VPN servers and firewall configuration

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

There are two approaches to using a firewall with a VPN server:

• VPN server in front of the firewall. The VPN server is attached to the Internet, and the firewall is between the VPN server and the intranet.

• VPN server behind the firewall. The firewall is attached to the Internet, and the VPN server is between the firewall and the intranet.

VPN server in front of the firewall

When the VPN server is in front of the firewall and attached to the Internet, you need to add packet filters to the Internet interface that allow only VPN traffic to and from the IP address of the VPN server's Internet interface.

For inbound traffic, when the tunneled data is decrypted by the VPN server, it is forwarded to the firewall. Through the use of its filters, the firewall allows the traffic to be forwarded to intranet resources. Because the only traffic that crosses the VPN server is generated by authenticated VPN clients, in this scenario, firewall filtering can be used to prevent VPN users from accessing specific intranet resources. Because the only Internet traffic allowed on the intranet must pass through the VPN server, this approach also prevents the sharing of File Transfer Protocol (FTP) or Web intranet resources with non-VPN Internet users.

The following illustration shows the VPN server in front of the firewall.

For the Internet interface on the VPN server, configure the following input and output filters using Routing and Remote Access:

Packet filters for Point-to-Point Tunneling Protocol (PPTP)

Configure the following input filters with the filter action set to Drop all packets except those that meet the criteria below:

• Destination IP address of the VPN server's Internet interface, subnet mask of 255.255.255.255, and TCP destination port of 1723.

  This filter allows PPTP tunnel maintenance traffic from the PPTP client to the PPTP server.

• Destination IP address of the VPN server's Internet interface, subnet mask of 255.255.255.255, and IP Protocol ID of 47.

  This filter allows PPTP tunneled data from the PPTP client to the PPTP server.

• Destination IP address of the VPN server's Internet interface, subnet mask of 255.255.255.255, and TCP [established] source port of 1723.

  This filter is required only when the VPN server is acting as a VPN client (a calling router) in a router-to-router VPN connection. TCP [established] traffic is accepted only when the VPN server initiated the TCP connection.

Configure the following output filters with the filter action set to Drop all packets except those that meet the criteria below:

• Source IP address of the VPN server's Internet interface, subnet mask of 255.255.255.255, and TCP source port of 1723.

  This filter allows PPTP tunnel maintenance traffic from the VPN server to the VPN client.

• Source IP address of the VPN server's Internet interface, subnet mask of 255.255.255.255, and IP Protocol ID of 47.

  This filter allows PPTP tunneled data from the VPN server to the VPN client.

• Source IP address of the VPN server's Internet interface, subnet mask of 255.255.255.255, and TCP destination port of 1723.

  This filter is required only when the VPN server is acting as a VPN client (a calling router) in a router-to-router VPN connection. TCP [established] traffic is sent only when the VPN server initiated the TCP connection.

For more information, see Add PPTP Filters.

Packet filters for Layer Two Tunneling Protocol over Internet Protocol security (L2TP/IPSec)

Configure the following input filters with the filter action set to Drop all packets except those that meet the criteria below:

• Destination IP address of the VPN server's Internet interface, subnet mask of 255.255.255.255, and UDP destination port of 500.

  This filter allows Internet Key Exchange (IKE) traffic to the VPN server.

• Destination IP address of the VPN server's Internet interface, subnet mask of 255.255.255.255, and UDP destination port of 1701.

  This filter allows L2TP traffic from the VPN client to the VPN server.

• Destination IP address of the VPN server's Internet interface, subnet mask of 255.255.255.255, and UDP destination port of 4500.

  This filter allows IPSec network address translator traversal (NAT-T) traffic.

Configure the following output filters with the filter action set to Drop all packets except those that meet the criteria below:

• Source IP address of the VPN server's Internet interface, subnet mask of 255.255.255.255, and UDP source port of 500.

  This filter allows IKE traffic from the VPN server.

• Source IP address of the VPN server's Internet interface, subnet mask of 255.255.255.255, and UDP source port of 1701.

  This filter allows L2TP traffic from the VPN server to the VPN client.

• Source IP address of the VPN server's Internet interface, subnet mask of 255.255.255.255, and UDP source port of 4500.

  This filter allows IPSec NAT-T traffic.

For more information, see Add Add L2TP over IPSec Filters.

