Slashdot Mirror
Open VPNs On Unix That Support Windows Clients?
Adam Schumacher writes:"At work, I've been investigating the possibility of migrating our proxy/ftp/VPN server from NT4 to Linux. Proxying and FTP are obviously no problem, but I am at a bit of a loss as to what to recommend as our VPN server. We need transparent and secure tunneling of our network traffic across the Internet to Windows 95/98/NT/2000 workstations. I know that there are commercial vendors offering VPN solutions that interoperate beautifully between Windows and Linux, but these carry a hefty pricetag, upwards of several thousand dollars. I would much rather go with an Open Source solution. What experience have you had with setting up a VPN between a Linux server and Windows clients? Can you recommend any particular products I should investigate further? In the event that we do have to go with a commercial solution, would you recommend one product over another? Why? Bear in mind that this machine will control access to our entire internal network, so I need a product that has been proven to be robust and secure. Immature code need not apply."
I recommend SonicWall (http://www.sonicwall.com). They work great. Tech support never answers, but neither does Checkpoint's, and a hefty SonicWall only costs 1/10 as much ($2500). VPN clients cost $50 each. It also does nice firewall stuff.
Hey, ssh has port redirection over a tunnel to another box with ssh on it. We had it setup here, with a NT 4 server on one end and a few 95 clients on the other. The Windows people didn't even know they were going over anything but a LAN, because we managed to get samba to flow seamlessly over ssh. Drop me a note if you want more info. mattj@invisik.com
I use a VPN system called Carnivore, by FBI Privacy Solutions, Inc. The FBI techs (called agents) are extremely helpful, and do all the installation and monitoring for you, no added charge.
Once the VPN systems were in production with Freeswan, they were plagued by kernel panics, flaky startup and shutdown and many other problems.
Also, back then, there was a major problem with Windows clients connecting using DHCP addresses (all?!!), in that the way Freeswan is configured, it expects a static IP address at the other end of the tunnel.
These guys who are posting that Freeswan is any sort of panacea, or even a workable solution, either haven't used it for real or are using a dramatically different product than the one I used 4 months ago.
You can read my many cries for help on the mailing list archives I'm sure. Whatever your case, I wouldn't recommend Freeswan unless they have fixed the kernel panics, flaky startup and shutdown,and the dependency on fixed IP addresses.
My two cents. --Aaron Newsome
Once the VPN systems were in production with Freeswan, they were plagued by kernel panics, flaky startup and shutdown and many other problems.
Also, back then, there was a major problem with Windows clients connecting using DHCP addresses (all?!!), in that the way Freeswan is configured, it expects a static IP address at the other end of the tunnel.
These guys who are posting that Freeswan is any sort of panacea, or even a workable solution, either haven't used it for real or are using a dramatically different product than the one I used 4 months ago.
You can read my many cries for help on the mailing list archives I'm sure. Whatever your case, I wouldn't recommend Freeswan unless they have fixed the kernel panics, flaky startup and shutdown,and the dependency on fixed IP addresses.
I submitted this earlier as a reply, I hope the dupe engine doesn't flag me as bad.
My two cents. --Aaron Newsome
WWJD? JWRTFM!!!
"This is not the VPN solution you're looking for."
--
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
The quick answer:
First of all, if you want a VPN with Windows clients and don't want to spend any money, use PoPToP. However, be aware: PoPToP doesn't work correctly with many broken versions of Windows, and the PPTP protocol has some serious shortcomings.
IPsec, while still not being particularly secure, is a somewhat better protocol. However, you'll need to purchase a commercial Windows client to use it (even with Windows 2000, which supports IPsec, you'll need a commercial client such as that from Network Associates to work without L2TP; I haven't heard of anyone making succesful use of l2tpd in this context). Via FreeS/WAN, a free, high quality client/server solution for linux is available, as well.
In any event, you'll want to use ipsec for your linux clients. Use it for your Windows clients also, if you can afford the commercial software.
Posted by BSD-Pat:
recently, at USENIX, I had the pleasure of talking to Jason Wright, who works at NETSEC.
Jason is also an OpenBSD developer, and rpesented a paper on something very interesting, which I am in the process of planning to deploy.
OpenBSD currently can bridge layer 2 over IPSec interfaces, which makes for a nice, transparent VPN.
those who are interested, I can point anyone to the paper that was written, its also available from the USENIX Association... http://www.usenix.org.
echoing other people's comments, OpenBSD , because of its IPSec implementation, is perfect for this scenario, in fact IMHO its really the only thing that will do this particular job this well.
