Public Name Resolution Through a VPN Connection
The first time you establish a successful VPN connection to your remote server, you might have trouble with public name resolution (e.g., DNS, WINS). For example, you might not be able to launch a browser on a remote system to connect to a public Web site on the Internet. Because your VPN server is a completely separate LAN, you need to configure name resolution separately, too. Fortunately, there's a bulletproof way to handle name resolution on the client side without having to address the security implications of handling it on the VPN server—through your default Internet connection (i.e., your ISP).
However, before I show you how to set up public name resolution, I should point out that setting it up on your VPN server isn't necessarily a good idea. Indeed, many administrators deliberately set up their VPN servers without it. Two schools of thought exist about denying public name resolution through a VPN server. The first school asserts that the purpose of a VPN is to provide secure access to corporate LAN resources. Therefore, leveraging the corporate VPN as a springboard to public Internet sites is unnecessary. The second school centers on security. Providing public Internet access through a VPN connection is just one more exposed route that a malicious intruder can attack. So, many IIS administrators choose either not to provide name resolution at all through VPN connections or to provide only internal name resolution for internal servers (i.e., internal DNS).
If, however, your clients or administrators require access to resources outside the VPN, you can configure your VPN connection to handle public name resolution outside your VPN server. To do so for a Win2K VPN, follow these steps:
- Choose Start, Settings, Network and Dial-up Connections.
- Right-click your VPN connection, then select Properties.
- Click the Networking tab.
- Select Internet Protocol (TCP/IP) from the components list, then click Properties.
- Click Advanced, then click the General tab, which Figure 4, page 10, shows.
- Clear the Use default gateway on remote network check box. (This check box is selected by default.)
The Use default gateway on remote network check box controls the route used for connections to remote servers. By clearing this check box, your Internet connection rather than the remote server handles the routing. This connection provides a secure connection to the servers on your LAN through the VPN. Any access to the public Internet will be routed through your Internet connection, where your ISP handles public name resolution.
VPN Connectivity Through Windows CE
At the time of this writing, Windows CE .NET (code-named Talisker) was in beta 2 and publicly available. This new version of Windows CE will ship not only with a VPN client but also with its own version of Terminal Services. Figure 5 shows the Windows CE VPN configuration screen. Web-exclusive Figure 1, which you can access from the Windows Web Solutions Web site (http:// www.windowswebsolutions.com, InstantDoc ID 23575), shows the Windows CE Terminal Services client.
Windows CE .NET will feature PPTP support. With this support, you can secure the transfer of data from a remote Windows CEbased client running on form factors as small as a pocket PC to a private enterprise server by creating a VPN across a TCP/IP-based network. Windows CE .NET will also feature RDP 5.0 support, which connects a Windows CEbased client to a Win2K- or Windows NT 4.0based server that's running Terminal Services. As Web-exclusive Figure 2 shows, you can securely administer a production IIS server remotely from a wireless pocket PC by running Internet Services Manager (ISM) over Terminal Services. You'll be able to administer IIS servers remotely on handheld computers that have the same tools you use on desktop PCs!
Up and Running with VPN
Installing and configuring a VPN server for secure remote access is one of the more complex operations in Win2K. Configuring VPN client access is also complex. Now, you have the foundation to get your VPN client connectivity running securely and effectively. Next month, I'll dive into the Microsoft SMTP Service and show you how to automate sending email from your Web servers.
End of Article
Register
Do you have any idea about setting it up on the domain?
edon July 29, 2003