Slashdot Mirror
Embedded Linux VPN Router Near Release
An anonymous reader writes "A new open source project aims to build a VPN router that supports all major routing protocols on a standardized hardware platform running embedded Linux. The "Linux Router Project - LR101" started in mid-2003 and plans a first release in January 2004. It is based on a dual-NIC VIA EPIA mainboard and a Travla case, along with Red Hat 8, zebra, FreeS/WAN, IP-tables, an other open source software, all compiled from source."
...thats really funny... true...but funny
It would be nice if they have High Availability on their feature list. Some nice solid appliances like this would be interesting.
Is this a stripped down Redhat distro, with a configuration tool that they wrote? Isn't a whole distribution a little bit too much for such a project? Wouldn't a linuxfromscratch installation - with only the bare minimums - be a better idea? Just a thought.
OpenBSD is better suited for this purpose, especially on older hardware no longer desireable for desktop use.
Anyone with half a brain can set up an OpenBSD Firewall/Router!
Where's PPTP? for a VPN router, it's kind of desirable ...
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Your sig is fucking bollocks.
Im serious RH8 was the biggest pice of scrap from RH since 5.0. (and Im a Redhat fan)I understand development cycles have to start somewhere, and RH 8 was probably release when it started, But hasnt enough time passed to replace it with a more solid distro.
Or, just buy a Linux-based Linksys WRV54G for well under $200 with most, if not all the features of this project. No, I don't mean the WRT54g, I mean the WRV54G. Excellent piece of gear, VPN, firewalling, dmz, wireless (wep/wpa), snmp, yadda yadda.
Snapgear?
If that's true, then it's illegal for a US citizen to contribute to the 2.6.0 kernel too, since that has crypto in it.
all compiled from source.
As opposed to say, a Linksys Router, which we all know is compiled from Cheerios. =)
Do you Gentoo!?
The only market for this is some screwed up and corrupted country like Argentina or Nigeria, where they would get the software for free, use it in the government
...
In Nigeria, the government official in charge of IT is waiting for you to help him unlock those $20M from that deceased german businessman, in order to have funds to buy routers
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Soekris
I want a router where all the binaries were hand assembled, myself.
Is this the same Linux Router Project that was run by that crazy, paranoid survivalist guy? Or is that still dead?
Crypto export laws were relexed a long time ago (during the Clinton administration).
Just goes to support what I've observed about people who claim Mensa membership.
Complexity is Easy. Simplicity is Hard.
Open source software, all compiled from Source! What will they think of next?
...the Linux Router Project, a floppy-based 386-compatible micro-distro which served as the basis for (among other things) Coyote Linux.
> perfect end-user operating system close to
> Windows XP
Bwahahahahahahahahahahaahahahahahaha
Excuse me... I just shat myself.
I was doing this BEFORE it was cool.
I also reply below your current threshold.
Santa works for osdn now?
Custom firmware for the wrt54g does/will do pretty much the same thing. Progress is very quick. See the forum here:
sveasoft
This isn't the project's fault, I know, but there is a "major", albeit proprietary, VPN protocol that's still not supported on Linux. It's Shiva's SST (Shiva Secure Tunnel). It was originally developed by Shiva, then sold to Intel where it became part of the NetStructure family. I should point out that these VPN gateways also support IPSEC, but some companies - like mine - only permit access using the SST flavor tunnel.
Shiva never had any Linux client software. Intel never developed any either. Then it got sold to HP/Compaq which never developed any Linux client software either. Recently it was sold yet again to a new company called - interestingly enough - Shiva. (No relation to the original company.) Like I said, the SST protocol is proprietary so the lack of support on Linux isn't the fault of the Linux VPN Router project or the FreeSWAN project either. Maybe all that's needed is for someone to contact Shiva/Intel/HP/Shiva to see if they'd be willing to open up the SST spec. I don't know. Unless the Shiva Secure Tunnel protocol offers major advantages over IPSEC I can't imagine any reason why they'd keep it secret. Maybe they're only still using it for backwards compatibility or something, because to me it sure looks like all new developement is geared towards IPSEC. If that's the case I guess I'm screwed. My company flat out refuses to open any IPSEC tunnels on their NetStructure VPN appliances.
His sig *is* bollocks: do you really think a mensa member would hang around on Slashdot? They're much too snobbish for that ...
Thou shalt not mention OpenBSD, particularly if thou art pointing out its superiority to Linux in this case, lest the moderators smite thee.
The initial PPTP was a total botch, with seven major security flaws. Some of them have since been fixed, but it gives you some idea of the professionalism and quality that didn't go into the basic design. If you want to use a VPN for security, use IPSEC - and this project has FreeS/WAN IPSEC in it. If you really really want to use a VPN to transport lame non-IP legacy Microsoft LAN protocols, go pay Microsoft some money for one of their server projects, and charge the silly customer who's hiring you as a consultant because they don't want to upgrade to the 1990s for it. If you want to use a VPN to carry private IP addresses, but don't actually care about security, use IPSEC anyway, or use GRE tunnels.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
just check out astaro.org
linux distro and free for personl use...this has allready been done and astaro rocks!!
Posting stupid comments to Slashdot might be illegal too, but it didn't stop you.
I almost did as well.
Nothing that open source community produced so far is not even remotely close to WinXP, leave alone the possibility of their shit being 'perfect'.
By this logic Windows must be the most buggy software of all since Microsoft makes more money supporting it than all it;s competitors combined! Bigger profits through crappier software!
