Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
The Internet Encryption Security

Low Cost VPN Solutions? 100

Posted by Cliff from the your-net-over-the-internet dept.
whschwartz asks: "I'm looking for a low cost solution for allowing myself and a few others the ability to share a server at one of our locations. One thought was using SSH tunnels to establish secure connections, forwarding any ports needed by our apps. We'd want to be able to map network drives, control the server with something like PC Anywhere or VNC with the possibility of running apps that have remote data on the server. I use the Cisco VPN solution for work, but that's not in our price range and is probably overkill. Are there any other options I should be looking at other than using SSH port forwarding?"
This discussion has been archived. No new comments can be posted.

Low Cost VPN Solutions? More

Low Cost VPN Solutions?

Comments Filter:

  • If Linux is ok.. (Score:4, Informative)

    by ADRA ( 37398 ) on Monday January 03, 2005 @02:49PM (#11246521)
    You could use vtun (http://vtun.sourceforge.net/) to get the job done.

    It has VPN functionality, although I don't think it has Windows support, if that's a requirement.

    • Re:If Linux is ok.. (Score:3, Informative)

      by nocomment ( 239368 )
      If linux is ok and yo uhave some spare boxes sitting around, then go download the Mandrake Multi-Network Firewall. I toyed around with it a couple years ago and got it working. I used OpenBSD now, but the MNF was really easy to configure. It also has packet sniffers to detect hack attempts built in (portsentry AND snort IIRC).
      • I use OpenVPN [sourceforge.net] because it works on damn near anything. It allows for network tunneling which covers any port or protocol you could need. From Linux to Windows or Windows to Windows or Linux to Linux. Windows File Sharing works without a hitch. As does games and VNC. Only had to open one port on the firewall to allow the VPN software to talk to each other. The only thing I'm limited by is my internet bandwidth.
    • Well since he was talking about using VNC for admin stuff, and mapping network drives, I'd assume Windows support is required.
    • Certainly worth noting that vtun works on OSX, *bsd, and there is always a vtun port to windows in the wings, but it never seems to arrive.
  • How are we supposed to answer the question when you don't even tell us the host operating system and the client systems?

    Is it linux, windows or a bsd? Ah screw it, too many options to even think about posting a usable response.

    • Re:How the... (Score:2, Flamebait)

      by svanstrom ( 734343 )
      If he knew what OS he's using he would have been smart enough to google for the answer... then again, maybe people prefer to spend maybe days getting lots of different (working and not working) answers from slashdoters, instead of getting something that works in about 5 minuters from google??!

  • OpenVPN (Score:5, Informative)

    by LiENUS ( 207736 ) <slashdot&vetmanage,com> on Monday January 03, 2005 @02:51PM (#11246548) Homepage
    Theres always http://openvpn.sourceforge.net/ [sourceforge.net] which has clients and servers for windows, or you could always tunnel pppd over ssh, http://www.tldp.org/HOWTO/VPN-HOWTO/ [tldp.org] for details

    • Re:OpenVPN (Score:3, Interesting)

      by the_maddman ( 801403 )
      I second OpenVPN. Way easier to setup then FreeSWAN, and less overhead. You do have to setup the server per machine that wants to connect, but it works on my linux and windows boxes.

      There are problems with tunneling ppp over SSH, since that's packing a TCP stream inside another TCP stream and can screw up the packet counters, and seriously, OpenVPN is easier to setup.

      • OpenVPN all the way. I have very non-IT-literate clients and they are amazed that they never see the "dial-up" any more (MS's PPTP client). OpenVPN is virtually transparent to the user and (as has already been said) it's a doddle to set up.

        I personally tend to go for TUN configuration, but YMMV.

      • Re:OpenVPN (Score:5, Informative)

        by bill_mcgonigle ( 4333 ) * on Monday January 03, 2005 @03:27PM (#11246998) Homepage Journal
        since that's packing a TCP stream inside another TCP stream and can screw up the packet counters

        I knew this comment would lurk here somewhere, it always does.

        There's a theoretical problem with TCP in TCP on connections with errors. That said, I've built network appliances that do TCP over TCP. From a practical perspective it works just fine, and I've sent terabytes of data over such a link and the throughput approaches the line speed.

