Configuring a Windows VPN and WWW/FTP server

Microsoft has made it so easy to configure a VPN between Windows servers that it has become quite popular for small to mid-sized businesses to use Windows 2000 Server to tunnel between sites across the Internet and RAS users, using Microsoft's Point to Point Tunneling Protocol (PPTP).

To make these VPNs as secure as possible, many administrators make these servers dual-homed with one Network Interface Card on the inside network, and one facing the Internet. It is customary to configure PPTP filtering on the Internet-side so that the only traffic allowed to pass through the server belongs to the encrypted PPTP tunnel. In theory, this practice prevents any users on the Internet from accessing the server and it also prevents the users from accessing the Internet from this point. (This is often used when policy dictates using a proxy server located at the other end of the tunnel for Internet access.)

The problem comes when small businesses, usually cost-conscious, want to also host a web or FTP site on this server, but

    Requires Free Membership to View

don't want to expose their internal network.

One solution to this, for PPTP users, is yet another registry hack. In

you can add an entry "AllowPacketsForLocalMachine" and give it a value of 1 and type REG_DWORD. You may not have the RASPPTPF key unless you've installed and configured Routing and Remote Access.

NOTE: Consult your system administrator before editing your registry. Always make sure you have a current backup of your data and registry before making changes. Manually changing your registry is generally unforgiving and rarely recommended by Microsoft and can void your support.

As you've probably gathered from the name, this entry lets your server receive and respond to traffic without allowing the potential for traffic from the Internet into the internal network directly through the VPN server.

About the author:
Thomas Alexander Lancaster IV is a consultant and author with over ten years experience in the networking industry, focused on Internet infrastructure.


This was first published in May 2002

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.