I want to create a site-to-site
VPN connection from our branch
office to the corporate datacenter
by using RRAS on our Windows
server. Our basic broadband firewall/router supports pass-through
for outgoing PPTP connections,
and I think I've correctly configured the site-to-site VPN on the
RRAS servers at the branch office
and at the datacenter. But I don't
know how to get the PCs on our
branch network to use the RRAS
server when they want to communicate with servers at the datacenter and the firewall when accessing
the Internet. In many scenarios,
the VPN server is also the router
connecting the LAN to the Internet. In our case, I can't replace
the router with a Windows server
because of other policies. How can
I solve this problem?
You need to do two more things.
First, you need to configure your
router/firewall to route traffic destined for the datacenter and local
branch network through your local
RRAS server instead of directly over
the Internet. To do this, you need to
know the subnets at the datacenter
to which your local computers need
to communicate. Then you add
some router rules to the firewall so
that it sends packets addressed to
those subnets to the VPN server
instead. While setting up your site-to-site VPN using Windows Help
you should have already added one
or more static routes for the same
subnets that route such traffic over
the VPN connection. Figure 1 shows
a screen print of the route defined
on my local firewall that routes traffic
destined for my other office through 10.42.42.40—the address of my local
VPN server.
With that rule configured, whenever the router sees a packet destined
for your datacenter, it will relay the
packet to your local RRAS server. The
RRAS server encapsulates it into a
PPTP packet and sends it back to the
firewall and out over the Internet.
For what it's worth, you could have
reconfigured your branch DHCP
server to configure DHCP clients
to replace the router as the default
gateway with your RRAS server.
Then the RRAS server would receive
each packet first and route it directly
to the Internet via your firewall or
first through the VPN connection,
as appropriate. I prefer to keep the
router as the default gateway because
if the local RRAS server goes down,
users can still access the Internet,
which wouldn't be the case if the
RRAS server were the default gateway.
You'll also probably need to
change how DNS queries are
resolved by computers at your
branch office. Currently, your DHCP
server is no doubt configuring
computers to use the router as their
primary DNS server. Therefore, DNS
queries for servers at your datacenter
will go unresolved unless you can
configure your firewall to try resolving DNS queries first against an internal DNS server at your datacenter via
your site-to-site VPN. But more likely, you'll need to configure your local
RRAS server as the primary DNS
server for your branch LAN. After
you install DNS on your RRAS server,
you'll create two forwarding entries
so that the server first forwards all
DNS requests to an internal DNS
server at the datacenter, then forwards any unresolved queries to your firewall. You'll also want to configure
your DHCP server to specify your
firewall as the alternate DNS server
for the branch LAN. Then if your
RRAS server goes down, branch computers will still be able to get DNS
queries for Internet sites resolved,
preserving Internet access.