Fixed IP addresses How to Allow PPTP Through Firewalls

88

5.7.2 How PPTP Can Bypass a Proxy Server

A proxy server acts as a go-between for your internal hosts and hosts youll need access to on the Internet. Typically, a proxy server will be the only machine on a network, outside of an Internet server such as SMTP mail, thats allowed to pass through a firewall. An administrator can control who has access to what Internet services outside of the firewall. Although they seem like a perfect match, PPTP will not work with some proxy servers one exception to this is Microsoft Proxy Server 2.0. At this time, PPTP clients and servers dont know how to interoperate with the sockets services on proxy servers. This means that you cant have your PPTP server sitting behind a proxy server on your network. The clients wont be able to get through. If youre running a proxy server, youll still need to keep your RAS server open to the firewall. In such a case, both the RAS server and the proxy server may need to be multi- homed between your router and your local network. Multi-homed servers are connected via two network cards to two separate LAN segments. For these situations, youll want to turn on IP Forwarding routing in the TCPIP Properties for each network card. 89

Chapter 6. Implementing the AltaVista Tunnel 98

The AltaVista Tunnel is a product from Digital Equipment Corporation now Compaq that supports moderately heavy use over a virtual private network connection. As virtual private networks mature, the AltaVista Tunnel continues to evolve, increasing security and adding features and functionality. Now reincarnated as the Altavista Tunnel 98, this client-server package is still a solid solution to a companys VPN needs. In this chapter we introduce some of the advantages, drawbacks, and key concepts to the functionality of the AltaVista solution. Though this is not the only virtual private networking solution, it is one that seems to be taking the lead in this still maturing field. The AltaVista Tunnel 98 is available in two versions: the Extranet Server and the Telecommuter Client. The Extranet server manages connections on the office side, while remote users dial in using Telecommuter Client. The Extranet server itself can also act as a tunnel client, allowing an entire LAN to access a tunnel to a remote LAN. The server keeps a file on each user, defining each user with a username, group name, password, and half of a digital key for the purposes of encryption. Each users client software is configured to issue this information to the server upon initiating a connection. The server secures traffic for the tunnel network with a combination of encryption and conventional authorization using usernames and passwords. This authorization scheme allows remote connections to the tunnel network from any point on the Internet. Each user belongs to one or more groups, and each group gains access to certain systems protected behind the server. The server manages the user groups name and password files, and each groups individual encryption keys. This system gives the enterprise a secure and fairly versatile solution to implementing a virtual private network, without a great expense in administrative time and headaches. While the AltaVista Tunnel Extranet Edition can be used on a computer running other network services, it is advised that this server be managed as a highly trusted system, as the AltaVista Tunnel software handles key generation and management, and authorizes remote tunnel clients. In other words, you should isolate it physically and remove non-essential software. The Telecommuter Client manages each virtual private network connection that the user has access to, allowing for multiple group configurations, keys, and routing information. The tunnel session from the end user side of the connection is transparent to the users Internet service provider, as the remote tunnel server handles all virtual IP assignments and routing information. The virtual IP address is assigned from a defined range in the Extranet servers configuration. These IP addresses are assigned to connecting users for the purpose of routing tunnel traffic. The end users PC then connects to the private network as if it were a node on the local network. The tunnel session is secure, and transparent to the end user. The AltaVista Tunnel Extranet server is available for Windows NT 4.0 SP3 or later, or Digital Unix. The AltaVista Tunnel Telecommuter Client is available for Windows NT 4.0 SP3 or later, MacOS v.8.0, or the Windows 9598 operating systems.