Need help configuring VPN - problems accessing the networks

Question

Hi everyone, hope someone can help me out here.
I'm administering the network for our small company. We basically have two sets of machines - public ones with fixed net addresses (mail, web, dns servers, etc), and private ones behind a wireless router/nat.
Our main need here is to be able to VPN in to the public side, in particular, the mailserver, so that we can get around all the stupid things that get done to SMTP when we connect at the BedBug Inn ("Free wifi, administered by gibbons").
Secondarily, it would be nice to be able to connect to and browse some of the internal machines.
So here is what I did:
* Installed 10.4.10 Server on a machine with two ethernet interfaces, one that has a public IP address, the other connects into the private network. When I'm actually at that machine, things work fine - I can browse the private network shares, connect to the net, etc.
* Configured VPN. I have no problems getting a VPN connection, both sides are happy. The VPN assigns incoming clients IP addresses in the private network IP range, but outside those assigned by the wireless router's NAT.
* Added 192.168.2.1/255 (the private network) and 12.17.29.193/224 (the public network) to the Network Routing Definition box under VPN/Settings/Client Information.
However, here's where it all falls down. Once the VPN is established, I can't connect to any of the public machines, and the only private-side device that seems to respond is the Wireless/NAT box (A Belkin N1). So the only thing I can do is administer the Belkin remotely, which, while nice, is not exactly what I had in mind.
Doing a traceroute while VPN is active to my mailserver shows the first hop direct to the VPN machine, then off into * * * heaven (though I have no idea if traceroute works over VPN!).
One curious note: when I change the order of the Network Routing Definitions so that the public network comes first, and the private one second, I can't contact the Belkin box.
Any advice, oh wise and powerful masters of technology?
Various, but the server is running on a G4   Mac OS X (10.4.10)  

Answer 1

I said:
"let's assume I VPN to the wireless box"
You replied:
"That's not correct as it is not the device running the VPN endpoint - in this case. "
But wouldn't I have to (on the VPN client) specify the public IP of the wireless box in order connect (because the packets are forwarded) to the actual OS X box running the VPN? Otherwise, it can't see it.
Part of the problem I have is that I can't dedicate a whole machine to VPN. The OS X machine running VPN is also running DNS, and will eventually run our mailserver and perhaps FTP, web, etc, as I slowly migrate stuff to it.
So this machine has to have a public IP address. It cannot be hidden behind the wireless NAT. And it seems to me that this is the crux of the problem. What I think you are telling me is that if the VPN machine was entirely hidden behind the wireless NAT, and had no direct public (WAN) interface, then since all the packets destined for the outside world (including my public servers)would have to go through the NAT, and all would be OK.
If so, then it seems to me that the best solution is to use something like OpenVPN on another OS X (not OS X Server, since I only have one of those) machine in the private network. Since the incoming VPN traffic will be Mac only, it shouldn't be an issue, L2TP-only is fine.
"Otherwise you have to run NAT and the firewall in the VPN server too and use private IPs for VPN clients - or use "only" it (remove the other NAT box and put it on the LAN only). Using only one device for NAT/gw means less configuration."
It is entirely unclear to me, in my setup, what effect turning on NAT on the VPN box (or perhaps, just IP forwarding) would have -- and if I do turn on NAT, would I still have the VPN assign IP's to clients in the internal private network's range, or would I use a different range (ie: private is 192.168.237.xxx, VPN assigns 192.168.239.xxx) and expect the NAT to handle the conversion?
I'm a bit leery of just trying it and seeing what happens because it if mucks things up so badly that the server becomes unreachable (via server admin), I'll have to schlep down to the office to fix it.
"Other things to consider is "bottlenecks" between your LAN and WAN."
Not a real issue. We have a small office, and a relatively small pipe to the internet. Most of the traffic from that pipe is from the public machines anyway. The traffic that goes through the wireless router is basically websurfing and hitting the mailserver.
I could, of course, use the VPN OS X machine as the NAT/DHCP server, and hang the wireless router off the internal network as a simple access point. But would that resolve all the VPN issues?
Once again, thanks for your helpful and prompt replies.