I am looking for the optimal VPN. Well it doens't have to be that elaborate. Just the best VPN. We currently have some customers using PPTP, some using openvpn, some using Cisco Any Connect and there are a few others. So my question is, if you have control of both ends (client and server) what is the best VPN to use? There are not too many requirements, but a big one is The VPN must return the same IP address to the same user each time That is there must be a specific IP address assigned to a user/password combination. pptp does not really do this but I wrote sort of a backend (or maybe frontend? ;-) ) to change the IP address assigned based on a login and password. It is extra stuff I would prefer not to do though.
tony.chamberlain at lemko.com writes:> > > I am looking for the optimal VPN. Well it doens't have to be that elaborate. > Just the best VPN. We currently have some customers using PPTP, some using > openvpn, some using Cisco Any Connect and there are a few others. > > So my question is, if you have control of both ends (client and server) > what is the best VPN to use? There are not too many requirements, but a > big one is > > The VPN must return the same IP address to the same user each time > > That is there must be a specific IP address assigned to a user/password > combination. pptp does not really do this but I wrote sort of a backend > (or maybe frontend? ;-) ) to change the IP address assigned based on a > login and password. It is extra stuff I would prefer not to do though. >OpenVPN can do that (see their commercial solution as well).> > _______________________________________________ > CentOS mailing list > CentOS at centos.org > http://lists.centos.org/mailman/listinfo/centos >
tony.chamberlain at lemko.com wrote:> I am looking for the optimal VPN. Well it doens't have to be that elaborate. > Just the best VPN. We currently have some customers using PPTP, some using > openvpn, some using Cisco Any Connect and there are a few others. > > So my question is, if you have control of both ends (client and server) > what is the best VPN to use? There are not too many requirements, but a > big one is > > The VPN must return the same IP address to the same user each time > > That is there must be a specific IP address assigned to a user/password > combination. pptp does not really do this but I wrote sort of a backend > (or maybe frontend? ;-) ) to change the IP address assigned based on a > login and password. It is extra stuff I would prefer not to do though. > > > _______________________________________________ > CentOS mailing list > CentOS at centos.org > http://lists.centos.org/mailman/listinfo/centos >My sense is that openvpn is the easiest to configure, the most robust and fault tolerant, as far as keeping connections up and reestablishing failed connections. The downside of openvpn is incompatibility with most mobile devices, not relevant if you are able to install openvpn clients. You can configure fixed IP addresses using either the ccd files or the client-connect script. Based on other discussussions on the list my recollection is that IPSEC provides better performance if you need GigE or better data rates on your VPNs. My sense is that IPSEC may be more difficult to configure and less robust at keeping connections up, but this has probably improved in recent years. The main advantage to pptp that I see is compatibility with mobile devices. A disadvantage of PPTP, as far as I know it cannot easily be tunneled through something like a linux firewall because it uses non-standard protocol packets (not TCP/UDP). Both OPENVPN and IPSEC can easily be tunneled through most firewalls. Though I have not researched this extensively, just based on watching list of security updates that get released for Centos, Fedora etc, It seems that OPENVPN has had very few security issues. I have definely seen a few for strongswan and openswan (both are IPSEC implementations). Again this is just gut feeling, not the result of any investigation. I do note though that OPENVPN runs easily in a chroot environment, just by enabling options in the config file. I'm not sure if openswan or strongswan can do this. Nataraj
-----Original Message-----> _______________________________________________ > CentOS mailing list > CentOS at centos.org > http://lists.centos.org/mailman/listinfo/centos >My sense is that openvpn is the easiest to configure, the most robust and fault tolerant, as far as keeping connections up and reestablishing failed connections. The downside of openvpn is incompatibility with most mobile devices, not relevant if you are able to install openvpn clients. You can configure fixed IP addresses using either the ccd files or the client-connect script. Based on other discussussions on the list my recollection is that IPSEC provides better performance if you need GigE or better data rates on your VPNs. My sense is that IPSEC may be more difficult to configure