Slashdot Mirror
Embedded Linux VPN Router Near Release
An anonymous reader writes "A new open source project aims to build a VPN router that supports all major routing protocols on a standardized hardware platform running embedded Linux. The "Linux Router Project - LR101" started in mid-2003 and plans a first release in January 2004. It is based on a dual-NIC VIA EPIA mainboard and a Travla case, along with Red Hat 8, zebra, FreeS/WAN, IP-tables, an other open source software, all compiled from source."
_ MM MM MMNMMMM MMMMMMMMM MMMMMMMMMMMMMMMM MMMMMM MMMNM MM M Fuck your mother, ___r_@MM Fuck your mother. _`__7M_X_M Fuck your mother .',.',._.',.',._.', ',._.',.',___M7__ii@ Fuck your mother_ ____MM__M_M Fuck your mother. ',___M__M_M Fuck your motherM MW___MM_MiS Fuck your mother_ raW_____MM Fuck your mother_ .',___M Fuck your mother' _._`_MM Fuck your mother_ __.MM Fuck your motherM MM Fuck your motherM M Fuck your mothera Fuck your mother ._`_r__B_aMBM_M2___iM Fuck your mother ._`_B__M__ _a.',._`_MMMr Fuck your mother
_ M_M_r'_.',._.',.',._.__________________.',._.',.'
_MM_W_M'_.',._.',.'---|Trollkore_Forever!|---,_'_
_M,___M'_.',._.',.', _'------------------'_,_'_.',____M__B_0 Fuck your mother
_M_W__M'_.',._.',.',._.',.',._.', ',._.',._,_'_.',___WM__0_MX Fuck your mother
_M2_S_M_;_,_Xi'_.',.
_MS_@MM_X0'_.',._.',.',____S_____;i'_.',._.',.',_
_MWMMM'_._`__a0BMMMZ.',._`__XB_rS___.MMMMMMMMMB'_
_MM_MM____MMMMMMMMMMMMMMMMr'_._`_:MMMMMMMMMMMMMMM
_ MMM2__MMMM.____.MMMMMMMMMM __ XMMMMMMMMMMMMMMMMMMMM._BM:MX Fuck your mother
_ MMM__MMMMM|._. |MMMMMMMMMMM _ MMMMMMMMMMMMMMMMMMMMMM__MMMM Fuck your mother
_MMZ__BMMMMM||o| |MMMMMMMMMMM _ MMMMMMMMMMMMMMMMMMMMMB____MM Fuck your mother
_M____MMMMMM'----'MMMMMMMMMMM _ MMMMMMMMMMMMMMMMMMMMMW_WM__M Fuck your mother
WM__i_MMMMMMMMMMMMMMMMMMMMMMM _M MMMMMMMMMMM.____.MMM,_____M0 Fuck your mother
MX__r_MMMMMMMMMMMMMMMMMMMMMM'_._` MMMMMMMMMM|._. |MMM'_._`_MM Fuck your mother
MZ____7MMMMMMMMMMMMMMMMMMMM __._Z_ MMMMMMMMM||o| |MMM__X___ZM Fuck your mother
MM__Z__MMMMMMMMMMMMMMMMMM; __MM_MM_ WMMMMMMM'----'MM__a____M0 Fuck your mother
_M__,r___XMMMMMMMMMMMMM ___:MMM_MMM:_ MMMMMMMMM MM____7____M Fuck your mother
_MM'_.',____,M0'_.',_____,,MMMB_MMMM_,____ZMMM:__
_ M_____ii_X___7__S_,2____SMMMM_MMMM'_.',______2:r'
_ MM'_.',._.',._,_'_._`_8:MMMMM_MMMMM_;__;ii.',._,_
__ MM'_.',._.',.',______;WMMMMM_MMMMM_M'_.',._.',.',
____ MMM'_.',._.',.',_____MMMMM_MMMMM'_.',._.',.',___X
____ 0MMMMr'_._,_'_.',____BMMM@_ZMMM;'_._,_'_._`__aMMM
'_._` MMMMMM_M_,__;'_._,_'_._`_i'_._,_'_._`_i____MMMMaM
'_._` M__BMMMM_2_ZM__@r___Z'_.',___,,__._'___M__;M@___M Fuck your mother
'_._` MM___M2MMM8M___Z___XM___X,____M._r_____MMMM@____M Fuck your mother
'_._` MM___M___ZMMMMMMMMMMMiMMM_____WMSMMMMMMM_ZM____MM Fuck your mother
'_._`_ MW__MM__W__X___M___iMaXMMMMMMBM_S__7__:_MM____MX Fuck your mother
'_._`_ MM__XMM2MM_M___M___,r__M'
'_.',__ M2__M__@__MMMMMMMMMr _M__M._MM_ZMZMM_;MM____MM Fuck your mother
'_.',___ M___MMM0_Z___M_ _MMB7MM2MM_M__S_____MW_____M Fuck your mother
'_.',___ M_____SMMMMWSM_ __i__M___a_M___M:MMB_S____MM Fuck your mother
'_.',___ MM'_.',___2XMMMWMMMM0MMMMMMMMMMMM__r_____2M Fuck your mother
'_.',____ MM_:'_.',______;_____8'_.',._.',.',____MM Fuck your mother
'_.',_____ XMMM'_._`_.aM'_._`__, ____;;:'_._`__MMM Fuck your mother
'_._,_'_.',__ WMM'_._,_'
'_.',._.',.',__ MMM_:__,____M.__XS2,_____ZMMMX Fuck your mother
'_.',._.',.',___ rMMMZMM___;____B_____rMMMM Fuck your mother
'_.',._.',._,_'_._` irXS2MMMMMMB8ZMMMMX: Fuck your mother
TROLLKORE HEAD, I'M IN YOUR BED
I'M FIZZY FIZZY WIZZY, I'M OFF MY HEAD
I frankly don't see the point in using bloated Linux.