        Somebody's firewall is going to kill your connection long before other problems kick in.
        • Right, I know that it's fine as long as packets aren't dropped, but sadly I have cable from Charter Communications, so my internet connection is spotty, I've never had any luck with ssh+pppd, it may just be a bad combination.

        • Re:OpenVPN (Score:3, Interesting)

          by schon ( 31600 )
          There's a theoretical problem with TCP in TCP on connections with errors

          No, it's not theoretical, and it's not just with errors. A single link with high latency will kill your connections. It really does happen.

          From a practical perspective it works just fine

          Only if you're extremely lucky. If you're not, you *will* experience problems. If any of the connections between sites become saturated, you'll experience dropped packets, which starts the snowball rolling down the hill.
          • Only if you're extremely lucky. If you're not, you *will* experience problems. If any of the connections between sites become saturated, you'll experience dropped packets, which starts the snowball rolling down the hill.

            I understand the theory, but if that's true in practice I've been extremely lucky across hundreds of sites across the US over a period of a couple years, which seems unlikely.

      • Re:OpenVPN (Score:3, Informative)

        by #undefined ( 150241 )

        i also recommend openvpn [sf.net]. supported on a majority of systems: windows 2k/xp, linux, mac os x, bsds, & solaris. here's the howto [sourceforge.net].

        imho, great example of kernel/user-land separation: tun/tap virtual device driver is the only kernel-side part, the rest is in user-land. no more having freeswan keep the system from cleanly shutting down because of a lost reference to a network device. but there is overhead from context switches between kernel & user, though it's a trade-off i think is worthwhile.

        y

      • Re:OpenVPN (Score:3, Interesting)

        by PGillingwater ( 72739 )
        By default, OpenVPN uses UDP, so the problem of TCP tunneling inside TCP doesn't need to happen (although in my experience is minimal except on heavily congested or small MTU links.) I think the parent post isn't referring to using OpenVPN with TCP (although this can be done). [Aside: TCP inside TCP isn't really a problem with packet counters, it's the sliding windows and retransmissions which causes problems.]

        I've used many VPN solutions, starting with proprietary (Raptor with IPIP), through to MS PPtP
    • I second OpenVPN. I've been using it quite awhile and it seems to work great. Cross-platform too.
    • I'll second this.

      I'm rolling out an openvpn 2 setup now, and I have to say I'm quite impressed by the package. It seems very stable, gives good performance, has clients for everything we are going to use, and is open source.

      The big reason why I chose openvpn over other solutions like IPSEC was basically because I couldn't find free IPSEC clients for windows.

      If I had any advice for someone setting up openvpn, it would be to figure out what kind of a setup you want before you try to implement it. There a
    • I second that, especially since OpenVPN uses tried and true cryptographic infrastructure that SSL/TLS is.

      I mean, there are countless problems with homebrew crypto solutions because many people think that just using crypto will solve all the problems. And all the time those new, "unorthodox" implementations make horrendous mistakes that often nullify all the security that crypto could give. This kind of problems keep popping up in VTUN, PPTP and WEP protocols.

      And when you (wisely) use tested infrastructure

      • Re:OpenVPN (Score:3, Insightful)

        by bloo9298 ( 258454 )

        Oh come on, you can't say there are problems with homegrown protocols without pointing people towards Peter Gutmann's comment [mit.edu] on penis-shaped sound waves. :-)

        I agree with you for the most part, but I think it is worth stating that using SSL/TLS or SSH does not free you from all problems. Secure (integrity not confidentiality) distribution of public keys is still a significant challenge (to be read as "something that's easy to screw up").

      • Just to clarify what appears to be confusion. OpenSSL provides the key exchange and authentication options within OpenVPN, but doesn't handle the tunneling. Instead, OpenVPN uses ESP, the same as IPSec. Basically, think of it as the IPSec payload, but without AH or IKE, running over UDP. While many SSL/TLS tunnels use TCP, this is not required with OpenVPN. See the OpenVPN security model [sourceforge.net] for details.

    • Re:OpenVPN (Score:4, Informative)

      by erth64net ( 47842 ) on Monday January 03, 2005 @05:15PM (#11248051) Homepage
      I second OpenVPN was well.

