setting up VPN router as a VPN server and more

[paulj1x]

Sorry for the newb question, but I would like to use VPN a little differently than most and I’m not able to find consistent information on the best way to do this.
I have a 1 Gbps fiber-optic Internet connection from Cox (the “modem”), a Dell R710 server, and a home network using a Netgear Nighthawk X10 AD7200 Smart Wi-Fi Router (R9000).
I would like up to 100 students to be able to access the server at my home, but protect my home network. Almost all of them are running Windows 10. Because the Nighthawk router is in my family room, I cannot put the server there, but I can put the server near the modem.
I’m thinking of buying a VPN router and connecting this to the modem, the Nighthawk router, and the server, setting up a VLAN on the VPN server and having students VPN from their school into the VPN router and only access the server keeping my home network safe. As an added bonus I would also like them to be able to access the Internet from the VPN router as their school filters sites that we need access to for this class. This VPN router does not need Wi-Fi.
Once a week the students will upload a few 5 GB files, and then at other times up to 100 students will access a website on the server for hours at a time.
I’m open to spending $200 - $500 on a VPN router, and I’m very concerned regarding performance. I’m open to trying DD-WRT or anything else. I’m guessing I’ll also need to use DynDNS. I’m also open to paying for support to make this work.
What’s the best way forward? Best configuration? Best equipment? Best VPN software for my needs?

 

[bill001g]

It depends on what you mean by 100 students. If it is simultaneous it is going to be hard to get to run on any consumer box. VPN...especially SSLVPN is extremely CPU intensive. In addition the CPU will limit the maximum total data transfer rates. Many times you only get 30mbps total...depends a lot on the routers.

I would look at dual nic pc and load pfsense or one of the many other firewall packages.

Depending on what you call a server it might be possible to load the VPN directly on your current device. It would make your network security somewhat simpler because the VPN would not be connected to your lan only your server and you could use firewall rules in that server to prevent them from going back out to your lan. Be careful though too much vpn traffic could affect the overall performance of the server

 

[failboat]

I run pfsense on a r710 proxmox kvm VM with 6+ other vms. It works very well and has lots of docs. You could create vms and put them in a dmz using vlans for the students. then another vlan for your home and no pass rules between them. if you get 2 ips from your isp you can use no vlans and run two routers each with their own ip on wan. pfsense has vpn on the gui. if you go the kvm route you can also run any vm you want to host the vpn server.

other options i can think of is using sftp for the file transfers.

if you test pfsense in a vm. you must turn off hardware offload in advanced settings.

 

[paulj1x]

@bill001g and @failboat, thanks for the idea, but I need to be able to turn the server off without impacting my home network.

 

[failboat]

You can get a VLAN router and still use the VPN on the server. It's not the passing packets that lags routers it's the encryption part. With port forwarding it can run on the server.