IT Employment

Ask something
Discussion Locked

VPN Setup

0 helpful
5 replies

by r.giskard

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have a client that wants to allow his employees to log-in from home. His work network is a 'File & Printer Sharing' network with no servers. They use a LinkSys Router/Gateway for internet access at work.

He wants a firewall to prevent unauthorized access. I'm thinking a hardware box at work and a software solution for the home computers. He does not want to pay for a box at each employees home.
I'm also thinking to move everyone to a file server. I'm not sure if I can get everyone to the right work computer from home using 'File & Printer Sharing'.

He will have no more than 10 employees logging in from home.

5 replies

by curlergirl

First, unless he has a static IP on his Internet connection, you could run into problems. Even if it's a broadband connection that is "always on," there is the possibility of getting a different IP address any time it is disconnected (i.e., any sort of power or service outage). So, that could obviously cause problems with any type of VPN setup. If you are determined to go the VPN route, then you really need a server of some kind - either a network file server (Win2K includes pretty much automatic VPN setup) or some kind of VPN-capable server box at the office end. Another way to go, however, would be to use a remote control software package like pcAnywhere (Symantec) or VNC (freeware). This would allow each user to connect directly through the router to his or her own workstation to work remotely. This requires more setup at the home end, though, because the software has to be installed and configured at each user's home computer. The static IP comment still pertains, since they have to connect to the router using the public IP address before they can get to their workstations. Hope this helps!

by r.giskard

They do have a static IP address provided with the DSL service. I like the software solution using remote software. But the host has to send a message
to the remote client to allow connection, I think.

by curlergirl

You're thinking of the remote control software built into Windows XP. With tools like VNC or pcAnywhere, you set up and configure the host to "listen" continuously over a specific IP address and port number. Then, the remote client is configured to connect to that specific IP address and port number and VOILA! there you are. If you need multiple hosts listening at the same site, you should probably use pcAnywhere - I'm not sure how configurable VNC is as to ports to listen on. I know that pcAnywhere can be figured with multiple hosts using one public IP address but listening on different ports. With version 10.5 and above of pcAnywhere, this is very easy to configure. If you have any sort of router with firewall and/or NAT capabilities on the DSL line, you also have to configure the forwarding at the router so that the packets coming in on the specified ports go to the specified hosts.

by salochin

Further to what has already been posted, one suggestion would be to place a system as the Internet gateway by placing the system between the Internet and the LAN.

Loading routing s/w, i.e. Winroute onto it (I use this s/w as it has a built in firewall) and setting up port redirection in the s/w, enables you to connect to the firewall system on various ports which then get redirected to the default pcAnywhere ports, i.e. connect on ports 9000 & 9001 (associated with system 192.168.254.1) which get changed to 5631 & 5632 (forwards the signals to system 192.168.254.1)

By doing this, you can leave the ports on the LAN systems as the defaults, so doing a network search on the LAN will show all the clients available, but means that, from outside, not only do you need to know the username and password for any given pcAnywhere client that is running, you also require the ports that have been assigned.

These individual details can be locked into the s/w on the external users system soit doesn't need entering again.

The above scenario can also be setup on a good firewall/router box as many allow for the port redirection feature, but check first.

One added bonus of doing this is that you can setup totally unconnected port numbers so if you get port probed it won't show up as running pcAnywhere.

Hope this helps.

This discussion is closed to new replies.