Configuring a Win2K VPN Server

VPN client connections and a glimpse of the future of IIS administration

In many of my earlier articles, I've said that you shouldn't consider implementing remote access technologies such as Microsoft Windows 2000 Server Terminal Services without implementing a VPN solution to secure that technology. In "Installing a Win2K VPN Server," January 2002, InstantDoc ID 23275, I showed you how to install a Win2K VPN to secure such remote access for your IIS administrators. This month, I show you how to configure a VPN connection, then provide a few tips and tricks for optimizing your PPTP VPN connections.

Configuring a VPN Connection
If you followed the instructions in last month's article, you now have a functional VPN server. Now, I'll walk you through the steps for configuring a VPN connection to your Win2K VPN server:

Now, connect to the VPN by typing your username, password, and domain. When you're connected, a computer icon will appear in your taskbar. If you hover over the computer icon, Windows provides connection identification and information. You can disconnect your VPN connection by right-clicking the VPN connection in the taskbar and selecting Disconnect. (Note that when you authenticate to a Win2K domain through a VPN connection, the logon script doesn't run. If network drives are mapped through your Win2K logon script and you want to access them, you need to map network drives manually.)

Public Name Resolution Through a VPN Connection
The first time you establish a successful VPN connection to your remote server, you might have trouble with public name resolution (e.g., DNS, WINS). For example, you might not be able to launch a browser on a remote system to connect to a public Web site on the Internet. Because your VPN server is a completely separate LAN, you need to configure name resolution separately, too. Fortunately, there's a bulletproof way to handle name resolution on the client side without having to address the security implications of handling it on the VPN server—through your default Internet connection (i.e., your ISP).

However, before I show you how to set up public name resolution, I should point out that setting it up on your VPN server isn't necessarily a good idea. Indeed, many administrators deliberately set up their VPN servers without it. Two schools of thought exist about denying public name resolution through a VPN server. The first school asserts that the purpose of a VPN is to provide secure access to corporate LAN resources. Therefore, leveraging the corporate VPN as a springboard to public Internet sites is unnecessary. The second school centers on security. Providing public Internet access through a VPN connection is just one more exposed route that a malicious intruder can attack. So, many IIS administrators choose either not to provide name resolution at all through VPN connections or to provide only internal name resolution for internal servers (i.e., internal DNS).

If, however, your clients or administrators require access to resources outside the VPN, you can configure your VPN connection to handle public name resolution outside your VPN server. To do so for a Win2K VPN, follow these steps:

The Use default gateway on remote network check box controls the route used for connections to remote servers. By clearing this check box, your Internet connection rather than the remote server handles the routing. This connection provides a secure connection to the servers on your LAN through the VPN. Any access to the public Internet will be routed through your Internet connection, where your ISP handles public name resolution.

VPN Connectivity Through Windows CE
At the time of this writing, Windows CE .NET (code-named Talisker) was in beta 2 and publicly available. This new version of Windows CE will ship not only with a VPN client but also with its own version of Terminal Services. Figure 5 shows the Windows CE VPN configuration screen. Web-exclusive Figure 1, which you can access from the Windows Web Solutions Web site (http:// www.windowswebsolutions.com, InstantDoc ID 23575), shows the Windows CE Terminal Services client.

Windows CE .NET will feature PPTP support. With this support, you can secure the transfer of data from a remote Windows CE­based client running on form factors as small as a pocket PC to a private enterprise server by creating a VPN across a TCP/IP-based network. Windows CE .NET will also feature RDP 5.0 support, which connects a Windows CE­based client to a Win2K- or Windows NT 4.0­based server that's running Terminal Services. As Web-exclusive Figure 2 shows, you can securely administer a production IIS server remotely from a wireless pocket PC by running Internet Services Manager (ISM) over Terminal Services. You'll be able to administer IIS servers remotely on handheld computers that have the same tools you use on desktop PCs!

Up and Running with VPN
Installing and configuring a VPN server for secure remote access is one of the more complex operations in Win2K. Configuring VPN client access is also complex. Now, you have the foundation to get your VPN client connectivity running securely and effectively. Next month, I'll dive into the Microsoft SMTP Service and show you how to automate sending email from your Web servers.