Load Balance Term Servers and VPN...

[thatguy]

This may seem like a pretty simple setup, but I've read thru a bunch of help docs and posts and still can't figure it out..

I've got one DSL line going into the WAN port of a netgear router. From there I've got a cable from the LAN ports into a 100mbps NIC in each of two Win2k3 servers (name: IST01: running TS and RAS; name: IST02: running TS). Each server also has a 1gbps NIC, which is connected to a gigaswitch. From there, we go to the data server (name: TSDC; running Win2k, DC, AD, 1gbps NIC).

I've setup NLB on the IST0x machines as such:
IST01:
1gbps: 192.168.1.5
100mbps: 192.168.1.15
IST02:
1gbps: 192.168.1.6
100mbps: 192.168.1.16

Cluster address: 192.168.1.10
NLB is attached to 1.15, 1.16, Unicast, with one port rule for all ports, both protocols, multiple mode, equal load and single affinty

In the router, port forwarding is setup like this:
Port 1723 -> 192.168.1.15
Port 3389 -> 192.168.1.15

When connecting in via RDP or VPN (to the DSL IP address), there's no trouble. RDP gives the login screen from IST01, VPN authenticates and then the user is allowed to RDP to any of the machines (IST01, IST02, TSDC).

However, when I change the port forwarding to the cluster address (192.168.1.10), RDP and VPN still work, but with the VPN, users can only RDP to IST01. The only way a user can connect to IST02 or TSDC is to RDP to IST01, then RDP within that session.

So, at long last, my questions: Is this set up incorrectly? Are the 100mbps NICs necessary? Should both 1723 and 3389 be forwarded to the cluster address? Should RAS be on the DC and 1723 forwarded there? Any suggestions would be greatly appreciated. Thanks

 

[thatguy]

hmm... so no thoughts on this?

 

[dberg35]

My network is very similar to yours and if I am home working then I have to RDP in that sesion to the other server. If you are having this issue internally then you can in RDP select browse and any terminal servers should show up.

 

[thatguy]

Yes, I'm talking about connecting from home via the VPN (connecting to the external IP on the router, using port forwarding to forward 1723 to the DC), then RDP'ing to a server on the [now] local network using the internal IPs.

I'm wondering why I can only RDP into one server (which isn't even the DC).

thanks
-- frank~

 

[dberg35]

Well if you want to be able to hit that server then you have to set it up in the router by opening the port for RDP and setting ti to that server IP address.

 

[thatguy]

I would like to be able to connect via the VPN and RDP to any server on the network directly. Are you saying that once I set up the load balancing cluster, that I won't be able to? Why is that?

 

[dberg35]

I am speaking as if you wanted to work from home on a server with out the VPN. If you want to be able to work on all servers then yes VPN would let you do that. You would need a VPN routers at home and the ip address of each server to use in RDP. As for load balancing that is a little out of my relm. You need to make sure RDP is active on all servers.