From owner-freebsd-security@FreeBSD.ORG Thu Mar 8 07:57:27 2007 Return-Path: X-Original-To: freebsd-security@freebsd.org Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id C008716A401 for ; Thu, 8 Mar 2007 07:57:27 +0000 (UTC) (envelope-from tom@tomjudge.com) Received: from smtp802.mail.ird.yahoo.com (smtp802.mail.ird.yahoo.com [217.146.188.62]) by mx1.freebsd.org (Postfix) with SMTP id 39F3D13C46B for ; Thu, 8 Mar 2007 07:57:27 +0000 (UTC) (envelope-from tom@tomjudge.com) Received: (qmail 75705 invoked from network); 8 Mar 2007 07:57:26 -0000 Received: from unknown (HELO ?192.168.1.2?) (thomasjudge@btinternet.com@81.157.42.3 with plain) by smtp802.mail.ird.yahoo.com with SMTP; 8 Mar 2007 07:57:25 -0000 X-YMail-OSG: 9HsxFuMVM1mSFYIjD2vulBgPy6XpjnbStsqMsIbCB1Izh.9MlsCAxkkQik3Os1GFMIyAeohAsYKS3utZDiawNReectisEUmJtdB0DG2eWNjlQ9RRWMgDm29Ny2r5nw-- Message-ID: <45EFC25C.2060802@tomjudge.com> Date: Thu, 08 Mar 2007 07:59:24 +0000 From: Tom Judge User-Agent: Thunderbird 1.5.0.9 (X11/20070104) MIME-Version: 1.0 To: Robert Johannes References: <20070307170617.GA2799@zen.inc> <45EF2EFF.5080407@tomjudge.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: freebsd-security@freebsd.org Subject: Re: freebsd vpn server behind nat dsl router X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Mar 2007 07:57:27 -0000 Robert Johannes wrote: > On Wed, 7 Mar 2007, Tom Judge wrote: >Looking into adding nat-t to ipsec as we speak. > >> >> I would suggest you go with Yvan's suggestion of doing away with gif >> and adding the nat-t support to ipsec. Alternatively you could use a >> UDP/TCP based vpn solution such as openvpn (in ports and >> http://openvpn.net/) which will be fully compatible with you nat >> setup, openvpn will also be tolerant to remote end points changing ip >> address half while the vpn link is active, comes in hand when used in >> combination with a dynamic dns service). > > As far as openvpn goes, I looked into it in October or Nov. last year, > and it seemed not to be very scalable; I have 6 different offices that > all need to connect and chat with each other, and it didn't seem like > openvpn would allow for this to happen. I didn't investigate it much > beyond that when I learned that. > > There are no problems with connecting 6 sites together with openvpn, you could either run separate instances of openvpn for each site or using the correct configuration option that specifies all clients can talk to each other via the server. However I would have though that you would want each site to have a link to every other site directly, in which case a openvpn server at each site is you best option, with a number of clients if you use ospf/bgp you will be able to easily maintain your routing table with all these links and be able to survive a link failure as the traffic will get routed via another site rather than directly to its destination. It would be advisable to use a routing protocol such as ospf even if you decide to use IPSec as is simplifies the maintenance of the routing table, and allows new sites to be added easily and quickly. Just my 2p Tom