------------------------------------------------------------------------------------------------------------------------------------------------------------

After configuration of all setting, the most Important thing you will need to configured TCP/IP packet filters for your VPN.

On the IP tab of the profile settings, the following TCP/IP packet filters are configured:

Input Filters:
•

Filter action: Deny all traffic except those listed below
•

Filter 1: Destination network IP address of 172.31.0.10 and subnet mask of 255.255.255.255
•

Filter 2: Destination network IP address of 172.31.0.11 and subnet mask of 255.255.255.255

Output Filters:
•

Filter action: Deny all traffic except those listed below
•

Filter 1: Source network IP address of 172.31.0.10 and subnet mask of 255.255.255.255
•

Filter 2: Source network IP address of 172.31.0.11 and subnet mask of 255.255.255.255

----------------------------------------------------------------------------------------------------------------------------------------------------------------

Thanks & Regards,
Alfred.
Support Department.