Solved

Internal vs external vpn

Posted on 2011-09-30
4
283 Views
Last Modified: 2012-06-27
We have a standard Windows 2003 vpn set up.   The firewall does port forwarding for vpn connections from the Internet to a dedicated  Win2003 rras.  We have only allowed remote access to the domain on a case by case basis, enabling Dial In on users domain accounts in AD.  We are using pptp to do this.

Now we have a situation where we want to allow numerous users to connect via vpn from inside by using the the vpn server's private local ip address using wireless laptops (which are secured through the wireless system) .   In testing, this works well and allows us to have staff log on to a laptop with a generic log on and then gain Windows authentication when they do the vpn connection.  

The issue is that we don't want to give staff Dial In rights from the Internet (and don't want to enable through each and every use account).   So far my solution is to set up a separate vpn server for the internal use.   Before doing that, I'm wondering if there is a way to set up a way for the one rras server to distiguish between the internal and external users even though they are coming in on the same private internal ip address?
0
Comment
Question by:Dgreenbaum
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 24

Expert Comment

by:Sandeshdubey
ID: 36895982
For the internal user who are in Active Directory, you can set the dial-in properties on the Dial-in tab in the user account in Active Directory Users and Computers.

Refer this links:
http://technet.microsoft.com/en-us/library/cc738142(WS.10).aspx
http://technet.microsoft.com/en-us/library/cc995159.aspx
http://stackoverflow.com/questions/892958/how-can-i-get-the-active-directory-dialin-permission-setting-from-ldap-using-vbsc

0
 
LVL 70

Accepted Solution

by:
Qlemo earned 250 total points
ID: 36908794
No, you cannot differ between internal and external dial-in - for RRAS, it is the same. But maybe you can restrict the accounts used to login only from specific PCs.
0
 

Author Comment

by:Dgreenbaum
ID: 36911055
Thanks Qlemo.... I'm going to set up a second rras and work with Remote Access Policies to get the right people access to it.
0
 

Author Closing Comment

by:Dgreenbaum
ID: 36911074
he saw through my dilemma and gave a clear answer
0

Featured Post

IoT Devices - Fast, Cheap or Secure…Pick Two

The IoT market is growing at a rapid pace and manufacturers are under pressure to quickly provide new products. Can you be sure that your devices do what they're supposed to do, while still being secure?

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A quick step-by-step overview of installing and configuring Carbonite Server Backup.
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

617 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question