Implementing Microsoft Remote Access Server / VPN Server End to End Solution: Installing VPN on Windows Server 2016 - Part 1

Posted by Ahmed Nabil In | 14 comments»
In this four part series I will be going through implementing Microsoft Remote Access Server /VPN only solution on Windows Server 2016 and integrating it with RADIUS / NPS server for Authentication then add on it Azure MFA implementation for second/Multi Factor authentication for VPN Users as sending message or getting a call on your cell phone.

So Why VPN solution ? Microsoft have a very nice solution for Enterprise customers named DirectAccess (Will have a series of articles on its implementation in Server 2016) however it has some requirements on top of them to be corporate domain joined and its not available for all windows Versions (Only Enterprise ones).

Traditional VPN fills this gap by targeting any windows version as Home and Professional and at the same time you can launch it from your home computer, tablet or mobile to connect to your corporate network. This will be very helpful especially nowadays more and more companies are supporting the idea of Bringing Your Own Device (BYOD) which of course can be any version of Windows and its not member in your domain.

Another question will be can I have one server with both VPN and DirectAccess roles co-existing together ? The Answer is Yes however one draw back is that you will loose the Null encryption and you will have to pay the penalty of the DirectAccess IP-HTTPS double encryption. In our Scenario I will go with installing the VPN role on a single server without other roles.

In Part 1 of this series, we will install the VPN Server, configure it and Enable it.

Part 2 of this Series will continue with configuring the VPN properties, integrating it with RADIUS server for authentication.

Part 3 of this series We will configure the VPN on the client machine and deal with common issues and frequent questions as accessing your Shares, DFS root from your VPN client.

In Part 4 of this series we will configure Azure MFA to add second level of authentication for VPN users connecting to our VPN server.

So let us get started by installing our VPN Server on our Windows Server 2016. This Server is 2 NIC server with 1 NIC in our Local Network and the second NIC in the DMZ

For 2 NIC server (Multi-homed server)we need to make sure of the following configuration:

  • You have only one Gateway which will be on the Second NIC (The one on DMZ or External Network), the Internal NIC will have no Gateway.                                                                                      
  • DNS servers will be specified on your internal NIC (This will be your internal DNS servers)                                                               
  • If you have multiple VLANs on your network, you won't be able to reach them from your VPN server since there is no Gateway on your internal NIC. You need to create static routes on the VPN server to these VLANs, For example if you have specific Servers subnet or other subnets as Printers or specific group then you need to create persistent route to this subnet (ROUTE ADD)

Implementing and Configuring VPN on Windows Server 2016 Standard.

  1. Open the Server Manager on your Windows 2016 VPN server and click Add Roles and Features.                                                                                                                                                                                                      
  2. Click Next and pick Role based or Feature based installation                                                                                                                                                              
  3. Ensure Select a server is your option and your server name is displayed and highlighted in the Server Pool below area                                                                                                                                                                                      
  4. Select the Remote Access Role                                                                                                                                                      
  5. Click Next - Add features and then select the first option Direct Access and VPN (RAS) as per the below screen shots                                                                                                                                                                                              
  6.  Click Next for the Web Server (IIS) role installation (This is mainly needed for your Direct Access implementation - Don't forget we picked the role that allow us to install both options, VPN and Direct Access). Click Next on the next screen for the IIS roles services.                                                                                                                                                                                                                   
  7. Confirm all your settings and check the Restart the destination server if required and go ahead for Install - It will take few minutes for the installation.                                                                                                                                                                                                                  
  8. After Installation is done you will get the option to configure the server with the warning sign displayed in your server manager as shown below. I would highly recommend not doing it this way so you can have better and full control on your configuration                                                                                                                                                                                                                                                                                                          
  9.        Instead from Tools, open Remote Access Management - Direct Access and VPN  - Pick the second option Run Remote access setup wizard and choose to deploy VPN only                                                                                                                                                                                                                                                                                                                                                                   
  10. Right Click on your server name - Configure and Enable Routing and Remote Access - Choose Custom Configuration - VPN access and click Finish (Check below screen shots)                                                                                                                                                                                                                

  11.  Your services will restart and the Remote access Service is up and running now and ready for configuration and Usage.                                                                                                                                                                                          

                                                                                                                                                                    So in Part 1 of this series we installed and enabled the VPN only role on our Windows server 2016 box. In the next part we will start configuring the VPN properties and integrate it with our RADIUS server. Hopefully you enjoyed this part and see you on the next part.

Part 2 of this series

Part 3 of this series

Part 4 of this series




Juan Juergens Says:

I am definitely enjoying your website. You definitely have some great insight and great stories.
Bitcoin VPN

Swati Bhatt Says:

Wow! Great post! The content is very rich, and I really like window server

Nur Banu Zeniya Says:

Wow! Thanks for sharing this informative post, Its really worth reading.

Microsoft Server 2016 Support
Microsoft Server 2016 Migration

Crack Tower Says:

Best Installing VPN on Windows Server 2016 Method

Abdur Rahim Says:

Thanks for the excellent information and facts, this was a very good piece of writing.

Microsoft Server 2016 Installation
Server 2016

Robert F. Crocker Says:

Wow! This could be one of the most useful blogs we have ever come across on thesubject. Actually excellent info! I’m also an expert in this topic so I can understand your effort.
review summary

gibsonherry Says:

This blog presented itself in a very easy and clear way. Owner of this blog found a very simple way to express its view but when you read this blog completely, you would get to know about how hard it could be to express such in a easy way. Windows Remote Desktop Services CAL

David Marchal Says:

Experience high-end security whilst availing blazing-fast speed with Fastest VPN connectivity.

SMS AZ Says:

Classic blog!
Please stay us informed like this.
Thanks for sharing.
Remote Access VPN in Phoenix AZ

Zohaib Raza Says:

thanks for sharing this good information. i will follow your websites frequently. thanks for sharing this. keep posting more information. PURE VPN

Amazing Quotes Says:

Very Nice And Interesting Post, thank you for sharing
Inspirational Quotes - Gym Quotes
Best Quotes - Success Quotes
Positive Life Quotes - Image Bank
Future Quotes - Excellence Quotes
كلام جميل - Keep Smiling Quotes

Elvira Albert Says:

Cyber Monday Special Deal - Get Ivacy VPN on this cyber monday for Just $1.34/Month

Cyber Monday VPN Deal

Use promo code icm10 for discount price.

Abdur Rahim Says:

Great Post...Thanks for sharing !!!

Server 2016 High Availability

Abdur Rahim Says:

wow!!! that is great thank you for your share...

Server 2016 High Availability

Post a Comment