Open VPNs On Unix That Support Windows Clients?

Adam Schumacher writes:"At work, I've been investigating the possibility of migrating our proxy/ftp/VPN server from NT4 to Linux. Proxying and FTP are obviously no problem, but I am at a bit of a loss as to what to recommend as our VPN server. We need transparent and secure tunneling of our network traffic across the Internet to Windows 95/98/NT/2000 workstations. I know that there are commercial vendors offering VPN solutions that interoperate beautifully between Windows and Linux, but these carry a hefty pricetag, upwards of several thousand dollars. I would much rather go with an Open Source solution. What experience have you had with setting up a VPN between a Linux server and Windows clients? Can you recommend any particular products I should investigate further? In the event that we do have to go with a commercial solution, would you recommend one product over another? Why? Bear in mind that this machine will control access to our entire internal network, so I need a product that has been proven to be robust and secure. Immature code need not apply."

Comments

Hrm

[Anonymous Coward]

I use a VPN system called Carnivore, by FBI Privacy Solutions, Inc. The FBI techs (called agents) are extremely helpful, and do all the installation and monitoring for you, no added charge.

PoPToP

[tzanger]

Moretonbay, the company who gave us so much work on uCLinux has PoPToP, a Linux PPTP server.

I have set it up personally and included the MPPE and stateless patches which give excellent performance and 128-bit encryption.

You mentioned that immature code need not apply. I can't say how mature this code is but I have not had any problem with the encryption nor the actual VPN going down or otherwise futzing up.

PoPToP uses pppd + openssl with a custom daemon to set up Windows VPN connections. You can force MSCHAPV2 (V1 has problems with security, what else is new? :-), enforce 128-bit encryption, use PAP or CHAP, whatever you please. Since it is pppd which is authenticating, you can use PAM or whatever authentication methods you can use with pppd. Another important feature is that you can configure pptpd to assin IPs or have pppd do it for you. Configuring for MPPE and stateless compression was a bit of a pain but in reality it involved scanning the already big mailing list and applying the correct version of the patches.

Overall I am very pleased with PoPToP, even if my typing slows to 10WPM when I have to type the name. :-)

Re:Translation

[sammy baby]

I'm actually pretty shocked that you managed to score a rating of 4: Insightful off this one, but what the hell, I'll bite.

Hi, I'd like to move a server from NT4 to Linux. I'd like to stress that it is a server that is extremely vital to my company's business. It is so vital in fact that I'm prepared to spend no money on it at all. I want someone to give me high-powered, reliable software upon which I can bet my job, for free.

Is that not reasonable? I use OpenSSH, Snort, and nmap all the time at my place of business for security. For other purposes, I use Red Hat, Debian, Apache, Perl, PHP, MySQL, and PostgresSQL. All "high-powered, reliable software," as you put it. All free.

Why must Open-Source necessarily equal free?

This may come as a shock to you, but I'm not in the habit of spending money on Open Source software unless I absolutely have to. Oh, I've certainly purchased the occasional RH distro CD because I wanted to install it at home, but at work, where I'm fortunate to have a decent net connection, I do net installs like crazy.

It's true that you can spend money on OSS. However, most people associate OSS with no charge, and not without reason.

Why does Open-Source necessarily equal best?

The orignal poster stated that he would rather go with an Open Source solution rather than ones that "carry a hefty pricetag, upwards of several thousand dollars." I think that this is an important consideration for him. Since you didn't suggest any commercial solutions (or, in fact, OSS ones), I'll pose the converse question to you: what is your familiarity with VPN software, and what commercial solution would you say was the best?

If it were my job on the line here, I'd find the best solution, not necessarily the one that meets my agenda.

I thought that the original post articulated his reasons for pursuing an Open Source package pretty nicely. On the flip side, your post seems to reflect a prejudice that only businessess with money to burn should have access to decent software. If you're of the opinion that Open Source software has no role in mission critical applications, fine, but just out of curiosity, why the hell would you read /.?

WTF??

[FascDot Killed My Pr]

(I have an answer to the question at the end of my rant)

Is there an open Slashdot terminal in some public place? Because these "Ask Slashdots" are starting to seem more like "Ask A Random Question Without Searching First". This is getting REALLY lame.

