General VPN question

[00u1a4mhonyhBNot75d7]

Hi,

Pretty new in the VPN area, and the question is pretty standard knowledge in VPN i believe, but I hope I could get some knowledge and support here,

Trying to configure a VPN connection to my LAN through a gateway device. The gatway has a WAN port and a LAN port.

• I have a machine running as VPN server with user control in windows - connected on the LAN side of the gatway.
• The Gateway is connected to the internet through WAN side, internet is going through fine on the clients on LAN.
• Configured Remote User VPN L2TP network on the gateway, directs the user control to the VPN server in LAN.
• Connecting to the VPN using windows Radius VPN settings on my PC to a given IP address - gateway WAN address

First I tested the VPN using a simple internet router with wifi. The gateway WAN was connecting to this simple router and i connected my PC to the routers own wifi. I could then connect my PC with my VPN user through the gatway by pointing on the gatway WAN IP address (in Radius settings).

Now, instead the the gateway WAN side is now connected to a larger network behind NAT. My question is, where shall I point my PC VPN connection to ??- the Radius settings need and IP address to point at. I'm pretty lost here.  the question is - how do you point the VPN connection to that gateway from external internet connect,  by a public address or how ? 

[pieterh · Accepted solution]

the "larger network using NAT" may be unwilling to make your VPN server accessible, as this bypasses their own security

apart from above, look at the components separately
- the VPN server
- the radius server
- the authentication server that the radius server is pointing at (the radius itself does not do authentication, it is only an intermediate)

these probably all are local addresses within the LAN ?

the VPN server needs to be accessible from the "outside" 
-> the "larger network using NAT" should map a public IP incoming to the LAN IP of the VPN-server
if your own gateway also performs NAT the configuration is more complex,
then above should map to your gateway and your gateway should do a second NAT tot your LAN addresses

[00u1a4mhonyhBNot75d7]

Hi pieterh,

Thanks for your reply.  

regarding VPN server accessible in the larger network,  yes that is something they have to allow the traffic of course, UDP port 500,4500 and 1701 should be forwarded to my gateway IP.

Correct, All components are placed on the LAN side. Only my gateway have a WAN side and is the VPN server, and is directing the VPN to the LAN side, that is tested to be working on the test setup.  

You are saying:  "the "larger network using NAT" should map a public IP incoming to the LAN IP of the VPN-server" 

 You mean to the WAN side of my VPN gateway  right ?      is this something they have to configure in their (owner of the larger network) router then ? does that means that you see the the WAN side of the gatway as it was directly connectet to the internet, can you please describe ?   

[pieterh]

Do i understand correct there is only one gateway involved? and this is the same device as the "VPN gateway" ?
Yes then it should map tot the WAN side of the VPN gateway
yes

- the vpn-client connects to the public ip

- the external network translates  this to the ip of the WAN interface

- the vpn-client needs no knowledge of the local ip of the WAN interface

[00u1a4mhonyhBNot75d7]

yes, only one gateway.  this is the same device taking care of the VPN connection.  this gateway is on my administration.

So the "only" thing i need is that my gateway gets mapped a public internet IP address,  by the larger network provider   

[pieterh]

Yes, as far as I can tell from the info in the posts

[00u1a4mhonyhBNot75d7]

thanks ! appreciate the help