Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Can I restrict (windows 2003/8) PPTP VPN access based on computer name (and/or IP address)

Posted on 2011-02-14
5
Medium Priority
?
1,397 Views
Last Modified: 2012-05-11
We are testing setting up a Windows 2008 box for incoming VPN connections.  I can make a successful connection from a remote machine and access network resources. I restrict by user and time of day.

Is it possible to restrict by computer name also, using PPTP?
How about the incoming client public IP address?

Our VPN server has a single NIC and running Network Policy Server (NPS) locally. Firewall is passing the tcp port.
Remote computers are mostly XP Pro.  Some Win7 may come in to play soon.

None of the remote machines are planned to be part of the domain. One of the two test machines is a domain workstation and the other is not.  Not sure if we plan to make them part of the domain or not as I have not been able to successfully execute log on scripts, which would be the major benefit for us.  (but that is another issue)

0
Comment
Question by:PlazaProp
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 71

Accepted Solution

by:
Qlemo earned 1000 total points
ID: 34892673
To the best of my knowledge you cannot restrict PPTP connections by computer name.
You can put a firewall restriction on clients' public IPs before they reach the PPTP server, of course.
0
 
LVL 1

Author Comment

by:PlazaProp
ID: 34893316
Qlemo,  Are you suggesting that some setting be modified on the firewall on the edge of our network or the firewall on the windows server box?  I don't see anything in windows that will allow restriction by IP.  

I am not sure if I can restrict the port by IP address on our firewall but I am investigating.
0
 
LVL 39

Expert Comment

by:ChiefIT
ID: 34893757
TACACS and RADIUS servers can use Multiple means of authentication prior to getting an IP through the VPN. It' s probably your best bet. TACACS can use AD for authentication. So, you can split AAA on a TACACS server. However RADIUS servers hold Authentication, Authorization, and Access (AAA)  on the one server.

A second option is:
Also, MAC address filtering on the switches will prevent them from getting anywhere within the network, if the MAC address isn't enabled on the switches. But, that is VERY admin intensive unless you only have a few machines. So, on your router, a MAC address filter ACL through the VPN connection will limit only the machines with those MAC addresses through your VPN tunnel.
0
 
LVL 71

Expert Comment

by:Qlemo
ID: 34894731
MAC address filtering will not work, as VPN connections do not maintain the original MAC addresses. MAC addresses are a feature of local networks only.

IP filtering can be done on several levels. One is the IP Filter list in the NICs TCP/IP properties. But I guess it is much easier to filter on the edge device (which forwards the VPN traffic).
0
 
LVL 1

Author Comment

by:PlazaProp
ID: 34896895
MAC address filtering would be nice for road warriors that could have changing IP addresses.  For our initial roll out the clients all have static IP so filtering by IP would work.  I have verified that I can do this on our firewall.  Thanks for the tip.
0

Featured Post

Looking for the Wi-Fi vendor that's right for you?

We know how difficult it can be to evaluate Wi-Fi vendors, so we created this helpful Wi-Fi Buyer's Guide to help you find the Wi-Fi vendor that's right for your business! Download the guide and get started on our checklist today!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Suggested Courses

618 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question