You'd honestly use WinXP as a router? I pray to god that you aren't responsible for network infrastructure at any company with sensitive data. This product has lead it's producer to start limiting it's patches to once a month mass bug updates because otherwise patching was causing it's uses too much downtime and man power. Your position is laughable.
Yeah, gotta love chicks that have DSL.
PS: Not ADSL.
[] Cowboy Neal VP's my N.
Having programmed some of these "beauties" in connection with a microcontroller, i must say they are shooting themselves in the foot. The first word that comes to my mouth is YUCK! I know all these 3Com and Intel network cards are more expensive, but they save time and money in the long run.
/Pedro
Indeed, export of cryptographic technology from USA is hampered with strong restrictions. So many Open Source projects are quite careful to avoid breaking laws by having (much) development done outside USA, and also letting release builds be done outside US as well.
For instance, OpenBSD has offered strong encryption for several years. The OpenBSD project is located in Canada, and a lot of development/release builds are done outside US. As Integrated Crypto shows :
..make sure that you have read this
Discusses some serious considerations before deciding to use ipsec and ike. And since ipsec/ike is the only serious solution in many cases, these concerns should not be taken lightly. For example did you know that the ike implementation in 2000/XP simply checks the signer of the servers certificate and not the actual identity that is signed? This means that any other user with a certificate which is signed by the same authority as you can impersonate the server.
The article is very lengthy, I know, but definitely worth your time.
There's a number of such projects out there ... Smoothwall is one. IPCop for another (although it is forked from Smoothwall.) I don't see this project as offering that much over similar ones.
The higher the technology, the sharper that two-edged sword.
I beg to differ, Sir/Madam. So stick that in your pipe and combust it! (Proud member of British Mensa, a Linux user for over two years now and my first AS exam is on the 8th Jan so I think I've made my point.)
I was a Mensa member. (I haven't paid my dues in a long time.) I just barely passed the test to get into the club. So, I may be the Mensa member with the lowest IQ.
I would like to see something that would let me access existing VPN routers from home.
Well, I had the same idea but, unfortunatly, I had nothing but trouble using OpenBSD and I tried the last 3 releases. ;)
Basicaly, I had complete system freezes when under heavy load and unstable network drivers (can't remember wich ones right now but the interface dropped at random times).
I don't know if was me but I used the same hardware with IpCop (VIA-M boards actualy) without a hitch so I decided to stick with it.
I will probably try OpenBSD again as I like the idea but at least for me, right now, it's a dead fish - pun intended
Scientia est Potentia
You had my attention up to the point where you mentioned "redhat". The company that doesn't care about their nonprofit distro. Whoopie, now you got a vpn on it.
Your company is very naive then. They are probably using the "nobody else is using it, so it will be more secure" argument.
Give somebody who can make that decision the results of the following google search - security in obscurity
The first article in this Crypto-Gram also explains the problem - Secrecy, Security, and Obscurity
The Internet's nature is peer to peer - 20050301_cs_profs.pdf
micro linux systems still need to be under $50 to really work and get widespread use.
Nothing that open source community produced so far is not even remotely close to WinXP, leave alone the possibility of their shit being 'perfect'.
So something that the Open Source community has produced is remotely close to WinXP? What, exactly? Are you insinuating something?
Go be a witless fuck somewhere else.
http://www.m0n0.ch/wall
If your interested in Linux or embedded VPN solutions, check out m0n0wall. Its excellent!
Umm...you guys do realize that www.snapgear.com has had embedded, ipsec/iptables equipped routers based on linux for years right? They're enterprise quality and I've had several deployed for over a year. This isn't new, nor is it exciting. Also, embedded implies that its not x86...or using a hard drive. This is a mini-itx based "router" running a distro that has no business being used as such.
Calling Linux running on a PC "embedded" is insulting to some of us who really do embedded programming.
you can reinvet the wheel or you could just use one of the router distros under the LEAF project
I'd like to see one based on this bad boy.
4 gigE ports, each on it's own PCI-X controller. Between the two Xeons and whatever amount of memory you through at it, one of these could *easily* handle a great deal of BGP sessions, load-balancing, failover, as well as VPN and encryption.
With a board like that, a couple of Xeons, and a gig of memory, these could out-perform some very, very expensive commercial routers.
steve
Oh, you're not stuck, you're just unable to let go of the onion rings.
I'll have to agree about Mono, (which I'm using now) and point out that there are quite a few other options. Mono's Web-based admin interface should make anyone who's worked with Firewall-1 feel right at home.
It would appear that while the LRP labored on defining and then implementing The Ultimate Solution, the rest of the world may have caught up, if not passed them.
Andrew Warenczak, the guy who designed the box, is looking at making a half-height version, making 4 completely independent servers in one RU of 19" rack.
Got time? Spend some of it coding or testing
Why waste money on Xeon and a electric bill?
Consider a more elegant and efficient approach. (I hate Xeons and Pentium 4s...Too much wasted heat.)
VPN/encryption hardware PCI card + Pentium-M 1.7Ghz + Radysis mATX mobo + 4-port Intel NIC.
The VPN/encryption hardware PCI card (see SafeNet or HifNET), relieves the CPU and allows the CPU to focus on other uses.
Heck, Soekris Engineering sell HifNET based ones in PCI and Mini-PCI form. So that low end CPU they sell can prove to be quite capable.