And this is coming from someone adamantly pro-FreeBSD =)
-Pat
1) Kernel patches (yay). There seem to be problems getting these patches to work with some distros (read: Red Hat) that have slightly-customized kernels
Only if you're dealing with some bonehead distribution that customizes the kernel instead of using kernel modules and a userland (or at least non-invasive) process to do whatever the hell it is they think is so important they should modify the kernel in the first place.
2) Windows only supports some real lame encryption out-of-the-box. To get 128 bit, you have to go through some real hoops to get the software from Microsoft, only to find it doesn't work.
Got some proof? I downloaded an easily-found file from MS' site, installed it and while I have not verified that it is indeed spitting out 128-bit encryption (anyone know a good way to actually test the wire?) pptpd/pppd won't talk to the client if I force 128-bit encryption on the server side and use weak encryption on the client.
3) Firewall/IPMasq causes even more fun, depending on which side of the firemasq the PPTP server is on.
Come on. This is getting silly. In my case I put the pptpd server on the firewall. I figure a VPN is an integral part of a firewall. Then I set aside a block of IPs and set up your masquerade rules to match. The hardest part of my whole firewall was making sure that my input chain didn't kill packets I didn't want gone. The forward chain is only three lines long.
4) Browsing windows shares over a VPN link is akin to black magic and seldom works.
I haven't had too much trouble. You mention that you're on the PoPToP list. Check out the Samba lists as well and read up on Samba and WINS. The key is a WINS server which is accessible to everyone (internal and VPN).
The rabbit I'm gonna have to pull out of my hat involves setting up a VPN'd subnet (using FreeS/WAN, pptpd is useless here) and making a couple servers on the inside of each end appear in the subnet as well, without munging things up too badly and without having each server step too much into the VPN. I may just set up coda and Samba on the firewalls and "fake" that they're the servers in question. It'll make security tighter in the end, I think.
Moretonbay, the company who gave us so much work on uCLinux has PoPToP, a Linux PPTP server.
I have set it up personally and included the MPPE and stateless patches which give excellent performance and 128-bit encryption.
You mentioned that immature code need not apply. I can't say how mature this code is but I have not had any problem with the encryption nor the actual VPN going down or otherwise futzing up.
PoPToP uses pppd + openssl with a custom daemon to set up Windows VPN connections. You can force MSCHAPV2 (V1 has problems with security, what else is new? :-), enforce 128-bit encryption, use PAP or CHAP, whatever you please. Since it is pppd which is authenticating, you can use PAM or whatever authentication methods you can use with pppd. Another important feature is that you can configure pptpd to assin IPs or have pppd do it for you. Configuring for MPPE and stateless compression was a bit of a pain but in reality it involved scanning the already big mailing list and applying the correct version of the patches.
Overall I am very pleased with PoPToP, even if my typing slows to 10WPM when I have to type the name. :-)
2) Then, there's always SKIP. An invention of SUN, but still worth investigating. SKIP has higher throughput than IPSEC, and faster recovery in the event of a system failure anywhere down the chain. Again, it's available for Windows and Linux.
3) Thirdly, there's SSH, SCP, et al. This is OK, but it's main drawback as a -transparent- VPN is that it's not very transparent. It's at the application level, rather than the stack level, which means that it's going to be more visible to the average user.
4) Last, but by no means least, your favourite hound of hell and mine, Kerberos! It's possible to set Kerberos as both an authentication AND an encryption mechanism. The main drawback with this option is that applications would need to be aware of Kerberos before they could benefit.
All in all, I'd say IPSEC or SUN SKIP are your two best options, as they don't require any user intervention or special code in the application.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
I've got a system I've been sitting on for a while that gives you the network isolation of Windows PPTP with the trustable crypto of SSH. I haven't done much development work on it in quite some time; anyone out there who'd like to hack on this and get it up to 1.0, toss me a note.
Yours Truly,
Dan Kaminsky
DoxPara Research
http://www.doxpara.com
"Little Caesars? You do pizza?"
What the hell are you talking about? I just downloaded VPND source code and looked at it myself. Looks fine to me. Go troll somewhere else. I got it from the link below, btw.
http://sunsite.auc.dk/vpnd/
___
___
If you think big enough, you'll never have to do it.
uh, free s/wan works with anything that does tcp/ip.
US Citizen living abroad? Register to vote!
IPSec is one of the more interesting technologies out there at the moment. Essentially, it has the advantages of being implemented into multiple diffrent server platforms and client workstations.
