Re: Problem in NAT

"marshal4ever" <> wrote in message
news:...
>
> I have configured a NAT and VPN Server on one server and I connected NAT
> to internet with PPOE demand dial , I want that no one can access to
> internet until they establish a VPN Connection to my VPN Server with
> specified user and pass .
> I didnt add the private interface to prevent them and I have added
> Internal Interface but its no working .
> what do you think the problem is?
> """" This is just an exercise """
> thank you.
>
>
> --
> marshal4ever
> ------------------------------------------------------------------------
> marshal4ever's Profile: http://forums.techarena.in/members/138668.htm
> View this thread: http://forums.techarena.in/server-ne...ng/1251427.htm
>
> http://forums.techarena.in
>


Anyone coming in from the internet that can't authenticate to the VPN can't
access anything internally anyway. But they need internet access from the
internet side so they can get to the VPN to begin with. So I'm not sure what
the question is. Are you having problems configuring VPN in general on the
server?

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Please reply back to the newsgroup or forum for collaboration benefit among
responding engineers, and to help others benefit from your resolution.

Ace Fekay, MCT, MCTS 2008, MCTS Exchange, MCSE, MCSA 2003 & 2000, MCSA
Messaging
Microsoft Certified Trainer

For urgent issues, please contact Microsoft PSS directly. Please check
http://support.microsoft.com for regional support phone numbers.

"marshal4ever" <> wrote in message
news:...
>
> No , you know the scenario is little ridiculous but I just want to test
> it .
> I want my users from my LAN can go to internet while the connect to
> VPN server ( with user and pass) . I already wrote a policy in RRAS
> server and I have created a group( VPN for example) in active directory
> then I create users and add them to that group( VPN group which I
> created) and in the policy I have set that users from that group can
> connect to RRAS and can be authenticated ( this is just for preventing
> internal users from going to internet , any one that want go to internet
> must have a user and pass )
> but this is not working what do you think?
>
>
> --
> marshal4ever
> ------------------------------------------------------------------------
> marshal4ever's Profile: http://forums.techarena.in/members/138668.htm
> View this thread: http://forums.techarena.in/server-ne...ng/1251427.htm
>
> http://forums.techarena.in
>


I see. Never heard of anyone doing it that way for controlling internal user
access to any subnet, outside or other. The reason it may not be working
must be a routing issue, because users are coinfigured internally to VPN to
the server, then back to the user, then using the VPN/RRAS server again as
the gateway. Sounds like a U-turn, which 99% of routers can't handle.

I would honestly discard the VPN idea.

Why not simply install an ISA server? Control all internet traffic based on
user accounts.

Or you can create a GPO on the OU of user accounts that you don;t want to
give access, with a fake Proxy server to get automatically set in their
browser.

Ace

"marshal4ever" <> wrote in message
news:...
>
> No , you know the scenario is little ridiculous but I just want to test
> it .

Yes,..just as you said,...you are testing the ridiculous.

Forget it.

Buy and ISA Server or another firewall capable of outbound authentication.

--
Phillip Windell

The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------