Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

VPN solution

Posted on 2007-04-04
1
Medium Priority
?
241 Views
Last Modified: 2010-04-12
This question is more educational than an actual technical/configuration issue. I currently run a small network with an edge c2620 router and a layer 2 3560G switch which does VLAN trunking to a linux firewall/gateway for my end hosts.

My firewall, which sits on the DMZ, is also currently running OpenVPN so users can remotely VPN into the internal network. As this is just currently a beta network, certificate based authentication is all that's used.

Now, this is where my slight dilemma falls into place. I need to allow a set of users to VPN who I don't trust as much. I don't necessarily feel it's a great idea to give them certificate based auth cause they can just toss the certificate on any client and be able to VPN. Also, I'm not responsible for security on their workstations, so if they get compromised, the attacker will have access to my network.

I'd like to figure out a solution to the above. My end users, located in an overseas office, do not have access to their gateway. That, and I'm not entirely sure any of my network equipment have an IOS that supports VPN, but I may be wrong.

Will OpenVPN still be an adequate solution? Should I just make all users authenticate against LDAP? Is there anyway to leave certain users on just certificate based auth and others on LDAP based auth?

0
Comment
Question by:stevefNYC
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 11

Accepted Solution

by:
kblack05 earned 2000 total points
ID: 18883476
OpenVPN is a great solution. The alternatives are IPSec, which is prone to breakage, and also buying a Cisco concentrator or similar (which is phenomenally expensive). Here is a great article which covers all the caviets of the comparison: http://www.linuxjournal.com/article/7949

With respects to your claim of clients hopping on any node they wish and copying the keys, there is a simple solution for this. Add clients allowed by network block in IP Tables rather than opening OpenVPN ports up to the globe.

A basic iptables rules looks like this:
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -A INPUT -i eth0 -p udp -s ip_addr_of_the_other_router --sport 1194 --dport 1194 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp -d ip_addr_of_the_other_router --dport 1194 --sport 1194 -j ACCEPT
iptables -A INPUT -i tun0 -j ACCEPT
iptables -A OUTPUT -o tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -j ACCEPT

http://www.linuxhorizon.ro/openvpn-brief.html
0

Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article will inform Clients about common and important expectations from the freelancers (Experts) who are looking at your Gig.
During and after that shift to cloud, one area that still poses a struggle for many organizations is what to do with their department file shares.
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…
Suggested Courses

604 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question