      We've used FreeS/WAN (now OpenVPN) since 2001, with nary an issue. We currently have 12 connections ranging from 144KBit to 3Mbit (all business quality!) all connected together. The VPN/firewall hardware at each site is a Pentium 120Mhz w/ 32MB or RAM, two network cards, and nothing but a floppy disk booting/running LEAF [sf.net]'s Bering-uCLib. We have Win2K/XP VPN clients connecting to these "LEAF" systems as well. In theory, OpenVPN can support many hundreds of VPN tunnels - though the highest we've pushed it was around 30 (ie: permeant tunnels plus the Win32 clients) - with about 600 users between all the sites.

      When we stress-tested this hardware/software combo, we were able to push just over 7Mbit/sec, and only added about 5ms latency to the link!

      This combo has been rock solid - not a single connection failure can be blamed on the VPN software - it has been either the last mile, a NIC failure, or a bad floppy disk. Administration is via SSH [ucc.asn.au] (with a web-based admin console in development), and the firewall code is Shorewall [shorewall.net].
  • If the OS's involved are linux or you can insert a low cost box into the mix then Freeswan is a good choice.

    I have had great sucess using it to connect a main office with a wharehouse across the highway. After setting it up I only had to touch the boxes to do upgrades. The only downside is the need for two servers, one for each end of the tunnel.

  • Smoothwall (Score:4, Informative)

    by Computerguy5 ( 661265 ) on Monday January 03, 2005 @02:54PM (#11246586) Homepage
    You could use a smoothwall [smoothwall.org] router. Only cost is standard hardware.
    • Bah, you probably want to use IPCop [ipcop.org] instead. The Smoothwall community has a history of being, ummm..., moody and really pissed a lot of people off [google.com]. IPCop was forked off of Smoothwall several years ago to make a more friendly product, and I have to say I like it much better.

      On Topic: I haven't used the VPN functionality yet, but with my new cable modem I plan on connecting to a couple of sites I support (all with IPCop).

  • Linksys (Score:3, Informative)

    by Dr. Bent ( 533421 ) <ben&int,com> on Monday January 03, 2005 @02:54PM (#11246593) Homepage
    Linksys sells a VPN router [google.com] that uses the IPSec standard, for around $100. I've been using it for the last year or so and I love it. You can connect to it using the IPSec tunnel built into Windows, or connect under Linux using FreeS/Wan

    • There's also a 802.11g-enabled [linksys.com] version of this... :)

    • Linksys sells a VPN router that uses the IPSec standard, for around $100.

      We have some of those, and they work great.

      That said, has anyone set up the IPSEC in 2.6 to work with one of them? Would be nice to be able to do it over the wireless connection too...

      • AFAIK the Broadcom wireless chipset used in that Linksys is closed source so you are basically stuck with kernel 2.4.

        • AFAIK the Broadcom wireless chipset used in that Linksys is closed source so you are basically stuck with kernel 2.4.

          I'm thinking of Linux connecting to one of them (they have native IPSEC in hardware, and can do 50-75 tunnels depending on the model), not on replacing the hardware on the unit itself.

          • The native IPsec in the Linksys is based on Linux as well, but it is outdated and buggy [openswan.org] and possibly insecure.

            • Not the same. I'm thinking of the ones with dedicated IPSEC hardware (BEVP41). And given that it is simple to set up, works well through NAT etc, it was well worth the price, compared to all the hours I spent trying to make Freeswan work. No moving parts etc. being good too. And it plays well with other IPSEC hardware... so all I'm wondering of now is the easiest way to get Linux to connect to it as a road warrior with FC2/3

              • Ironically, that one uses FreeS/WAN too, IIRC.

                I wrote the interop howto, at http://www.freeswan.ca/docs/BEFVP41/

                Ken (Openswan Developer)

    • Re:Linksys (Score:1, Redundant)

      by tonsofpcs ( 687961 )
      And the killer?
      Linksys is a division of Cisco Systems!
  • I have done this for almost for years now.

    I set it for my personal use and then when my company need a solution we did this to.

    Here is a how to [ishiboo.com]
  • I recently started using OpenVPN [sourceforge.net] and it works great. It took a little bit to set it up in the multi-client configuration, but it wasn't bad.

    I'm going to set everyone in my company up using it. We're small and everyone works either on customer sites or from home. This will allow us to more easily share resources. It works with Linux, Windows, etc.

    I highly recommend it.