Now, then. Go to Yahoo (yes, even Yahoo can find this, albeit through Google). Type "linux vpn". Find a link. Follow it.

For those that aren't interested in enough to click, this is PoPToP, a Linux implementation of the server-side of MS PPTP. A secure implementation. Why PPTP? Because you want Windows clients and the only thing they do out of the box is PPTP. BTW, PoPToP is GPL'd....
--

Re:WTF??

[Mark F. Komarinski]

IMO PoPToP has some serious issues. Unfortunately, most are outside the scope of what the PoPToP developers can work with:

1) Kernel patches (yay). There seem to be problems getting these patches to work with some distros (read: Red Hat) that have slightly-customized kernels
2) Windows only supports some real lame encryption out-of-the-box. To get 128 bit, you have to go through some real hoops to get the software from Microsoft, only to find it doesn't work.
3) Firewall/IPMasq causes even more fun, depending on which side of the firemasq the PPTP server is on.
4) Browsing windows shares over a VPN link is akin to black magic and seldom works.

These are the most common issues I've seen (and I'm a lurker on the PoPToP list). To their credit, the gang that make this software have integrated it into a hardware box (look for the NetTel) that does both PPTP and Firewall functionality. It's pretty inexpensive at $399US, and I'm pondering just buying that instead of hacking around on my own.

VPND

[bgarcia]

I've been using vpnd for over a year now, and it has been extremely reliable and should be very secure (can you say "576-bit blowfish encryption?).

It is meant more to connect two subnets, rather than a single device to a network. Also, it does not run on windows. However, you can do what I do, and resurrect an old 486 to act as a gateway/firewall/vpnd server at home, and hook your windows box to it.

It is setup to re-establish broken connections. Even though I often lose connectivity between work and home, as long as the downtime is less than a tcp timeout, all of my tcp connections over the encrypted channel will actually remain up! Very nice.

IPsec

[Ledge Kindred]

Your best bet is probably to get IPsec running on a Linux server farm and find IPsec clients for WinXX. At least that way, you'll be using a standard protocol, unlike most (read: all) proprietary VPN softwares out there. You'd then be able to support any OS that had an IPsec stack (which includes a lot of them nowadays).

Barring that, we've had good luck with VSgate by infoexpress in huge (and I mean huge) enterprise environments. Bonus: they directly support Linux not only as a server platform but client as well.

You could also look for PoPToP, which is a reverse-engineered hack of Microsoft's "Point-to-Point Tunnelling Protocol" to make a Linux box able to be a server for it, but take a look at some past issues of Schneier's Cryptogram (don't know the specific one, sorry) for some scathing commentary on the brokenness of PPTP.

-=-=-=-=-

Re:There's a difference

[TheCarp]

> Please remember that Open Source != Free
> Software.

That depends who you are talking to.

When people originally started talking about OpenSource, the idea (as I understand it was) "Lets take the 'Free Software' concept and repackage it under a new name, because the word 'free' scares suits".

The basic idea being Open Source *IS* free software in the same way that Zantac is Ranitidine (same chemical, different name).

So when we talk about "OpenSource" we talk about how you have source code and all sorts of other things. When we talk about "Free Software" we call all those things 'side effects' and talk about freedom as the main concern.

That doesn't mean there is a difference, just a different focus. In original intent though, the "focus" is the only difference, and when not trying to sell suits on the idea, the two terms can be used interchangably.

It has come to pass that you can seem to tell a persons beliefs on the subject by which term they use. FSF types will ALWAYS talk about "Free Software" and disparage the term "OpenSource". Those who just care that the code exists and think that having source code is better for the technical reasons, will call it "OpenSource".

The entire criticizm of the term is the focus change. People like RMS argue that the focus shift is bad. The whole point of free software is freedom and focusing on the other benefits instead is diminishing the value of the work by removing the political association of it.

At the end of the day though...the two are the same in every way but terminology and connotation.

-Steve

www.freeswan.org ???

[denjin]

Check out this place...it would be installed on a linux server. It probably is going to work best with the Windows 2000 VPN clients and even then I could be wrong :) Chris