Slashdot Mirror

Once I set it up for Windows and Linux, though, adding a Macbook to the network was a piece of cake by comparison, although OS X uses Racoon instead of Openswan, so I had to do even more research, and write a custom startup script.

i also recommend openvpn. supported on a majority of systems: windows 2k/xp, linux, mac os x, bsds, & solaris. here's the howto.

imho, great example of kernel/user-land separation: tun/tap virtual device driver is the only kernel-side part, the rest is in user-land. no more having freeswan keep the system from cleanly shutting down because of a lost reference to a network device. but there is overhead from context switches between kernel & user, though it's a trade-off i think is worthwhile.

you can do ip or ethernet tunneling, depending how far down the osi model you want to go and how much overhead you are willing/able to process. with a single wireless client in my household, i do ethernet tunneling, as it frees me from having to do any ip routing and configuring a wins server (which i've found problematic with windows 2000 and samba 2.2 on debian stable).

openvpn openvpn can use shared key or tls, just depends on what you want. you can quickly develop a proof of concept with shared keys (prove software installation, network communication, etc work) and then "upgrade" to tls.

openvpn uses openssl for it's encryption/authentication engine. that means that all the scrutiny and improvements openssl receives (security analysis, assembly encoded algorithms, hardware engines, etc) benefits openvpn. i'm interested in doing openvpn on the via epia platform with hardware-assisted openssl serving as wireless xterminals.

encrypting lots of bandwidth means lots of processor cycles, and depending on the speed of your processors and the bandwidth between the two, expect some slow down. this is not particular to openvpn, but any (software) encryption, so choose your hardware accordingly (with lots of benchmarking for your particular use case).

ipsec is a valid option, though i prefer openvpn. ipsec is a standard, and is supported on more platforms than openvpn (especially embedded systems & dedicated hardware), but is firstly cumbersome to configure and secondly compatibility is theoretically possible between all implementation but not guaranteed. i once connected windows 2000 and linux/freeswan using ipsec. nate carlson's howto is invaluable. with linux 2.6 it's even harder to implement ipsec with iptables because neither the in-kernel ipsec implementation nor openswan support virtual interfaces (ipsec[0-9]). supposedly it's "possible" using iptables to tag packets, but i won't consider it "practical" until it's easy enough to be documented in a howto.

Here is a reference on what I just described.

I've got a Sanyo 8100 with SprintPCS. I pay for the picture sending service too..but, that includes unlimited internet access. As soon as I finish getting Linux on my new laptop, I'm gonna get the cable to attach the phone to the usb port on it...and voila!! Moderately high speed internet connection when I'm out and about...

I called the Sprint people specificially when I got the phone and asked if the internet connectivity was unlimited..and NOT taken off my voice minutes. He said this was the case...

So, not sure if the Verizon setup is the same, but, is a decent deal for me for the extra $15/mo.

Here's a link describing how it can be done with a different sanyo phone, but, same basic principal and method: Sanyo Phone And Linux box

I'd rather have an OSI Red Team that was more like Delta Force.

They could wear MIT wearables, have an internet uplink, and code-fu your ass into submission.

Check out the "Vision" service from Sprint. It's an extra $10 a month for unlimited usage. There is a USB data cable which lets your sprint phone (I have a Sanyo 4900) work as a USB modem - and yes, it works with Linux. The Sprint Vision service gives you a digital connection at about 56k.

They don't advertise it any more and they don't sell the cable any more. Check ebay for the cable and make sure you have a compatible phone.

Here's a HOWTO for it.

No, it's just another way for the poster, Nate Carlson, to show everyone how Very Important and Interesting and Beautiful He Is.