Which versions of 7 for this network setup

wcsjohn · 21 Jan 2010

I run a small business with multiple locations. I need the following setup.

Main office: Quickbooks server and LAN (3 computers total)
2 remote offices: VPN to the Quickbooks server

Right now I have everything working with Vista Home Premium on all PC's, but am limited by the 1 active VPN connection to the server. I want to update all PC's to 7 but am unsure which versions I need. I have 2 copies of 7 Home Premium already from free upgrades, but I'm not sure if they network support is sufficient. Do I need Business for all PC's and 2008 for the server? And if 2008, which version? Thanks for the help.

Jonathan_King · 21 Jan 2010

Welcome!

Try this great tutorial for the differences between versions: Compare Windows 7 Editions

Hope this helps,
~JK

ultraplanet · 21 Jan 2010

It's been awhile but I didn't think Quickbooks server actually needed to be on a server.

Yea it doesn't look like a server is required according to this link....
System Requirements for QuickBooks 2010 and Enterprise Solutions 10

The only version of QuickBooks that is compatible with Windows 7 is QuickBooks 2010 (Pro, Premier, and Enterprise Solutions). Although QuickBooks 2009 and earlier versions will install successfully on Windows 7, Intuit's technical support for Windows 7 is limited to QuickBooks 2010 products only.

chev65 · 21 Jan 2010

From what I have read about this, Windows Server 2003 web edition only allows one incoming VPN connection. The same for Win 7 VPN unless you use third party software like Cisco VPN or shrew.

The solution is to upgrade to Standard edition of Windows Server 2003 which has a limit of 1000 connections. Server 08 standard will do it also.

You can see it on the chart here if you scroll down to networking features.
http://www.winsupersite.com/showcase...3_editions.asp

Shrew just came out with a beta VPN client that might be worth trying. It will allow for multiple VPN connections when using Win 7 as the VPN server. Still in beta though and not completely stable from what I have read about it.
Shrew Soft Inc : Home

You can also use the Cisco VPN client on a Win 7 VPN but it needs to run in XP mode.

zzz2496 · 21 Jan 2010

I personally suggest you use a different hardware for VPN access, leave the server for it's serving job alone...

VPN gateway is the front door of your network, if you put your server at your front door, either you're just plain mad or you don't know what you're doing...

I personally use Mikrotik routers as VPN gateways, it's small, light, very reliable, tons of features, and most of all, if you think that your network is compromised, just pull the router off the wall... You'd be isolated, but safe...

zzz2496

wcsjohn · 21 Jan 2010

ultraplanet said:

It's been awhile but I didn't think Quickbooks server actually needed to be on a server.

Yea it doesn't look like a server is required according to this link....
System Requirements for QuickBooks 2010 and Enterprise Solutions 10

No, server is not required for QuickBooks, but I believe it is for the multiple VPNs, right?

zzz2496 said:

I personally suggest you use a different hardware for VPN access, leave the server for it's serving job alone...

VPN gateway is the front door of your network, if you put your server at your front door, either you're just plain mad or you don't know what you're doing...

I personally use Mikrotik routers as VPN gateways, it's small, light, very reliable, tons of features, and most of all, if you think that your network is compromised, just pull the router off the wall... You'd be isolated, but safe...

zzz2496

The server is behind a gateway w/ firewall that passes through the VPN traffic. Is this not the safest way to do it? Would letting the gateway handle the VPN be a better option? If so, would I still need 7 Server for multiple VPNs?

And what about on the client side. Microsoft makes me think I need 7 Business to connect to any VPN server. True? Or is 7 Home Premium, which I already own for two of the PC's good enough?

zzz2496 · 21 Jan 2010

Here's what I meant:

Server || Router/Gateway/Security Appliance <===> Internet

In this case, everything is fine, good, secure, BUT ONLY for those who tries to "test" your "Router/Gateway/Security Appliance". If you have a Web server behind the "Router/Gateway/Security Appliance", then everything that's connecting to your Web server will be filtered by the "Router/Gateway/Security Appliance".

Now the case changes IF you add VPN to the mix as such

The topology as seen from Internet:
Server/VPN Server || Router/Gateway/Security Appliance <===> Internet

The topology as seen from a VPN client
Server/VPN Server <==> Internet

Where is your firewall...? Firewalls doesn't block VPN connection attempt, you MUST allow it to go through the firewall so that VPN clients can connect to your Network. Let's say one of your user's password has been compromised, the "attacker" will directly connect to your "SERVER", your super precious "SERVER", where you keep ALL OF YOUR DATA. This fact alone is disturbing...

See what I mean?

I have this in my setup:

Server || Router/Gateway/Security Appliance/VPN Server <===> Internet

Now for whatever reason if I see a user, connected over VPN, but I see the person in front of me with his/her laptop turned off, all I need to do is turn off the router, it is the VPN server, so if it's off, I can still check my Server, is it compromised, check for anything missing, etc...

zzz2496

Edit: If you have a head office and a branch office, both should be connected to each other, I think you need a VPN tunnel, it's way simpler and way better. I have several tunnels setup for several clients of mine, connecting several branch offices to regional head offices. I use Mikrotik Router to connect each sites, including from my home to the head office (the head of regional head offices). Here's what my network looks like:

Home <====VPN Tunnel====> Head office <==== VPN Tunnel ===> Regional Head Office(s) <====VPN Tunnel ===> Branch Office(s)

I can access every client/server in this network as if I'm in my own WAN (not internet).
Everything is routed and filtered properly in every checkpoint by Mikrotik routers.

ickymay · 21 Jan 2010

wcsjohn said:

The server is behind a gateway w/ firewall that passes through the VPN traffic. Is this not the safest way to do it? Would letting the gateway handle the VPN be a better option? If so, would I still need 7 Server for multiple VPNs?

And what about on the client side. Microsoft makes me think I need 7 Business to connect to any VPN server. True? Or is 7 Home Premium, which I already own for two of the PC's good enough?

you will need professional or ultimate if you wish to join a domain , home is very cut back and doesn't include gpedit which is where i would be setting all my policies :)

RedBirdDad · 21 Jan 2010

I agree with zzz2496. Use a router/gateway with a built in VPN server. The router is better equipped to handle it. IPSec VPN's will be the most secure. IPSec VPN's are very robust but aren't lightweight and it's processing overhead that you really don't want on the server.

zzz2496 · 21 Jan 2010

RedBirdDad said:

I agree with zzz2496. Use a router/gateway with a built in VPN server. The router is better equipped to handle it. IPSec VPN's will be the most secure. IPSec VPN's are very robust but aren't lightweight and it's processing overhead that you really don't want on the server.

Or create a special "VPN Gateway/Server" appliance...