After installing Windows 2003 today I began to make an attempt to get Remote Access Server working. The goal was to create a VPN server that I could dial in to.
The first step was to install it. This was done via the Manage Your Server wizard via which I added the Remote Access/VPN Server Role. One of the issues in doing this was that I had to select a custom configuration as the VPN configuration (which is what I really wanted) required me to have two NICs installed.
Once this step was completed I went about configuring the policy. Out of the box each user is assigned the Remote Access Permission "Control access through Remote Access Policy." Simply changing this to allow access is by far the easiest way to go IMHO. However, as usual I wanted to try things a little differently. I wanted to create a group such that any members of that group would automagically be given access. To do this I first created a new group called Remote Access Users. This is in addition to the Dial group that already exists but is invisible in the Computer Management Snap-in. I next opened up the Routing and Remote Access MMC and added a new policy called Windows Group Matches Remote Access Users. I created this using the New Policy Remote Access wizard and selected the "use wizard to set up a typical policy for common scenario" option. I created a VPN only policy and then added the Remote Access Users group that I created using the Computer Management MMC. I left the default authentication methods and encryption methods.
At this point dialing in over VPN from the server machine to itself went all the way through the "Registering computer on network" dialog and then erred out with "Error 733, A connection to the remote computer could not be created. You might need to adjust the protocols on your computer." Unfortunately, I could not get past this error. I am hoping it is due to the fact that I am dialing myself or dialing from a computer that is already on the local network but at the moment I am simply grasping at straws. I tried the help and found the following instructions, "In Routing and Remote Access, double-click IP Routing, right-click DHCP Relay Agent, and click Properties. Type the IP address of the DHCP server for your network in Server address." Unfortunately, this didn't fix the issue either and adding a Local Area Network as a DHCP Relay Agent didn't help either. It turns out that my router was declining the request to provide another DHCP assigned address. To circumvent this problem I created a static IP address pool on the IP tab of my servers Properties dialog. Now all seems to be working but I need to test by actually dialing in remotely and verifying that traffic is indeed routed to other computers on the LAN. To do this I have also opened up PPTP (Port 1723) on the firewall. I read here something about GRE support as well but I am hoping that is automatic on my router.
By the way, since I created a static pool of IP address, which the RAS server passed out when clients connected, I no longer needed the DHCP Relay Agent to be specified. In addition, I was able to add the Local Area Network DHCP Relay Agent that I previously added manually.
By the way, I explicitly denied access (RAS) for the Administrator user as I didn't want people trying to hack in with this known user name that I had not yet changed.
In summary, this was not nearly as intuitive as I had expected it to be. However, I believe one of the key issues was that fact that my router, a D-Link DI-713P, did not allow DHCP addresses to be relayed out. This is perhaps configurable but I sure couldn't find such a setting within the router configuration screens.
12:50:25 AM
|