    • I agree with this. OpenVPN even has some nice little user friendly tools to access the VPN from Windows, etc.

      http://openvpn.sourceforge.net/gui.html [sourceforge.net]

    • We're small and everyone works either on customer sites or from home.

      Before I made it Real Easy for my co-workers to VPN in from home I'd be checking to make sure their home computers had pristine reputations. I know this kind of touchy issue, too. "Whaddya mean suggesting my computer sleeps around!"

  • windows xp vpn server (Score:5, Informative)

    by uits ( 792760 ) on Monday January 03, 2005 @02:58PM (#11246643)

    It seems you are trying to connect to a windows machine, and you are using windows clients. Since we can assume it's not Server 2000/2003 (otherwise why would you be asking...) the following link shows how to set up a VPN server on windows xp.

    http://www.onecomputerguy.com/networking/xp_vpn_se rver.htm [onecomputerguy.com]

    Might not be the coolest way...but it's simple & low cost, using the hardware/software you have already.

    • Boy, I think this is the only post we need for all windows vpn solution. That site is the single most organized windows tutorial site I have ever seen in my life. And trust me, I have seen quite a number.

  • Simplest way I've done it is to setup IPCop [ipcop.org] on both ends. You can use throw-away hardware (Pentium or greater) with little RAM and hard drive space and two network cards. VPN's are a breeze to setup.

    The only issue will then be bandwidth, the faster the better. My main site uses cable and the remote site uses ADSL, and it's fast enough to be usable, but not as fast as a thin-client (Citrix) installation is. But we're talking trade-offs of cost for speed here, but since it's so cheap to do you can set i
    • I am also using IPCOP for VPNs here.

      Very easy to setup a net-to-net-connection, a little harder to set up a host-to-net-connection, when it comes to connect a so-called Road-Warrior with dynamic IP.

      If you need to provide IPSEC to XP-Clients, this works as well, just a little fiddling necessary. There are several HOWTOs out there.

      I use a Pentium I 133 MHz with 100MB RAM here ... works like a charm.

      And you also get loads of other functionality as well. Webproxy, DNS-Proxy, IDS, QoS, NTP, DHCP, ...

  • A couple of options (Score:3, Informative)

    by Some guy named Chris ( 9720 ) * on Monday January 03, 2005 @03:07PM (#11246752) Journal

    PPP tunnelled over SSH is simple, quick to set up, and works without a hitch. I've used it to connect 20+ locations, and it's just as good as having a dedicated frame link between the sites.

    IPSEC (using openeswan or similar) work well, but are in my experience more complicated and harder to maintain than using the PPPoverSSH method.

    Both of these are free.

    • It seems to me that in the post-dialup world, many people ditched PPP as fast as they could because of the miseries they had setting it up in those days.

      With modern tools like wvdial and rp-pppoe however, you never need to see the pppd command-line anymore.

      PPP is a very powerful protocol and it will work for many of your situations. IPSec however does have a lot of features not implicit in SSH + PPP.
  • I've had decent luck with PPP over SSH. It's not the fastest (although I haven't done any tuning of my PPP config), but all the components needed are pre-installed on most modern 'nix boxes.

    See http://www.faqs.org/docs/Linux-mini/ppp-ssh.html [faqs.org]

    c.

  • Netgear FVS328 and FVS318 routers with VPN (Score:3, Informative)

    by Futurepower(R) ( 558542 ) on Monday January 03, 2005 @03:44PM (#11247193) Homepage

    This may be helpful to someone:

    We have extensive experience with the Netgear FVS328 and FVS318 routers with VPN. We have had many many problems with them.

    Note that the FVS318 does NOT have secure login for remote maintenance. The password is sent in the clear.

    Netgear apparently has no technical support representatives that work for the company. They apparently all work for contractors in India and the United States. We have found them to have very, very little information about these Netgear products.

    Here are a few of our extensive notes about the problems:

    We establish an IKE and VPN policy, and start a VPN. It works fine the first time, but, after we disconnect we cannot connect later, even though no changes have been made to the policies.

    1) There is general agreement among Netgear technical support people that there is a problem.

    Netgear technical support people have standard IKE and VPN policy setups they like to use, which they say are proven to work. The most common one, however, is slow and drops a lot of pings. More sophisticated IKE and VPN settings are faster, even though better encryption is used. We have no idea why this is so.