and less robust at keeping connections up, but this has probably improved in recent years. The main advantage to pptp that I see is compatibility with mobile devices. A disadvantage of PPTP, as far as I know it cannot easily be tunneled through something like a linux firewall because it uses non-standard protocol packets (not TCP/UDP). Both OPENVPN and IPSEC can easily be tunneled through most firewalls. Though I have not researched this extensively, just based on watching list of security updates that get released for Centos, Fedora etc, It seems that OPENVPN has had very few security issues. I have definely seen a few for strongswan and openswan (both are IPSEC implementations). Again this is just gut feeling, not the result of any investigation. I do note though that OPENVPN runs easily in a chroot environment, just by enabling options in the config file. I'm not sure if openswan or strongswan can do this. Nataraj _______________________________________________ Hi, If you don't use any fancy features, OpenVPN is rather easy to set up. Additional effort is needed with: -certificates -routing -smartcards Exactly _the same troubles_ you will encounter with ipsec (though i have only used with strongswan) If it is only master/slave configuration, openvpn will do, for a more complex topology (meshed) consider ipsec Will you be confronted with IPv6 in the (not so) near future? Forget OpenVPN, it is still beta there, while it has been implemented in strongswan for ages, and part of there standard test plan. Furthermore, openvpn is only compatible with openvpn, while using ipsec you might be able to connect to other boxes. If you can install software on both ends, openvpn is available for many platforms. hw ______________________________________________________________________ Dit bericht kan informatie bevatten die niet voor u is bestemd. Indien u niet de geadresseerde bent of dit bericht abusievelijk aan u is toegezonden, wordt u verzocht dat aan de afzender te melden en het bericht te verwijderen. De Staat aanvaardt geen aansprakelijkheid voor schade, van welke aard ook, die verband houdt met risico's verbonden aan het elektronisch verzenden van berichten. This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. The State accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages.
On 25/11/10 4:07 AM, tony.chamberlain at lemko.com wrote:> > > I am looking for the optimal VPN. Well it doens't have to be that elaborate. > Just the best VPN. We currently have some customers using PPTP, some using > openvpn, some using Cisco Any Connect and there are a few others.Be careful with the Cisco VPN solutions. Cisco's VPN client is notoriously bad at handling 64-bit architecture and frequently induces kernel panics (I've seen this in both Linux and OS X systems).> So my question is, if you have control of both ends (client and server) > what is the best VPN to use? There are not too many requirements, but a > big one isI'd go for OpenVPN, it's free and widely supported across multiple platforms.> The VPN must return the same IP address to the same user each time > > That is there must be a specific IP address assigned to a user/password > combination. pptp does not really do this but I wrote sort of a backend > (or maybe frontend? ;-) ) to change the IP address assigned based on a > login and password. It is extra stuff I would prefer not to do though.RADIUS can assign a specific IP to a given user, but let OpenVPN handle the encryption. Regards, Ben -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 227 bytes Desc: OpenPGP digital signature URL: <http://lists.centos.org/pipermail/centos/attachments/20101201/da0c0637/attachment-0001.sig>
On 30/11/10 15:49, Ben McGinnes wrote:>> > That is there must be a specific IP address assigned to a user/password >> > combination. pptp does not really do this but I wrote sort of a backend >> > (or maybe frontend? ;-) ) to change the IP address assigned based on a >> > login and password. It is extra stuff I would prefer not to do though. > > RADIUS can assign a specific IP to a given user, but let OpenVPN > handle the encryption.You don't even need RADIUS to provide specific IP addresses. You can either use --ifconfig-pool-persist or --client-config-dir. --ifconfig-pool-persist will create a file with a kind of a database of which IP addresses assigned to clients earlier, and will re-assign the same IP address if found here. That's the automatic way of doing it. However, if you're running out of IP addresses from your initial address pool, IP addresses will be reused. --client-config-dir combined with --push "ifconfig <ipaddr> <netmask>" in a client specific config file, will provide this feature consistently. It's also possible to use other plug-ins or scripts to provide client specific IP addresses and/or routes dynamically, based on who the client is ... Which is what the RADIUS plug-in does. kind regards, David Sommerseth