For example OpenBSD supports it's natively and Linux can be made to support it with the FreeS/WAN projects kernel patches which allow you the IPSec functionality.
Unforuntately, the problems lie with IPSec compatible clients for the Win32 platform:
Essentially, if you company uses Win9X and NT then you have no problems. The Link will show you a bunch of clients that will actually work under OpenBSD's implementation of IPSec. Some of which are actually quite good.
On the other hand Windows 2000 is VERY unsupported. In fact it is very hard to find a Windows 2000 implementation (other then the poor implementation in Windows 2000 itself). Quite a few promise an implementation in a few months, some even a few weeks, but that does little if you need it done now.
If you need to get VPN clients for Windows 2000. I have found two that support it, but have yet to be able to test it's implementation ability with OpenBSD (the companies current Firewall/NAT platform). The two I have found are listed below:
.
Now if anyone else knows of Windows 2000 compatible clients that work with IPSec then I would be very interested in knowing about them
Server: OpenBSD
l ient_intro.asp
Client: NAI Labs PGP Client
Information On PGP Client:
http://www.pgp.com/asp_set/products/tns/pgpvpnc
To quote their page:
PGP MIT Freeware Downloads
PGP is the world's defacto standard for email encryption and authentication, with over 6 million users. PGP 6.5.1 MIT freeware supports RSA, PGP email and secure client-to-client connections using PGP certificates. It is available for non-commercial use only.
The commercial PGP VPN Client is available from Network Associates and is fully IPSec compliant with support for X.509 certificates from industry leaders such as VeriSign, Entrust and Net Tools, and VPN gateway support to create encrypted network connections to your company for secure remote access. The commercial client also includes PGPdisk for lightning fast disk, file and directory encryption and authentication in addition to technical support!
-------------------------------------------
Use the OpenBSD mailing list archives, man pages, and faqs for info on how to set up this scenario (VPNs with X.509 certificates).
The difference between Open Source and Free Software is just a matter of focus (focus on freedom or on open development), of ideology, and of degree of purism (some borderline licences might get more easily accepted by Open Source advocates than by Free Software ones), but the main idea is the same: software where you get the source code, and the right to use, modify, alter, compile and distribute (incl. for profit) under the same conditions.
Only if you're dealing with some bonehead distribution that customizes the kernel instead of using kernel modules and a userland (or at least non-invasive) process to do whatever the hell it is they think is so important they should modify the kernel in the first place.
Userland processes to fix kernel security bugs?
--
http://freshmeat.net/search.php3?query=v pn
I think what you mean to say here is "I want someone to make me this thing for free." This is a great example of why RMS doesn't like the term Open Source. For 90% of the schmucks out there it translates to Free Beer, rather than the Free Speech he is speaking of. You want VPN software? Go write it and GPL it.
Left shift 1 for e-mail...
I'm actually pretty shocked that you managed to score a rating of 4: Insightful off this one, but what the hell, I'll bite.
Is that not reasonable? I use OpenSSH, Snort, and nmap all the time at my place of business for security. For other purposes, I use Red Hat, Debian, Apache, Perl, PHP, MySQL, and PostgresSQL. All "high-powered, reliable software," as you put it. All free.
This may come as a shock to you, but I'm not in the habit of spending money on Open Source software unless I absolutely have to. Oh, I've certainly purchased the occasional RH distro CD because I wanted to install it at home, but at work, where I'm fortunate to have a decent net connection, I do net installs like crazy.
It's true that you can spend money on OSS. However, most people associate OSS with no charge, and not without reason.
The orignal poster stated that he would rather go with an Open Source solution rather than ones that "carry a hefty pricetag, upwards of several thousand dollars." I think that this is an important consideration for him. Since you didn't suggest any commercial solutions (or, in fact, OSS ones), I'll pose the converse question to you: what is your familiarity with VPN software, and what commercial solution would you say was the best?
I thought that the original post articulated his reasons for pursuing an Open Source package pretty nicely. On the flip side, your post seems to reflect a prejudice that only businessess with money to burn should have access to decent software. If you're of the opinion that Open Source software has no role in mission critical applications, fine, but just out of curiosity, why the hell would you read /.?
If this box will have proxy, ftp, and VPN on it all at once and have access inside and outside I would consider not putting the ftp server on this box. FTP servers are usually best put some cold place all by themself. What with all the various problems that have occured with PROftpd, wuftpd, etc. I would hesitate giving a process like that root level access on my vpn =)
I think he was clear. He wants somethign that supports windows VPN clients.
