Topic: VPN connection to M$ Small Business Server

[rkscscc]

Hi Guys,

My first post here, and before anyone asks, I did do a search and couldn't find an answer...

I discovered SME a month ago, and boy, has it changed my life drastically... For the better  

Here's my problem...

I have a client, who is on a remote site.  I've installed SME for him, and he is over the moon with the new security/speed/stability of his network...  But, his main office is 200km's away running SBS as their main office server.  SBS is not really made for remote connections but does allow user to VPN in in order to check email, work on local SBS sites and access various other things.

Problem with SBS is it only allows 1 concurrent VPN connection for a single IP adress.  So, with 5 users on my remote site, all needing to connect over the VPN, the only solutions right now is for every user to manually dial the PPPOE connection for ADSL and then dial the VPN in order to gain access to SBS.

The problem in this is SARG is not reporting whats happening, logs on SQUID shows barely anything, because they come in in the morning, dial the PPPOE/VPN and then just sits on that the whole day.

One solution is offcourse to spend 8k ZAR on a nice Cisco router with multiVPN connectors between the two sites in order for them to be bridged onto the main network, thus cancelling out the need to dial PPPOE/VPN connections.  But I see this as a problem.  I'm not just someone who will go and tell my client to spend a load of money on something for which we already have a 30second solution for...

Yes, it's a pain in the butt, they get peeved when forgetting to dial PPPOE first, but I still see that as a cheaper option than spending money and having some extra hardware that could cause problems in the future.

SME server is set up as Private Server / Gateway.  PS is on static IP, Gateway on DHCP via PPPOE.

What my question is, is this:  Having to deal with the main site IT guy being worried about security (running MS and all), and him freaking out everytime I suggest something, is there a way that I could set up a VPN connection on SME to connect to SBS?

I have only recently discovered the joys of linux, and allthough I'm learning every day, I'm still a newb.  So bear with me.  I have been a MS guy in the past, best solution sometimes being format/re-install, but luckily the light at the end of my tunnel came on and linux dropped into my lap.  So bearing the above in mind, is there anyone who can help me figure out a solution for this?

I've read posts about OpenVPN routing and bridging, but am unsure whether these will work in my situation.  The IT guy at the main site refuses to help in any way as he sees Linux as unsecure, a threat to to his position in the company, and most possible myself as a threat as I sorted out a network in 3 days with Linux which he couldn't sort out in a year.

So, any extra configuring on SBS is out, all and anything would need to be done locally and tested without having to request any changes on their side.

Thank you in advance for suggestions and help.

[rkscscc]

anyone?

[CKConsulting]

With out the cooperation of the other IT guy it's not going to be easy.
Suggestions:
    Add an SME server to another public IP on the office network.  VPN sme 2 sme.
    See if Open VPN runs on Win SBS?
    Figure out how to allow more that one IP to connect to MS SBS server and teach the guy how to do it.
    Look into OpenSwan

Sorry not much help

Rick

[rkscscc]

Hi Rick, thanks for the options....

Add SME server to his network -->  Says it's a security risk, doesn't want to add SME inbetween net and SBS...
OpenVPN -- He refuses to install anything on his machine, everything is a security risk
Multi IP's --> Solution like i mentioned is every user dials PPPOE, it's a problem with SBS as it's made for single sites, not remote sites
OpenSwan --> only runs on Linux as far as I can see, so won't be able to have it running on SBS, even if mr MS decides to let it run


Any other options?

[CKConsulting]

A little hokey, but..........it might work.
You could set up a vpn tunnel on one PC's and setup internet connection sharing.
Use SME as a router and point all traffic to that subnet to forward to the pc with the VPN.

[rkscscc]

A little hokey, but..........it might work.
You could set up a vpn tunnel on one PC's and setup internet connection sharing.
Use SME as a router and point all traffic to that subnet to forward to the pc with the VPN.

That might work, thought about that but it got cancelled in my head long before I gave it much thought...  Mind jumping on Skype and helping me with some pointers? skypename riaanstrydom

Thanks Rick

[CKConsulting]

I'm downloading skype now.

[MSmith]

Another alternative might be to abandon NAT and get static IPs for the workstations; each could then have its own VPN connection to the SBS.

[rkscscc]

Static IP's are not an option, client has various guys from H/O coming and going on an ongoing basis, so that would mean i spend loads of time there having to set them up because they don't have a dedicated IT guy onsite...

Thanks for the suggestion though...  Still working on Rick's solution, can't get the thing running properly, but, in all fairness, I can't see myself spending ages there trying to solve something for which I already have a solution...

Thanks to everyone who helped...    Much appreciated

[mike_mattos]

I'm not thrilled with VPN's, so I am using radmin (famatech.com)  to allow remote people to access a local computer.  Thus the local people can see the activity on screen and can administer the "local" machine too!

[ayster]

What about using a spearate firewall/gateway like IPCop, we use it successfully here, (25+sites around the UK and Europe) you can do net2net vpns though it..

 You'd have 2 ipcops, one on the site with the SME server and the other on site with the SBS. You can then setup a secure tunnel from 1 ipcop to the other, then you can access the SBS shares in the normal manner from the SME server site, you will probably have to have the SBS server in your DNS table for name resolution on the SME server end, other than that, the only other config is on the SBS's network, to use the IPCop as its gateway, and the same on the SME's network.

You obviously need to have different network IP addresses on the two sites i.e one might be 192.168.1.0/24 the other couldn't be the same, would have to be something different, like 192.168.2.0/24.

The IT guy can't complain that a dedicated firewall is insecure!