    2) Turning the router power off and restarting sometimes cures the problem with not being able to re-establish a VPN. We have seen cases where the menu choice reboot did not cure a problem, but turning the power off and on did cure it.

    3) Something hidden seems to time out after several hours. Sometimes VPN connection problems fix themselves after a day or so.

    4) When establishing a VPN Auto Policy, the help says:

    Remote VPN Endpoint Select the desired option (IP address or Domain Name) and enter the address of the remote VPN Gateway/Server or client you wish to connect to. Note: The remote VPN endpoint must have this VPN Gateway's address entered as it's "Remote VPN Endpoint".

    However, we had a case where the address of one of the routers had changed from that given in the "Remote VPN Endpoint", but the VPN was re-established. The impression is given that specifying the address increases security. Apparently this is not so. Again, something seems to be keeping information for several hours, and then timing out.

    5) We have seen a case where deleting all the policies and starting over cured a persistent problem with not being able to re-establish a VPN.

    6) We have seen cases which seem to indicate browser dependence. For example, there may be Javascript that works perfectly only in Microsoft Internet Explorer, but sometimes fails in other browsers.

    7) We have seen cases where choosing "Log Out" does not actually log out. Netgear technical support people say they've seen this also.

    It seems to help if we exit from the browser completely. However, if the browser is Firefox (or Mozilla), and there are several Firefox windows open, exiting from Firefox means exiting from all the windows and tabs, which means that work opening those windows is lost. (Firefox and Mozilla do not have multiple instances; all windows come from the same instance.)

    Logging out sometimes seems to leave something in the router which gets confused, and prevents re-establishing the VPN.

    Version tested -- We have not tested the FVS328 firmware beta version. This report is about the FVS328 firmware Version 1.0 Release 09.
    • I'll just chime in with a "Me too!" on the "NetGear VPN sucks" issue.

      I've always liked NetGear switches and wireless routers. They tend to work well, and I've never had one die out of dozens in the field (that's not to say they're necessarily more reliable than other decent low-end brands, but I've a lot of others prove historically less reliable). But their VPN Routers are atrocious. Simply terrible. They offer a "ProSafe" IPSec VPN client package for Windows that is terribly buggy, confusing to use,

    • NOTE: Anyone wanting a secure VPN should pay attention to number 4 above. FVS328s ignore the WAN addresses specified during configuration, apparently, or there is some other bug.

  • Linux based VPN gateways (Score:4, Informative)

    by PinkX ( 607183 ) on Monday January 03, 2005 @03:48PM (#11247225) Homepage
    Are cheap, easy to setup and mantain, highly flexible and very cost-effective.

    Depending on what you're planning to do, you can use any of the several VPN implementations out there, just to name a few:

    * PoPToP [poptop.org], a PPTP server, compatible with the VPN client that Windows has always has,
    * vpnd [sunsite.dk], really easy to set up, ideal gw to gw VPN solution, seems a little outdated but works great over slow links,
    * OpenVPN [sourceforge.net], a highly portable, flexible and multiplatform VPN solution, which supports gw to gw and gw to host style VPNs,
    * etc. There is also LinVPN, FreeS/WAN / Openswan, et al

    Best regards.
    • A recent exploit discovered in MSCHAP means that PPTP VPNs are an utterly insecure solution. I've used vpnd and it was as close to troublefree as I've seen yet. What I want to know is how to get any of the assorted ipsec implementations to work, I have yet to find a coherent howto that will let me set up freeswan OR openswan properly. At some point in the howto everything breaks down and there are commands which cannot be issued or files that do not exist. Some of the howtos tell you to follow some steps fr
  • You can use ssh with explicit port forwarding, but it sounds like you'd benefit from using it as a SOCKS proxy. OpenSSH can provide a SOCKS4 proxy with the -D switch and PuTTY can provide a SOCKS5 proxy. I've found that this works quite nicely for most purposes.
  • I'm not sure if you mean "Low Cost" as in "Free with a lot of my time installing/configuring" or "Low Cost" as in "Under $1000 plug-and-play," but our company recently bought a Symantec 200R VPN Server and firewall. You can get them for about $500 online. (Make sure you get the 200R, as the 100 and 200 don't have the actual VPN endpoint.)