There are no filters required for Encapsulating Security Payload (ESP) traffic at the IP protocol of 50. The ESP header is removed by the IPSec components before the L2TP packet is passed to Routing and Remote Access.

Important

• An IPSec NAT-T deployment for Windows that includes VPN servers that are located behind network address translators is not recommended. When a server is behind a network address translator, and the server uses IPSec NAT-T, unintended behavior might occur because of the way network address translators translate network traffic.

VPN server behind the firewall

In a more common configuration, the firewall is attached to the Internet, and the VPN server is an intranet resource that is attached to the Perimeter Network. The VPN server has an interface on both the perimeter network and the intranet. In this scenario, the firewall must be configured with input and output filters on its Internet interface that allow tunnel maintenance traffic and tunneled data to pass to the VPN server. Additional filters can allow traffic to pass to Web, FTP, and other types of servers on the perimeter network. For an additional layer of security, the VPN server can also be configured with PPTP or L2TP/IPSec packet filters on its perimeter network interface.

Because the firewall does not have the encryption keys for each VPN connection, it can filter only on the plaintext headers of the tunneled data. In other words, all tunneled data passes through the firewall. This is not a security concern, however, because the VPN connection requires an authentication process that prevents unauthorized access beyond the VPN server.

The following illustration shows the VPN server behind the firewall on the perimeter network.

For both the Internet and perimeter network interfaces on the firewall, configure the following input and output filters using the firewall's configuration software:

Packet filters for PPTP

Separate input and output packet filters can be configured on the Internet interface and the perimeter network interface.

Filters on the Internet interface

Configure the following input packet filters on the Internet interface of the firewall to allow the following types of traffic:

• Destination IP address of the VPN server's perimeter network interface and TCP destination port of 1723 (0x6BB).

  This filter allows PPTP tunnel maintenance traffic from the PPTP client to the PPTP server.

• Destination IP address of the VPN server's perimeter network interface and IP Protocol ID of 47 (0x2F).

  This filter allows PPTP tunneled data from the PPTP client to the PPTP server.

• Destination IP address of the VPN server's perimeter network interface and TCP source port of 1723 (0x6BB).

  This filter is required only when the VPN server is acting as a VPN client (a calling router) in a router-to-router VPN connection. This filter should be used only in conjunction with the PPTP packet filters described in VPN server in front of the firewall and configured on the VPN server's perimeter network interface. By allowing all traffic to the VPN server from TCP port 1723, there exists the possibility of network attacks from sources on the Internet that use this port.

Configure the following output filters on the Internet interface of the firewall to allow the following types of traffic:

• Source IP address of the VPN server's perimeter network interface and TCP source port of 1723 (0x6BB).

  This filter allows PPTP tunnel maintenance traffic from the VPN server to the VPN client.

• Source IP address of the VPN server's perimeter network interface and IP Protocol ID of 47 (0x2F).

  This filter allows PPTP tunneled data from the VPN server to the VPN client.

• Source IP address of the VPN server's perimeter network interface and TCP destination port of 1723 (0x6BB).

  This filter is required only when the VPN server is acting as a VPN client (a calling router) in a router-to-router VPN connection. This filter should be used only in conjunction with the PPTP packet filters described in VPN server in front of the firewall and configured on the VPN server's perimeter network interface. By allowing all traffic from the VPN server to TCP port 1723, there exists the possibility of network attacks from sources on the Internet using this port.

Filters on the perimeter network interface

Configure the following input filters on the perimeter network interface of the firewall to allow the following types of traffic:

• Source IP address of the VPN server's perimeter network interface and TCP source port of 1723 (0x6BB).

  This filter allows PPTP tunnel maintenance traffic from the VPN server to the VPN client.

• Source IP address of the VPN server's perimeter network interface and IP Protocol ID of 47 (0x2F).

  This filter allows PPTP tunneled data from the VPN server to the VPN client.

• Source IP address of the VPN server's perimeter network interface and TCP destination port of 1723 (0x6BB).

  This filter is required only when the VPN server is acting as a VPN client (a calling router) in a router-to-router VPN connection. This filter should be used only in conjunction with the PPTP packet filters described in VPN server in front of the firewall and configured on the VPN server's perimeter network interface. By allowing all traffic from the VPN server to TCP port 1723, there exists the possibility of network attacks from sources on the Internet using this port.

