I am in need of a VPN solution...... 1

[mrlucio79]

Hello all, I am in need of a vpn solution. Currently we have a AS400 server here at our site that is behind a firewall. Well we have about 50 clients that want to access the server from their homes using their windows boxes. This needs to be a linux solution due to budget. Any recommendations?

 

[RandyRiegel]

I use Poptop for my Linux machine.

http://www.poptop.org

I like it because there is nothing special to install on Windows computers.

 

[mrlucio79]

Yeh, I was reading about that. Is it secure enough though? Seems very easy to configure and I like how you don't have to install anything on the client....

 

[lgarner]

It's the same protocol as Windows' PPTP (hence the name). As I recall I had to patch the kernel to get MS-CHAP2 authentication to work. Otherwise, it's probably as secure as using a Windows 2000 or 2003 server as the endpoint.

 

[cdlvj]

Check out Redhat

http://www.redhat.com/docs/manuals/enterprise/RHEL-3-Manual/security-guide/ch-vpn.html

Talks about all that, cipe is included in base installation for ES.

 

[mrlucio79]

alright here are some dumdum questions:

Do I need a dhcp server to assign remote users IP addresses?

Where do I assign username and Passwords???

What other applications should be running side by side with PopTop?

 

[lgarner]

No. The address pool is specified in the configuration file.

Usernames and passwords are in a text file in /etc/chap-secrets normally. I think that's variable according to your configuration.

You'll probably want iptables for access restrictions, and I've used squid as a proxy to further control internet access via the vpn server. Otherwise, a basic multihomed server should do the trick.

 

[thedaver]

Stop messing around and use OpenVPN

http://openvpn.sf.net/

Surfinbox.com Business Internet Services - National Dialup, DSL, T-1 and more.

http://www.surfinbox.com/ds3.php

 

[mrlucio79]

lgarner, do you think this is a good setup?

http://poptop.sourceforge.net/dox/radius_mysql.html

 

[lgarner]

Looks good. I didn't mess with radius on Linux at the time because I had only a dozen or so users needing vpn access. Radius would definitely be the way to go, and is what I use now.

 

[mrlucio79]

alright, i have poptop setup on my lan and I am having trouble connecting to it through vpn. I am on a windows xp box and it throws up the error "Error 732 Your computer and the remote computer could not agree on PPP control protocals". I just did a basic setup of POPTOP, no radius or mysql. How do i know if mschapv2 is installed/enabled on my machine?

 

[lgarner]

Did you install the mppe kernel patch? If not, reduce the security requiremens of your XP vpn connection properties. You could also use tcpdump to see what's going on at the server side.

Personally, I'd install the patch. However, the difficulty in maintaining and updating a patched kernel is one of the reasons that I no longer use PPTP on Linux.

 

[gbaughma]

I know you were talking price and all that, and I know this is a Linux forum... HOWEVER....

... at work here, I run a Cisco VPN3000. With the VPN clients installed on the workstations.

IMHO, a hardware solution is *ALWAYS* better than a software solution.

If you have a problem cost-justifying it, just point out how much $$$ could be lost if an open-sourced VPN server were hacked....



Just my $.02

"In order to start solving a problem, one must first identify it's owner." --Me
--Greg

 

[lgarner]

Agreed. Pix is what we switched to. A 3015 is something that I've been looking at adding.

 

[aleonhardt]

Hi,

here a open source vpn router/firewall :

http://www.linux-vpn.de/lr101.php

-Alex