VPN server behind router... How to configure?

I have a w2k3 server setup for Remote access/VPN. It is on a LAN and
both the server and a WinXP workstation can see each other and the
internet. However how will I connect a remote client (not on the LAN)
when there is a router between the remote client and the server? The
router is a Belkin DSL 4-port Cable/DSL Gateway Router. Before I
installed the router the remote could access the server using the IP
address of the server (derived from the DSL ISP) but now when I try to
vpn to the server from the remote I get the 800 error message, "unable
to establish vpn connection." What are the proper connection settings
in the nic to make this work?
Thanks,
Ed

For a PPTP-based VPN (easiest to configure), you need to forward TCP
Port 1723 to the server machine and enable PPTP Passthrough/GRE (this
may or may not be configurable per your router - I don't remember
offhand how the Belkin responds - check your user manual).

A IPSEC/L2TP VPN will require quite a bit more configuration and has
some of the same dependencies as the PPTP VPN.

Jeffrey Randow (Windows Networking & Smart Display MVP)
jeffreyr-(E-Mail Removed)

Please post all responses to the newsgroups for the benefit
of all USENET users. Messages sent via email may or may not
be answered depending on time availability....

Remote Networking Technology Support Site -
http://www.remotenetworktechnology.com
Windows XP Expert Zone - http://www.microsoft.com/windowsxp/expertzone

On Thu, 27 May 2004 20:40:53 -0500, Ed Spann
<(E-Mail Removed)> wrote:

>I have a w2k3 server setup for Remote access/VPN. It is on a LAN and
>both the server and a WinXP workstation can see each other and the
>internet. However how will I connect a remote client (not on the LAN)
>when there is a router between the remote client and the server? The
>router is a Belkin DSL 4-port Cable/DSL Gateway Router. Before I
>installed the router the remote could access the server using the IP
>address of the server (derived from the DSL ISP) but now when I try to
>vpn to the server from the remote I get the 800 error message, "unable
>to establish vpn connection." What are the proper connection settings
>in the nic to make this work?
>Thanks,
>Ed

It really depends on the router. At home, for example, I have a Linksys
router, which is going to be similar to your Belkin, I would guess. In
order for me to setup VPN access there, I had to use the router's DMZ
feature, which puts one machine inside the private network out on the
public network without any firewall features.[1]

The reason for having to do it this way, rather than using the router's
port-forwarding feature, is that there is no way to tell the Linksys to
route the GRE packets; all the Linksys provides options for are TCP and
UPD, which is great for a web or mail server, but not so much for a PPTP
VPN server.

Good luck,

robert

[1] At least with the Linksys, port forward entries take precedence over
the DMZ entry, so one 'trick' is to port forward ports I'd rather not
have exposed, such as 135, to a non-existent internal IP.


"Ed Spann" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed):
> I have a w2k3 server setup for Remote access/VPN. It is on a LAN and
> both the server and a WinXP workstation can see each other and the
> internet. However how will I connect a remote client (not on the LAN)
> when there is a router between the remote client and the server? The
> router is a Belkin DSL 4-port Cable/DSL Gateway Router. Before I
> installed the router the remote could access the server using the IP
> address of the server (derived from the DSL ISP) but now when I try to
> vpn to the server from the remote I get the 800 error message, "unable
> to establish vpn connection." What are the proper connection settings
> in the nic to make this work?
> Thanks,
> Ed