Granted, not everyone's a programmer, but when people turn to Linux because they _expect_ free (as in beer) software, that kinda yanks my krank.
You don't need to be a programmer to be a good sys admin, but it's getting too easy for people to take Free software for granted.
If you have a Cisco PIX or a 7100 or 7200 router you can set up a PPTP server which does MPPE on that which will authenticate against a RADIUS server. Set up the RADIUS server on your windows domain controllers so the users can just use their domain login. If you have Win2k domain controllers, you can control who has access to the vpn with the allow dialin flag.
Since you're running a proxy, I doubt you have a PIX, but if you do happen to have a 7100 or a 7200 this would work great, you can also use L2TP on the router, not sure about the firewall though. You can run PPTP on other cisco products, but you won't get the MPPE encryption with most of them. I use a couple of them set up on routers right now and they work excellent. I have tried using the PPTP server built into the PIX and it sucks, I think they basically put it in as a marketing gimmick.
As far as proxy servers go, I set up a Linux box with Squid and Dante. It has an uptime of over 200 days right now and I haven't had any trouble with it... except for this custom app that does http posts and the proxy likes to munge up the content-length header which screws up the app.
Need Free Juniper/NetScreen Support? JuniperForum
(I have an answer to the question at the end of my rant)
Is there an open Slashdot terminal in some public place? Because these "Ask Slashdots" are starting to seem more like "Ask A Random Question Without Searching First". This is getting REALLY lame.
Now, then. Go to Yahoo (yes, even Yahoo can find this, albeit through Google). Type "linux vpn". Find a link. Follow it.
For those that aren't interested in enough to click, this is PoPToP, a Linux implementation of the server-side of MS PPTP. A secure implementation. Why PPTP? Because you want Windows clients and the only thing they do out of the box is PPTP. BTW, PoPToP is GPL'd....
--
Linux MAPI Server!
http://www.openone.com/software/MailOne/
(Exchange Migration HOWTO coming soon)
Although this is not the VPN solution you're looking for, it is very cool.
You can use taptunnel to connect multiple LANs together through an encrypted pipe.
It's also the best solution for playing multiplayer IPX games like starcraft between LANs.
XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-U
We finally decided on OpenBSD although we considered Linux, Tru64, Solaris, NetBSD, FreeBSD, Irix, NT and Windows 2000. By considered, I mean we thought about it. But we finally decided on OpenBSD because throughout all the security bulletins that we've seen, this was the one that touted the best security, and was notably lacking in security bulletins.
We have been extremely satisfied with OpenBSD, and use it as a real bastion firewall, and as a transparent bridge to our production servers. It has an incredible amount of power, and is very versatile. Combined with Snort, Nessus, Nmap, IPF, and Perl (or any scripting language), it makes an wonderful IDS (Intrusion Detection System). I have yet to see a commercial system rival the power of this open source system in terms of complexity and diversity.
I've heard good things about the AltaVista tunneling software from some people who were looking at a very similar situation. It appears to be abandoned, although it may just be hiding.
I found links to it on Tom Dunigan's VPN page, which has a number of good links for the problem at hand.
A link to AltaVista tunnel info that does work is found on this Digital link in Russia, which is oddly, in English.
Again, I haven't tried this myself, so caveat emptor.
"The future's good and the present is nothing to sneeze at." - Roblimo's last
I'm a leaf on the wind. Watch how I soar.
It is meant more to connect two subnets, rather than a single device to a network. Also, it does not run on windows. However, you can do what I do, and resurrect an old 486 to act as a gateway/firewall/vpnd server at home, and hook your windows box to it.
It is setup to re-establish broken connections. Even though I often lose connectivity between work and home, as long as the downtime is less than a tcp timeout, all of my tcp connections over the encrypted channel will actually remain up! Very nice.
I'm a leaf on the wind. Watch how I soar.
Hi, I'd like to move a server from NT4 to Linux. I'd like to stress that it is a server that is extremely vital to my company's business.
It is so vital in fact that I'm prepared to spend no money on it at all. I want someone to give me high-powered, reliable software upon which I can bet my job, for free.
Why must Open-Source necessarily equal free?
Why does Open-Source necessarily equal best?
If it were my job on the line here, I'd find the best solution, not necessarily the one that meets my agenda.
I agree wholeheartedly. And I'd mod you up if I ever got moderation points when I fscking wanted them.
