How to restrict clients on VPN

[Mamun Shaheed]

I have a win2k VPN server. I want to restrict clients base
on IP. Only specifice IP will be able to dail my server.
How can I do that

Mamun

 

[Steven L Umbach]

You could create firewall rules for the appropriate ports on your
firewall based om pptp/l2tp and you can use remote access policies by
editing the profile where you can set up packet filters. --- Steve

 

[Mamun Shaheed]

Thanks Steve,
Can you explain it a bit more or can u give me any link
where I can find details

 

[Al Smith]

try this link... i've done it before, if i remember correctly it's
pretty easy...

http://www.microsoft.com/technet/tr...er2003/proddocs/entserver/vpn_server_role.asp

 

[Steven L Umbach]

Depending on whether you are using pptp or l2tp, you can create a
firewall/packet filtering rule to control access to your vpn server.
Assuming you are using pptp for instance, a rule could be created that would
allow inbound traffic to your vpn server through port 1723 tcp and protocol
47 gre from only the allowed ip address. You could also do something
similar in rras via remote access policies where you could edit the profile,
select ip and then input filters and possibly select permit only the packets
below where you could create rules for allowed ip addresses to your vpn
server/lan. --- Steve

http://tinyurl.com/ea5d --- Example of firewall setup for various vpn
configurations.

 

[Steven L Umbach]

I may need to clarify. Firewall rules would be needed to restrict
traffic from a "public" ip address while remote access policy ip filtering
would be used to restrict traffic to "private" ip addresses after the
initial vpn connection had been made. --- Steve

 

[Mamun Shaheed]

Thanks steve,
It was realy helpful.
Mamun Shaheed

-----Original Message-----
I may need to clarify. Firewall rules would be needed to restrict
traffic from a "public" ip address while remote access policy ip filtering
would be used to restrict traffic to "private" ip addresses after the
initial vpn connection had been made. --- Steve


[email protected]... be created that
would 1723 tcp and
protocol could edit the
profile, permit only the
packets


.