    Setup and installation was a breeze. I had it working out of the box in about an hour, including mucking around with the client they provide. I have a Debian Samba box as
  • I'm looking for a solution as well. My situation is that I want to tunnel two LANs together. One of them is behind a firewall that I control and has a semi-static IP address. That is, the IP address is resolvable using a DNS lookup. However, the other LAN is behind a firewall I do NOT control (though I have all necessary consent, of course) and does NOT have a static IP address.

    OpenVPN therefore does not seem to work for me, though perhaps I was reading the documentation incorrectly. It seems that it

    • Did you see this from the OpenVPN first page? "Can OpenVPN tunnel over a TCP connection? Yes, starting with version 1.5."

    • Re:Looking for a solution (Score:4, Informative)

      by PinkX ( 607183 ) on Monday January 03, 2005 @04:32PM (#11247658) Homepage
      You are certainly doing something wrong. I have multiple points OpenVPN setups which only has dynamic IP address on all of them, using a dyn dns server, and it's always up and running.

      Here is my config for all of the VPN gw's (/etc/openvpn/${HOST}.conf):

      dev tun
      remote ${REMOTEHOST}
      ifconfig ${LOCAL_VPN_IP} ${REMOTE_VPN_IP}
      secret /etc/openvpn/${REMOTEHOST}.key
      route ${REMOTE_NETWORK} ${REMOTE_NETMASK} vpn_gateway 1
      ping 20
      ping-restart 60
      persist-key
      ping-timer-rem
      persist-tun
      user nobody
      port 5001
      verb 3
      resolv-retry infinite

      of course substitute all the variable names with your own values.

      Best regards,

    • OpenVPN therefore does not seem to work for me, though perhaps I was reading the documentation incorrectly. It seems that it requires both endpoints have static IP addresses. Also, am I correct in saying that it requires UDP?

      I am not familiar with OpenVPN, but I am with some others. If you are behind a NAT firewall or on a dynamic IP address you may need to turn off AH to make it reliable. AH authenticates the IP address header so if it is altered or tampered with the IPSec/VPN can reject the packet.


  • OpenVPN seems to be the winner of the comments so far. However, I'd like to see other hardware VPN solutions, too.

    From the Slashdot question: "Are there any other options I should be looking at other than using SSH port forwarding?"

    It would be interesting to know more about experiences with SSH, too.
  • I've had excellent results with the SnapGear (since bought by CyberGuard) appliance. You can have it up and running in fairly short order via the web interface. It runs on Linux and all the Linux configs are easily accessible in case you need more flexibility than the web interface offers.

    There's one on eBay at the moment for $138 (sorry, I already bought his other ones to augment what I already had installed).

  • m0n0wall? (Score:3, Informative)

    by M1FCJ ( 586251 ) on Monday January 03, 2005 @04:54PM (#11247888) Homepage
    It does the job. I use it as a CD-based system + floppy on very old hardware with 64MB. Setting up the VPN was very easy and it was dead-easy to maintain/backup. I use it between three sites but I intend to use it at work as well.
  • more here [sites.inka.de].

  • CyberGuard SG530 (Score:2, Interesting)

    by brian0x00FF ( 701559 )

    I use the CyberGuard SG530 [cyberguard.info] for my personal VPN needs. It's a box about the size of your average 8-port switch, it runs a version of embedded linux and come default with PoPToP for PPTP v2 and FreeSwan for IPSEC. It has a web based config and if fairly painless to set up.

    I was searching specifically for a PPTP device simply because it is so easy to configure and use, especially for Windows-based clients.

    If you have a spare computer you wanted to use for this, you may want to look at IPCop, but at about U

    • I have several CyberGuard (aka SnapGear) in service. Good stuff. I prefer the the models like the SG550 or SG570. They cost a little more but they provide ssl and ssh access to maintenance, the lower models do not.

      They aren't cheap but if you're only buying one for remote access, they won't break the bank either.

      Note: If you get one, update the firmware. It is usally out of date comapred to what is on the website.
  • It's opensource. Works pretty well and seems to be evolving pretty fast.

    SSL Explorer provides an entry-level SSL VPN to individuals and small businesses. This practicable remote access solution includes SSL tunneling, web site proxying, Microsoft Windows file sharing and Java application deployment through a standard browser

    http://3sp.com/

    http://sourceforge.net/projects/sslexplorer/
  • Actually, a Cisco VPN solution os not that expensive (it is more than free).