(rant)
Taco: Can't we move to a moderation system where people accumulate moderation points and can use them WHENEVER they want. Just put a cap on it so people who go on vacation don't come back to 1000 moderation points or something. I NEVER get moderation points when I want them, and only get them when there is nothing really of interest to me, or just flames or hot grits.
(/rant)
It's 10 PM. Do you know if you're un-American?
Not to give moderators too much credit, but it *might* have been somebody trying to be funny. I have to admit it made me laugh.
Check this out. I've had it working flawlessly for a while now. There isn't much out there that isn't more proven or secure than ssh. Give it a try, it's the best of what's out there.
Interested in open source engine management for your Subaru?
Comment removed based on user account deletion
I checked into VPND somewhat recently to see if it'd be a nice way to link a few LANs which have faily powerful (min 200Mhz) firewalls which could be used to tunnel traffic.
I looked at the source code, as I had to port the program to OpenBSD. My first thought was that the person who wrote the code must've been some ASM programmer who took a 5-hour course in C. The entire body of main is the entire source file. Functional programming? What's that? The code is one big blob function. You can see blocks which are similar and could probably be handled by a separate function, but aren't.
My friend's first comment on waving him over to see the code was, "and you wanted to run that on your server?"
The code looks a lot like procmail's code, and is (IMO) a complete tear down and rewrite. I'm sure a lot can be salvaged from vpnd, but I find it hard to believe that the person who wrote code looking like that also did the strictest possible checking on all input/output code for security problems.
You might want to read the VPN section of the Linux Admin Security Guide for a listing of alternatives.
---
--
Internet Explorer (n): Another bug -- that is, a feature that can't be turned off -- in Windows.
Using this at our site to do VPN with several other Linux boxen. It's IPSec compliant, so PGPNet, W2K, and others have all been noted to work with it. It's a pretty good solution.
Yeah, PPTPv1 is very broken, but PoPToP also implements PPTPv2 which I understand is a massive improvement. You can force v2-only connections too.
Looks to be a v.good product; something that I'm looking at implementing myself.
j.
Absit Invidia
Mudge and Schneier analyzed PPTP and found half a dozen major things wrong with it. The symmetric encryption algorithm it uses, RC4, is quite strong, but has a one rule aboutusing it safely - Never use the same key twice. PPTP violates this two or three different ways, and has some leftover Microsoft Wimpy Password Algorithm cracks that provide a couple of other ways in, and there may be some other holes as well. (Then there's the usual security principle of "Never plug anything sensitive into a Windows machine":-)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Nortel has a policy of Freeswan compatibility, so you should be able to use their server or client to talk to a FreeSWAN linux box. Nortel's client software runs on Win95, Win98, and NT, and is free if you buy the Nortel hardware (formerly Bay, formerly New Oak.) I don't know if it's free if you don't buy a box from them. So far I've used the Nortel client only with Nortel servers, but it works quite well and has multiple options for keying, including SecureID.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Barring that, we've had good luck with VSgate by infoexpress in huge (and I mean huge) enterprise environments. Bonus: they directly support Linux not only as a server platform but client as well.
You could also look for PoPToP, which is a reverse-engineered hack of Microsoft's "Point-to-Point Tunnelling Protocol" to make a Linux box able to be a server for it, but take a look at some past issues of Schneier's Cryptogram (don't know the specific one, sorry) for some scathing commentary on the brokenness of PPTP.
-=-=-=-=-
-=-=-=-=-
My mom's going to kick you in the face!
> Please remember that Open Source != Free
> Software.
That depends who you are talking to.
When people originally started talking about OpenSource, the idea (as I understand it was) "Lets take the 'Free Software' concept and repackage it under a new name, because the word 'free' scares suits".
The basic idea being Open Source *IS* free software in the same way that Zantac is Ranitidine (same chemical, different name).
So when we talk about "OpenSource" we talk about how you have source code and all sorts of other things. When we talk about "Free Software" we call all those things 'side effects' and talk about freedom as the main concern.
That doesn't mean there is a difference, just a different focus. In original intent though, the "focus" is the only difference, and when not trying to sell suits on the idea, the two terms can be used interchangably.
It has come to pass that you can seem to tell a persons beliefs on the subject by which term they use. FSF types will ALWAYS talk about "Free Software" and disparage the term "OpenSource". Those who just care that the code exists and think that having source code is better for the technical reasons, will call it "OpenSource".
