Networks

Ask something
Discussion Locked

VPN server behind a NAT router

0 helpful
2 replies

by tobs

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I'd like to get some advice on how to set up a VPN server behind a NAT router. Our office is connected to the internet through ADSL. I've connected a router to do the address translation so that PC's in our office can access the web. I've also configured access lists for firewall functions. This is working fine now.
We've recently put up a branch office and I need to be able to share files between the two offices securely. I'm planning to setup a Windows-based VPN server in our head office but still not sure how to go about doing it. I've read in Microsoft web site that implementing VPN server behind a NAT is not advisable. Any thoughts and suggestions would be great help.
Thanks

2 replies

by dryflies

you will have to use port forwarding in the NAT router to direct ipsec traffic to the VPN server. And they are right, it is not advisable.
you should be able to get a firewall appliance that incorporates NAT and VPN thus having your VPN endpoint at the network edge instead of inside.
please remember to rate this answer.

by jt

This is quite true, it is much more adviseable to let an external
appliance handle the vpn. However depending on the firewall it
is most likely TCP port 1792 and the GRE protocol for PPTP, UDP
500 for IPSEC, UDP 1701 for L2TP. forward those and MAKE
sure you have good authentication, having vpn hosted on a
separate machine other than a firewall is really no major ordeal
so long as the vpn host is secured.

This discussion is closed to new replies.