The windows 2012 server shall have two network cards, one for internet, another for local network(connected to switch).
Network topology diagram:
1) Add "Remote Access" Role
2) Add features
3) Check the "RAS" and "Routing" features
4) Apply and restart the server
1) Open the Getting Started Wizard
2). Deploy DirectAccess Only
3). Enable NAT on the external adapter
WFilter shall be installed in this server. In "System Settings"->"Monitoring Settings" of WFilter, choose "Pass-through mode", choose the internal adapter as the "monitoring adapter".
Now you're able to monitor all network clients.
For pass-through filtering, you also need to install WFilter IMNPTF driver, please check: How to install WFilter IMNPTF driver?