The entire criticizm of the term is the focus change. People like RMS argue that the focus shift is bad. The whole point of free software is freedom and focusing on the other benefits instead is diminishing the value of the work by removing the political association of it.
At the end of the day though...the two are the same in every way but terminology and connotation.
-Steve
"I opened my eyes, and everything went dark again"
If I were you, I'd try out IPsec and PGP.net. IPsec is included with the default OpenBSD install(if you can install Debian you can install OpenBSD) and PGP.net is a component of the free Windows PGP client. They interoperate just fine with eachother, and the client will work on a standalone computer or as a gateway for a VPN linking two LANs into a WAN.
Free music from Jack Merlot.
Check out this place...it would be installed on a linux server. It probably is going to work best with the Windows 2000 VPN clients and even then I could be wrong :) Chris
We only use Linux boxes to connect the different offices together. Inside it's still a full blown Windows NT 4 deal.
My $0.02
StarTrek.org Free Webmail
Please remember that Open Source != Free Software. Open Source does not specifically require the software to be free, an example of this is Solaris. Free Software (in the FSF sense of the term) however, requires the software to be free, open source and a bunch of other things (concerning distribution, etc.)
Sorry for bitching, but I think that at least the people at /. (and those submitting to /.) should have the terms straight.
If there is a product that works really well, why not purchase it? The cost probably gets you not only the software that you need, but also a manual, tech support, etc.
Do you really need the source code to your VPN software? If so, that sounds like the "immature" code you want to avoid in the first place.
Have you considered getting 2 routers with VPN built in? being a small company here we use a cheap easy to setup product that is a firewall\router all in one. The current model we are using is the WebRamp 700s. Were small and it works well for us. http://www.webramp.com
It's good enough for windows clients out in the wild...
IPSEC is better, but I don't know if there is a free client avaiable for Windows.
BlackNova Traders
PoPToP is an open source implementation of PPTP under Linux. I've used it. It's solid. It rocks.
BlackNova Traders
I've got a very similar problem concering a VPN solution. My company has a Checkpoint firewall with VPN support that we've been quite happy with running on NT. The main problem that I've been running into is the software for client side only supports Windows platforms and the client must have a routable IP address.
For the most part, this isn't a problem since Windows is the dominant desktop platform around our office. With home networking kicking in with a lot of my folks, they're finding a need to have a single routable IP solution at home for multiple boxes AND having VPN support for them. I also have one remote office that presently has to have unique routable IP's for each client. To further complicate matters, that remote office has a couple of Macs tossed into the mix.
I've been looking about for a reasonable server side solution that I can deploy to a number of locations to handle the chit chat between it and this Checkpoint firewall. If I can get either Linux or a flavor of BSD to act as a proxy and VPN solution, freeware will get migrated into my office setup for the first time.
Aside from getting this to work at all, I do have support concerns. Between Linux and BSD, I've at least spent some time using Linux but there's apparently stability concerns with S/Wan. OpenBSD looks interesting, but I have zero BSD experience at this point in time. All the support and configuration falls squarely into my lap to implement.
I had rather hoped to find something that was a Windows based solution, mostly since that's what all my remote users are using. Not too many folks want to go out and purchase a seperate PC just to handle network proxying. Granted, this isn't nearly as much of an issue as the remote office is, as I can easily get another PC to deal with this there.
Bottom line: I need a solution that proxies non-routable IP addresses to the internet while providing for VPN support to a Checkpoint firewall.
The line must be drawn here. This far. No further.
A fairly mature package I've seen is S/WAN (Swan), avaliable from www.freeswan.org. Its in version 1.5 and is being activly devepoped. A good source for this type of software is munitions.org. They have a software section containing many VPN / cryptography related packages. Good luck!
Amateurs built the arc, professionals built the Titanic
There are unfortunately no Open Source Windows VPN clients. A good alternative however is SafeNet's client. Though not open source, you can get a pack of 10 licenses for about $80, last I checked. Cisco rebrands and sells this very product but charges about 10 times as much for it. SafeNet's VPN client works with FreeS/WAN which can be loaded on Windows 95/98/NT and possibly 2k. DO NOT use Windows 2000's built in IPSec, is has a major bug in that when told to operate in 3DES mode is suddenly drops to single DES without so much as telling you. When inter-operating with FreeS/WAN the connection barfs, I consider this a great feature of FreeS/WAN :-). FreeS/WAN no longer supports single DES as it is too easily brute force cracked. If there is enough interest in this sort of thing, I could see the company I work for producing an Open Source windows VPN client. www.protectix.com