    Get a pix 501 10 user bundle from CDW for $399-
    http://www.cdw.com/shop/products/default.as px?EDC= 337727

    Download the VPN client from Cisco (free) configure the box and you are reay to VPN.
    • I've used Cisco PIX 501 firewalls extensively, primarily for mobile-user VPN boxes. They are easy to set up and work well for a relatively small number of users. Feel free to email me if anyone has questions about this solution.
  • Primary reason why I like it as it uses UDP protocol for packet transmission.

    That is REALLY effective in utilizing multiple connections to the same locations for redundancy, with varying weights, for example if you use something like Quagga for BGP routing management.

    Works fabulously and the config is trivial.

    -Hack
  • I've used PopTop in the past, and it works fine for the kind of scenario you're describing. It's free (as in speech and beer), has adequate - albeit not great - documentation, and is fairly easy to install and configure.

    The biggest downside I'm aware of is that the MS-CHAPv2 protocol doesn't use the world's best encryption. Research MS-CHAP, see if it's secure enough for your needs; if so, I think PopTop would be a fine solution.

    The next thing that comes to mind is something like FreeSWAN/OpenSWAN, whic
  • I've used apache with webdav over https on several occasions for remote file sharing. Works great on 2000 & XP through webfolders without additional software. Users can just browse using windows explorer as if working with local files. OSX needs a special app (goliath). tuning apache to user webdav with XP is the hardest part (but there's an manual here [ibiblio.org] and here [caltech.edu].

  • OpenVPN (Score:4, Informative)

    by eno2001 ( 527078 ) on Wednesday January 05, 2005 @11:34AM (#11263720) Homepage Journal
    Go look at my very first JE a while back and I point out that OpenVPN is cross platform (Windows, Linux, MacOS X, BSDs, etc...) and works fairly well. Be warned that you need to use the latest Beta with Windows XP as SP2 breaks the last stable version. I've been using it going from Linux to Linux and it works great. Full access to my network at home from anywhere. All you need to do is open on UDP port and this will actually tunnel TCP and UDP traffic, so even Voice over IP will work with this for a private IP phone setup. Check it [sourceforge.net] out. It's worth the effort.

    As a side note, I used to use SSH tunnels. That worked very well for me too, but it required a good deal of setup and mapping ports on the remote end to ports on the local end. It's great as far as cross-platform goes, and if you don't have things changing much on your network, it really works well, but it won't handle UDP traffic. Not to mention, when I used it with VNC, I had to map remote ports to local ports that were unused. So if I connected to 'mymachine:1' at home, I would connect to '127.0.0.1:21' at work since I couldn't stomp over :1 on my machine here. With OpenVPN, that all goes away. You just connect to the remote machine by its own IP (or if you get DNS or hosts set up right by its name).

    I'll also mention that I'm using OpenVPN in "routing" mode. I throw all traffic destined for my home network to the tun1 interface that openVPN brings up on my local machine. You can also use openVPN in bridged mode which is a bit more of a headache to set up since you need to know how to break your network up into ranges for each location. Bascially subnetting. But the advantage of bridged mode is that broadcasts will be carried over the tunnel. OpenVPN is about the closest you get in a free project to having a virtual ethernet cable going from one end of the connection to the other. In the end, I think this is what you want. Hope this helps.
  • It is not exaktly a VPN programm, but it do that what you want do with a VPN:
    - give access to the all the internal servers (SaMBa, Mail, WWW)
    - has strong encryption
    - has public key authenification
    - is invisible (NO default ports)
    - Linux and Windows Version.
    Just work.
    http://www.winton.org.uk/zebedee/ [winton.org.uk]

    I'm using it in a few project with NO problems at all.

  • "I'm looking for a low cost solution for allowing myself and a few others the ability to share a server at one of our locations. One thought was using SSH tunnels to establish secure connections,

    OpenBSD, FreeBSD, Solaris (Intel) and most Linux distros offer IPSec VPN as part of the OS Most run well on older hardware and can be a router, gateway, NAT, IP tunnrling as well as a mail relay, IMAP server and of course come with repected firewalls. You can also run IDS software such as Snort, AprWatch and c

Slashdot Top Deals

"What man has done, man can aspire to do." -- Jerry Pournelle, about space flight

Close