Re: vpn

["René Gallati" <draxinusom@gmail.com>]

On Tue, 14 Sep 2004 17:07:35 +0100, Nick Drage <nickd@metastasis.org.uk> wrote:
> On Tue, Sep 14, 2004 at 10:42:27AM -0400, John A. Sullivan III wrote:
> > On Tue, 2004-09-14 at 09:46, Peter Marshall wrote:
> 
> <snip>
> 
> > I would suggest an IPSec VPN using either the native IPSec stack in the
> > latest Linux or either StrongSWAN (www.strongswan.org) or OpenSWAN
> > (www.openswan.org) and placing access control and VPN on the same
> > device.  That is how we design most devices for use in the ISCS project
> > (http://iscs.sourceforge.net).
> 
> Reading "Network Security Hacks" recently I liked the look of VTun.  Any
> thoughts on that?  How does it interface with IPTables?

As far as I know openvpn uses it
(http://openvpn.sourceforge.net/index.html) It is fairly easy to
install and far more flexible and robust if one or both sides of the
tunnels have dynamic ip addresses. I've used FreeSwan for some years
and always had stability troubles when one side went down but the
tunnel wasn't properly terminated on the other side and such things.
I've switched to openvpn after the removal of the ipsec pseudodevices
which made my firewall rules unusable.

Now with openvpn you again have a device per tunnel on which you can
easily filter as before with ipsecN, just now they are called tunN
and/or tapN (depending on which type of tunnel you want)

You can furthermore do some things that ipsec cannot or are very
difficult. Using the tap's it emulates a virtual network card, so you
have arp running over it. You can easily do dhcp over taps and
furthermore broadcasts and multicast simply works over these pseudo
devices. It's just like both ends of the vpn have an additional nic
that is directly connected to each other.

I currently use it in a project where many peers connect to one vpn
server which then bridges together all these vpn endpoints and thus
creates one big "lan" segment where the peers can communicate to each
other mainly using broadcast and multicast. (it's a network testbed
for multihop routing protocols)

-- 
C U

     - -- ---- ----- -----/\/  René Gallati  \/\---- ----- --- -- -