Configure the following output packet filters on the perimeter network interface of the firewall to allow the following types of traffic:

• Destination IP address of the VPN server's perimeter network interface and TCP destination port of 1723 (0x6BB).

  This filter allows PPTP tunnel maintenance traffic from the PPTP client to the PPTP server.

• Destination IP address of the VPN server's perimeter network interface and IP Protocol ID of 47 (0x2F).

  This filter allows PPTP tunneled data from the PPTP client to the PPTP server.

• Destination IP address of the VPN server's perimeter network interface and TCP source port of 1723 (0x6BB).

  This filter is required only when the VPN server is acting as a VPN client (a calling router) in a router-to-router VPN connection. This filter should be used only in conjunction with the PPTP packet filters described in VPN server in front of the firewall and configured on the VPN server's perimeter network interface. By allowing all traffic to the VPN server from TCP port 1723, there exists the possibility of network attacks from sources on the Internet using this port.

Packet filters for L2TP/IPSec

Separate input and output packet filters can be configured on the Internet interface and the perimeter network interface.

Filters on the Internet interface

Configure the following input packet filters on the Internet interface of the firewall to allow the following types of traffic:

• Destination IP address of the VPN server's perimeter network interface and UDP destination port of 500 (0x1F4).

  This filter allows IKE traffic to the VPN server.

• Destination IP address of the VPN server's perimeter network interface and UDP destination port of 4500 (0x1194).

  This filter allows IPSec NAT-T traffic to the VPN server.

• Destination IP address of the VPN server's perimeter network interface and IP Protocol ID of 50 (0x32).

  This filter allows IPSec ESP traffic from the VPN client to the VPN server.

Configure the following output packet filters on the Internet interface of the firewall to allow the following types of traffic:

• Source IP address of the VPN server's perimeter network interface and UDP source port of 500 (0x1F4).

  This filter allows IKE traffic from the VPN server.

• Source IP address of the VPN server's perimeter network interface and UDP source port of 4500.

  This filter allows IPSec NAT-T traffic from the VPN server.

• Source IP address of the VPN server's perimeter network interface and IP Protocol ID of 50 (0x32).

  This filter allows IPSec ESP traffic from the VPN server to the VPN client.

There are no filters required for L2TP traffic at the UDP port of 1701. All L2TP traffic at the firewall, including tunnel maintenance and tunneled data, is encrypted as an IPSec ESP payload.

Important

• An IPSec NAT-T deployment for Windows that includes VPN servers that are located behind network address translators is not recommended. When a server is behind a network address translator, and the server uses IPSec NAT-T, unintended behavior might occur because of the way network address translators translate network traffic.

Filters on the perimeter network interface

Configure the following input packet filters on the perimeter network interface of the firewall to allow the following types of traffic:

• Source IP address of the VPN server's perimeter network interface and UDP source port of 500 (0x1F4).

  This filter allows IKE traffic from the VPN server.

• Source IP address of the VPN server's perimeter network interface and UDP source port of 4500.

  This filter allows IPSec NAT-T traffic from the VPN server.

• Source IP address of the VPN server's perimeter network interface and IP Protocol ID of 50 (0x32).

  This filter allows IPSec ESP traffic from the VPN server to the VPN client.

Configure the following output packet filters on the perimeter network interface of the firewall to allow the following types of traffic:

• Destination IP address of the VPN server's perimeter network interface and UDP destination port of 500 (0x1F4).

  This filter allows IKE traffic to the VPN server.

• Destination IP address of the VPN server's perimeter network interface and UDP destination port of 4500 (0x1194).

  This filter allows IPSec NAT-T traffic to the VPN server.

• Destination IP address of the VPN server's perimeter network interface and IP Protocol ID of 50 (0x32).

  This filter allows IPSec ESP traffic from the VPN client to the VPN server.

There are no filters required for L2TP traffic at the UDP port of 1701. All L2TP traffic at the firewall, including tunnel maintenance and tunneled data, is encrypted as an IPSec ESP payload.

Important

• An IPSec NAT-T deployment for Windows that includes VPN servers that are located behind network address translators is not recommended. When a server is behind a network address translator, and the server uses IPSec NAT-T, unintended behavior might occur because of the way network address translators translate network traffic.