VPNs and Multiple IP Addresses

When dealing with TCP/IP connectivity between computer systems it's important to have a basic understanding of how it all works. A TCP/IP connection is always established between TWO TCP/IP addresses. In a simple network (as shown below) the computer (or server) running the HL7 Router (sender) establishes a connection from its internal TCP/IP address across the network to the specified internal TCP/IP address (and port #) of the computer (or server) running an HL7 message listener (like the EasyHL7 Listener Service).

Simple Networks: Computer to Computer (or Server to Server) within the same LAN (local area network) with each computer having only 1 TCP/IP address.

Complex Networks: Computer to Computer (or Server to Server) not within the same LAN (local area network) where each computer might have multiple TCP/IP Addresses.

Scenario 1: Using the complex network diagram shown above, consider what is necessary for Server A to send HL7 messages with an HL7 message router service to Server B which is running an HL7 message listener service. We'll assume the following:

1.	Server A acts as the primary DNS server for Network A and assigns TCP/IP addresses to Network A in the Range of 192.168.1.220/230. In an ordinary state Server A has it's own internal TCP/IP address of 192.168.1.220. Computer 1 is 192.168.1.221 and Computer 2 is 192.168.1.222.

Server B acts as the primary DNS server for Network B and assigns TCP/IP addresses to Network B in the Range of 192.168.3.240/250. Server B also acts as an incoming VPN server and services the VPN by acting as the DHCP server and assigns TCP/IP addresses to incoming VPN connections in the Range of 192.168.3.200/210. This means that in an ordinary state Server B has TWO internal TCP/IP addresses. It has it's 'Default' TCP/IP address which would be 192.168.3.240 which it uses to communicate internally with Network B and it also has 192.168.3.200 which it uses to communicate externally with the VPN.

In order for Server A to send data to Server B, Server A must first establish a secure network connection to Server B through the VPN tunnel. When Server A logs into Server B through the VPN, Server B will assign Server A a NEW TCP/IP address that is valid for the VPN like 192.168.3.201. Now Server A has two internal TCP/IP addresses (192.168.1.220 for internal communications within Network A AND 192.168.3.201 for external communications through the VPN). See below for the final result.

If Server B has an HL7 listener service running that is bound to it's internal TCP/IP address of 192.168.3.200 (see configuring the HL7 Listener) then Server A can send HL7 messages to Server B using an HL7 router service which is using 192.168.3.201 as the 'IP Address to Send From' (See configuring the HL7 Router). Server A may not be able to send HL7 messages to Server B from it's 'Default' TCP/IP address of 192.168.1.220 because that IP address may not be visible (and in fact probably would not be) to the VPN connection.

If Server B has an HL7 listener service running that is bound to it's 'Default' internal TCP/IP address of 192.168.3.240, then Server A would likely NOT be able to send HL7 messages over the VPN connection to Server B.

For our example we will assume that Server A is running the EasyHL7 Router Service and is sending HL7 messages to Server B through the VPN on IP Address 192.168.3.201 (connected to a Listener service bound to 192.168.3.200 on Server B). In the EasyHL7 Router service configuration if the Monitor Communications section was completed using the 'Default' IP address for Server A then any computer in Network A can run the EasyHL7 Service Monitor to check the status of the Router Service running on Server A. If however, it was configured to use 192.168.3.201 as the 'Monitor Communications' IP address, then you would likely ONLY be able to run the EasyHL7 service monitor directly from Server A because that IP address is 'invisible' to Computers 1 and 2 on Network A (they aren't connected to the VPN). See Configuring the Router and Configuring the Monitor for further info.