This article explains how to configure a VPN server on Windows 2016 or 2012 to route traffic to specific IP addresses through your VPN.
Update the network adapter drivers
First, download the Latest virtio-win iso drivers from https://fedoraproject.org/wiki/Windows_Virtio_Drivers. Look for the Latest version; the download URL is usually https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-virtio/virtio-win.iso
Go to Downloads and mount the downloaded ISO file by double-clicking it.
On the desktop, right-click “Este equipo” and select propiedades. In the next window, click “Administrador de Dispositivos”.
In Device Manager, expand “Adaptadores de Red”, right-click the first network adapter, and select “Actualizar software de controlador…”:
In the next window, click “Buscar software de controlador en el equipo”, click the browse button, and locate the CD drive, NetKVM, and the folder for your operating system. In this article, the path is: D:\NetKVM\2k16
During the update, it is normal to lose the connection to the server for a few seconds. Once it finishes, you should see a window like this:
Repeat the previous step for the second network adapter.
In a command prompt window, run “ipconfig” and leave the window open to see which adapter has the public IP address, in this case 46.183.XXX.XXX. Go to “Panel de control > Redes e Internet > Centro de redes y recursos compartidos” and click “Cambiar la configuración del adaptador”. Right-click the adapter with the public IP address (46.183.XXX.XXX in this case) and click “Propiedades”. In the window that opens, double-click “Protocolo de Internet versión 4 (TCP/IPv4)”. In this window, select “Usar la siguiente dirección IP” and enter the details shown by ipconfig, as illustrated below, using your server's IP address:
Restart your server.
Add roles to the Windows server
Open “Administrador del servidor” and click “Administrar > Agregar roles y características” in the upper-right corner. In the wizard that appears, click “Siguiente” until you reach “Roles del Servidor”. In this section, enable “Acceso Remoto” and “Servidor DHCP”:
Click “Siguiente” until you reach “Acceso Remoto > Servicios de rol”. Here, enable “Direct Access y VPN (RAS)” and “Enrutamiento”:
Adding these roles will most likely install others, such as IIS. Keep clicking “Siguiente” until the final step, where you will see an “Instalar” button.
Create an SSL certificate (required for IPsec)
Open “Administrador de Internet Information Services (IIS)”, double-click your server's name, then double-click “Certificados de servidor”. In the certificates window that opens, click “Crear certificado autofirmado” on the right, enter a name, and click “Aceptar”.
Configure the VPN
Now configure the VPN. Click the flag at the top of Server Manager, then click “Abrir el Asistente para introducción”:
In the next window, click “Implementar solo VPN” to open “Enrutamiento y acceso remoto”. Right-click the server and select “Configurar y habilitar Enrutamiento y acceso remoto”. In the next window, click “Siguiente” and select “Acceso a red Privada Virtual (VPN) y NAT”, then click “Siguiente” and “Finalizar”. Right-click the server again and select “Propiedades”. Go to the “Seguridad” tab, enable “Permitir la directiva IPsec…”, and fill in the “Clave previamente compartida” field, using prekeyVPN in our example. Under Certificado, find the certificate you created in the previous step.
On the “IPv4” tab, change the adapter to the one with IP address 10.0.0.1 (Ethernet 3 in our case) and click “Aceptar”.
In the same “Enrutamiento y acceso remoto” window, expand “IPv4” and go to “Agente de retransmisión DHCP”. Right-click the right-hand pane (which shows Interno), click “Interfaz nueva”, and select the adapter with IP address 10.0.0.1 (Ethernet 3 in our case).
Now, in the “Enrutamiento y acceso remoto” window, go to “NAT”, right-click the right-hand pane, click “Interfaz nueva”, and select the adapter with IP address 46.183.XXX.XXX (Ethernet 2 in our case).
Configure DHCP
Once installation is complete, the first step is “Completar la configuración DHCP”. To do this, click the flag at the top of Server Manager:
In the window that appears, simply click “Confirmar” and then “Cerrar”.
Now open “Herramientas administrativas > DHCP”, expand your server, right-click “IPv4”, and select “Ámbito Nuevo”.
Under Nombre, enter “Ámbito 10.0.0.0” and click “Siguiente”. Complete the next window as shown in the following image:
Under “Agregar exclusiones y retraso”, configure the IP address range by clicking “Agregar”:
Keep clicking “Siguiente”, leaving all fields as they are, until you reach “Finalizar”.
Once the scope has been created, expand it, right-click “Opciones de ámbito”, and select “Configurar opciones”. In the window that opens, scroll to the bottom and enable “121 Rutas estáticas sin clase”. Click the “Agregar ruta…” button and add 2 routes:
- 10.0.0.0 | 255.255.255.0 | 10.0.0.1 //private range
- 172.27.0.0/22 | 255.255.252.0 | 10.0.0.1 //Clouding public range
- 46.183.112.0/21 | 255.255.248.0 | 10.0.0.1 //Clouding public range
- 80.240.126.0/23 | 255.255.254.0 | 10.0.0.1 //Clouding public range
- 85.208.20.0/21 | 255.255.248.0 | 10.0.0.1 //Clouding public range
- 93.189.88.0/19 | 255.255.224.0 | 10.0.0.1 //Clouding public range
- 103.23.60.0/23 | 255.255.254.0 | 10.0.0.1 //Clouding public range
- 161.22.40.0/21 | 255.255.248.0 | 10.0.0.1 //Clouding public range
- 185.166.212.0/21 | 255.255.248.0 | 10.0.0.1 //Clouding public range
- 185.253.152.0/22 | 255.255.252.0 | 10.0.0.1 //Clouding public range
- 185.254.204.0/22 | 255.255.252.0 | 10.0.0.1 //Clouding public range
- 213.192.233.0/24 | 255.255.255.0 | 10.0.0.1 //Clouding public range
- 217.71.200.0/21 | 255.255.248.0 | 10.0.0.1 //Clouding public range
Now configure your second network adapter with IP address 10.0.0.1.
Create users with VPN access
Open “Administración de equipos” and go to “Usuarios y grupos locales”. Right-click “Usuarios” and select “Usuario nuevo…”. In our example, we use userVPN as the username and passVPN as the password (use strong passwords; this is an example).
Now double-click the user you created and go to the “Marcado” tab. Change “Permiso de acceso a redes” to “Permitir acceso”.
You can repeat the previous steps to create more users if you want to control who connects.
Configure the Clouding firewall
To connect to your VPN using the PPTP protocol, add the following rules to your Clouding firewall:
To connect to your VPN using the IPsec protocol, add the following rules to your Clouding firewall: