DirectAccess - on single IP address and NIC behind NAT

[OverWorked]

Hello,

 

I'm in the early stages of setting up DirectAccess on 2012 R2. I'm trying to do it the simple way - one server with one NIC and one public IP address behind a NAT firewall (Smoothwall).

 

I'm working through https://technet.microsoft.com/en-gb/library/jj134148.aspx, and in the note section it says:-

 

If the DirectAccess client has been assigned a public IPv4 address, it will use the 6to4 transition technology to connect to the intranet. If it is assigned a private IPv4 address, it will use Teredo. If the DirectAccess client cannot connect to the DirectAccess server with 6to4 or Teredo, it will use IP-HTTPS.

 

◦ To use Teredo, you must configure two consecutive IP addresses on the external facing network adapter.

 

◦ You cannot use Teredo if the DirectAccess server has only one network adapter.

 

◦ Native IPv6 client computers can connect to the DirectAccess server over native IPv6, and no transition technology is required.

 

*All* DirectAccess are going to have private IPv4 address behind their home routers. Does this mean using Teredo with 2 consecutive public IPs, two NICS, routing between external and internal networks etc?? I thought this wasn't necessary on 2012 R2? Is this notes section just badly worded and it's really OK to use one public IP?

 

Thanks.

[sted]

did you ever get this working as im looking at doing it in pretty much the same way?

[OverWorked]

It is (easily) possible to use IPv4 and a single IP address on Server 2012 R2, despite the confusing statement above.

 

I got past this stage and almost got it working.

 

I got the a stage where DirectAccess would work from inside the LAN (create a DNS record for the external address, and switch the NLS server off). I could not get clients to connect from outside. I never found out why. I'll be moving to another job soon, so I dropped the project rather than leave it for someone else to pick up.

 

I recommend you go ahead with it with single v4 IP. It should work.

[sted]

It is (easily) possible to use IPv4 and a single IP address on Server 2012 R2, despite the confusing statement above.

 

I got past this stage and almost got it working.

 

I got the a stage where DirectAccess would work from inside the LAN (create a DNS record for the external address, and switch the NLS server off). I could not get clients to connect from outside. I never found out why. I'll be moving to another job soon, so I dropped the project rather than leave it for someone else to pick up.

 

I recommend you go ahead with it with single v4 IP. It should work.

seems to be the point im at shows working internally just says connecting from elsewhere

[dezt]

I had it working from one ipv4 until recently, a hyperv upgrade has caused an issue at the moment. I got it working by disabling the teredo adapter and also the isatap adapter. Open an elevated command prompt, type in "netsh interface teredo set state disabled" and netsh interface isatap set state disabled on a test client to see if that works. Check to see if your clients are getting the gpo, but if it says connected in your lan I'd think they are.

[sted]

i got it working with 2 nics one that goes to a router port with its own external ip i think most of my issues were trying to fudge things on my home connection without a static ip