On Tue, 14 Sep 2004 17:07:35 +0100, Nick Drage <nickd@xxxxxxxxxxxxxxxxx> wrote: > On Tue, Sep 14, 2004 at 10:42:27AM -0400, John A. Sullivan III wrote: > > On Tue, 2004-09-14 at 09:46, Peter Marshall wrote: > > <snip> > > > I would suggest an IPSec VPN using either the native IPSec stack in the > > latest Linux or either StrongSWAN (www.strongswan.org) or OpenSWAN > > (www.openswan.org) and placing access control and VPN on the same > > device. That is how we design most devices for use in the ISCS project > > (http://iscs.sourceforge.net). > > Reading "Network Security Hacks" recently I liked the look of VTun. Any > thoughts on that? How does it interface with IPTables? As far as I know openvpn uses it (http://openvpn.sourceforge.net/index.html) It is fairly easy to install and far more flexible and robust if one or both sides of the tunnels have dynamic ip addresses. I've used FreeSwan for some years and always had stability troubles when one side went down but the tunnel wasn't properly terminated on the other side and such things. I've switched to openvpn after the removal of the ipsec pseudodevices which made my firewall rules unusable. Now with openvpn you again have a device per tunnel on which you can easily filter as before with ipsecN, just now they are called tunN and/or tapN (depending on which type of tunnel you want) You can furthermore do some things that ipsec cannot or are very difficult. Using the tap's it emulates a virtual network card, so you have arp running over it. You can easily do dhcp over taps and furthermore broadcasts and multicast simply works over these pseudo devices. It's just like both ends of the vpn have an additional nic that is directly connected to each other. I currently use it in a project where many peers connect to one vpn server which then bridges together all these vpn endpoints and thus creates one big "lan" segment where the peers can communicate to each other mainly using broadcast and multicast. (it's a network testbed for multihop routing protocols) -- C U - -- ---- ----- -----/\/ René Gallati \/\---- ----- --- -- -
