How to enable VPN access for users in a front-end or back-end scenario in ISA Server 2004

To publish the back-end ISA Server computer by using the front-end ISA Server computer

1. Start the ISA Server Management tool.
2. Expand Server_Name, where Server_Name is the name of your ISA Server computer.
3. Click Firewall Policy, and then click Create New Server Publishing Rule.
4. Type a name for the new server publishing rule, and then click Next. Use a descriptive name, such as PC1 on PC2.
5. Type the IP address of the back-end ISA Server computer that you are publishing, such as 192.168.1.1, and then click Next.
6. In the Selected protocol list, click to select PPTP Server, and then click Next.
7. Select the network IP addresses that will listen for requests that are intended for the published server. Because you are publishing the server to the Internet, click to select the External check box, and then click Next.
   
   Note By default, ISA Server 2004 will listen on all external IP addresses for VPN connections. If there is more than one IP address on the external interface of the ISA Server computer, and you want to control which IP address is published for VPN access, click Address to open the External Network Listener IP Selection dialog box. Then, select the specific IP addresses to listen on.
8. Review the summary on the Completing the New Server Publishing Rule Wizard page, and then click Finish.
9. In the Firewall Policy pane, click Apply to apply the new server publishing rule.
   
   Note You can modify the properties of any rule by double-clicking the rule in the Firewall Policy pane to open the rule properties.

To publish the internal VPN server by using the back-end ISA Server computer

1. Start the ISA Server Management tool.
2. Expand Server_Name, where Server_Name is the name of your ISA Server computer.
3. Click Firewall Policy, and then click Create New Server Publishing Rule.
4. Type a name for the new server publishing rule, and then click Next. Use a descriptive name, such as VPN1 on back.
5. Type the internal IP address, such as 192.168.2.1, of the back-end ISA Server computer that you are publishing, and then click Next.
6. In the Selected protocol list, click to select PPTP Server, and then click Next.
   
   Note This step assumes that you are publishing a VPN server by using the Point-to-Point Tunneling Protocol (PPTP). If you are using the Layer 2 Tunneling Protocol (L2TP), visit the following Microsoft Web site for additional information:
   http://technet.microsoft.com/en-us/library/cc713323.aspx
7. Select the network IP addresses that will listen for requests that are intended for the published server. Because the back-end ISA Server computer is the computer that listens for requests, click to select the External check box.
8. Because you want the back-end ISA Server computer to listen for requests that come from the front-end ISA Server computer, click Address.
9. In the Listen for requests on area, click Specified IP addresses on the ISA Server computer in the selected network.
10. In the Available IP Addresses area, click the IP Address of the front-end ISA Server, such as 192.168.1.1, click Add, and then click OK.
11. Click Next.
12. Review the summary on the Completing the New Server Publishing Rule Wizard page, and then click Finish.
13. In the Firewall Policy pane, click Apply to apply the new server publishing rule.

Front-end computer

Back-end computer