NAT passthrough to Remote Desktop machine connected via VPN.

[Jed]

Greetings all,

I hope this isn't too unclear. Bear with me please.

Here are the machines involved:

VPNC1 = VPN client1 (windows 2000 Server)
VPNN1 = VPN/NAT server (windows 2003)
RASC1 = Remote client 1 (?hypothetical)
RTR01 = Borrowed office router (small netgear/linksys)


Currently I am in "borrowed" office space. I sit behind a small
router appliance (RTR01) that performs NAT and a simple firewall. The
addresses of the network clients behind RTR01 are in the range
192.168.x.x. VPNC1 is on this borrowed net.

I have a VPN server on the internet (VPNN1) whose address is
206.169.x.x.
If I connect VPNC1 to VPNN1, VPNC1 gets a new address on its PPP
interface= 10.0.0.100. So far it's not bad. Easy.

LAC192.168.2.101 VPNC1--->RTR01--->---->----->VPNN1 206.169.x.x
PPP10.0.0.100 |<---<---RTR01--<---<----<-|


Here's the dilemma: I would like to then allow VPNN1 to pass requests
for a remote desktop session from RASC1 on to VPNC1, using NAT.

I cannot seem to get this final stage to work. VPNN1 has multiple
addresses (6) so I can dedicate one for inbound traffic. I am just not
sure how to do it. Perhaps I need another NIC?
______________________
|VPNN1 206.169.xx.xx
|
192.168.2.101 VPNC1---->-----RTR01-->---> | 10.0.0.x
|
^
|_____________________|
10.0.0.100 |---<-----<---RTR01--<--<----<-|
|
^
|
|
RASC1---->---->---->---->----> -^


To preemptively answer the obvious question of "why not just
pass-through 3389 on RTR01?"
The "borrowed office" has used that port on RTR01 for another service,
so I cannot use RTR01 to this end.
SHOOT!

Thanks in advance, and kind regards.

Jed Needle

 

[Bill Grant]

Your "obvious question" doesn't really come into this at all. Once the
two servers are connected by VPN, the firewall settings and NAT are
effectively bypassed. The VPN data is encrypted and encapsulated. The
router/firewall only sees the "wrapper" details. It doesn't see the
"tunnelled" packets.

It is probably a routing or name resolution problem. When you connect
your remote client, can you ping the target server by name or by either of
its IP addresses (192.168.x.x or 10.0.0.x)?

If you can't ping by IP address, you have a routing problem. If you can
do that but not ping by name, it is a name resolution problem.