Creating a site-to-site VPN connection from a branch office to the corporate datacenter

I want to create a site-to-site VPN connection from our branch office to the corporate datacenter by using RRAS on our Windows server. Our basic broadband firewall/router supports pass-through for outgoing PPTP connections, and I think I've correctly configured the site-to-site VPN on the RRAS servers at the branch office and at the datacenter. But I don't know how to get the PCs on our branch network to use the RRAS server when they want to communicate with servers at the datacenter and the firewall when accessing the Internet. In many scenarios, the VPN server is also the router connecting the LAN to the Internet. In our case, I can't replace the router with a Windows server because of other policies. How can I solve this problem?

You need to do two more things. First, you need to configure your router/firewall to route traffic destined for the datacenter and local branch network through your local RRAS server instead of directly over the Internet. To do this, you need to know the subnets at the datacenter to which your local computers need to communicate. Then you add some router rules to the firewall so that it sends packets addressed to those subnets to the VPN server instead. While setting up your site-to-site VPN using Windows Help you should have already added one or more static routes for the same subnets that route such traffic over the VPN connection. Figure 1 shows a screen print of the route defined on my local firewall that routes traffic destined for my other office through 10.42.42.40—the address of my local VPN server. With that rule configured, whenever the router sees a packet destined for your datacenter, it will relay the packet to your local RRAS server. The RRAS server encapsulates it into a PPTP packet and sends it back to the firewall and out over the Internet. For what it's worth, you could have reconfigured your branch DHCP server to configure DHCP clients to replace the router as the default gateway with your RRAS server. Then the RRAS server would receive each packet first and route it directly to the Internet via your firewall or first through the VPN connection, as appropriate. I prefer to keep the router as the default gateway because if the local RRAS server goes down, users can still access the Internet, which wouldn't be the case if the RRAS server were the default gateway.

You'll also probably need to change how DNS queries are resolved by computers at your branch office. Currently, your DHCP server is no doubt configuring computers to use the router as their primary DNS server. Therefore, DNS queries for servers at your datacenter will go unresolved unless you can configure your firewall to try resolving DNS queries first against an internal DNS server at your datacenter via your site-to-site VPN. But more likely, you'll need to configure your local RRAS server as the primary DNS server for your branch LAN. After you install DNS on your RRAS server, you'll create two forwarding entries so that the server first forwards all DNS requests to an internal DNS server at the datacenter, then forwards any unresolved queries to your firewall. You'll also want to configure your DHCP server to specify your firewall as the alternate DNS server for the branch LAN. Then if your RRAS server goes down, branch computers will still be able to get DNS queries for Internet sites resolved, preserving Internet access.