Good luck selling that, when anyone in China/India/Taiwan can download the source, load it onto one of their boxes and sell it for 50% of the original price.
.config files to set it up correctly, and end up buying support license anyway?
Open source software is ridden with bugs by definition, as the companies need to sell the support licenses to stay in business. If Red Hat et al. produced a perfect end-user operating system close to Windows XP, no one would bother to buy the support licenses and this would put the company out of business. Red Hat not only confirms the bugs and end-user difficulties, it relies on them for their business model.
The same with this company. How many want to bet that you can't set up this VPN router straight out of the box, but are required to go through through mangled
The only market for this is some screwed up and corrupted country like Argentina or Nigeria, where they would get the software for free, use it in the government, while the son of the government official would be the president of the firm, providing "support licenses" and receiving generous check for "free" software.
man, i'd sure like to embed something into that osdn personals chick in the red outfit!
Whip it, whip it good!
It would be nice if they have High Availability on their feature list. Some nice solid appliances like this would be interesting.
Does it run Linux? :)
Is this a stripped down Redhat distro, with a configuration tool that they wrote? Isn't a whole distribution a little bit too much for such a project? Wouldn't a linuxfromscratch installation - with only the bare minimums - be a better idea? Just a thought.
all compiled from source.
As opposed to compiling it from a binary?
Contributing to this OSS project might be illegal for US citizens due to cryptography export laws.
Owner of a Mensa membership card.
I upgraded my tinfoil alien detection hat from CPM to Linux recently but I cannot find the optimal angle for reception. Any ideas?
I just read in another guys troll that BSD is dying. As long as trollers are a good source of accurate information, I'm sticking with Linux, thank you.
OpenBSD is better suited for this purpose, especially on older hardware no longer desireable for desktop use.
Anyone with half a brain can set up an OpenBSD Firewall/Router!
Where's PPTP? for a VPN router, it's kind of desirable ...
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Im serious RH8 was the biggest pice of scrap from RH since 5.0. (and Im a Redhat fan)I understand development cycles have to start somewhere, and RH 8 was probably release when it started, But hasnt enough time passed to replace it with a more solid distro.
Or, just buy a Linux-based Linksys WRV54G for well under $200 with most, if not all the features of this project. No, I don't mean the WRT54g, I mean the WRV54G. Excellent piece of gear, VPN, firewalling, dmz, wireless (wep/wpa), snmp, yadda yadda.
Snapgear?
all compiled from source.
As opposed to say, a Linksys Router, which we all know is compiled from Cheerios. =)
Do you Gentoo!?
Soekris
I want a router where all the binaries were hand assembled, myself.
Is this the same Linux Router Project that was run by that crazy, paranoid survivalist guy? Or is that still dead?
Open source software, all compiled from Source! What will they think of next?
...the Linux Router Project, a floppy-based 386-compatible micro-distro which served as the basis for (among other things) Coyote Linux.
I was doing this BEFORE it was cool.
I also reply below your current threshold.
Custom firmware for the wrt54g does/will do pretty much the same thing. Progress is very quick. See the forum here:
sveasoft
This isn't the project's fault, I know, but there is a "major", albeit proprietary, VPN protocol that's still not supported on Linux. It's Shiva's SST (Shiva Secure Tunnel). It was originally developed by Shiva, then sold to Intel where it became part of the NetStructure family. I should point out that these VPN gateways also support IPSEC, but some companies - like mine - only permit access using the SST flavor tunnel.
Shiva never had any Linux client software. Intel never developed any either. Then it got sold to HP/Compaq which never developed any Linux client software either. Recently it was sold yet again to a new company called - interestingly enough - Shiva. (No relation to the original company.) Like I said, the SST protocol is proprietary so the lack of support on Linux isn't the fault of the Linux VPN Router project or the FreeSWAN project either. Maybe all that's needed is for someone to contact Shiva/Intel/HP/Shiva to see if they'd be willing to open up the SST spec. I don't know. Unless the Shiva Secure Tunnel protocol offers major advantages over IPSEC I can't imagine any reason why they'd keep it secret. Maybe they're only still using it for backwards compatibility or something, because to me it sure looks like all new developement is geared towards IPSEC. If that's the case I guess I'm screwed. My company flat out refuses to open any IPSEC tunnels on their NetStructure VPN appliances.
Thou shalt not mention OpenBSD, particularly if thou art pointing out its superiority to Linux in this case, lest the moderators smite thee.
The initial PPTP was a total botch, with seven major security flaws. Some of them have since been fixed, but it gives you some idea of the professionalism and quality that didn't go into the basic design. If you want to use a VPN for security, use IPSEC - and this project has FreeS/WAN IPSEC in it. If you really really want to use a VPN to transport lame non-IP legacy Microsoft LAN protocols, go pay Microsoft some money for one of their server projects, and charge the silly customer who's hiring you as a consultant because they don't want to upgrade to the 1990s for it. If you want to use a VPN to carry private IP addresses, but don't actually care about security, use IPSEC anyway, or use GRE tunnels.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
just check out astaro.org
linux distro and free for personl use...this has allready been done and astaro rocks!!
Very offtopic, but I can't resist:
An anonymous reader writes "A tired old game project aims to build a 3D FPS with undefined technology". "Duke Nukem Forever - DNF" started in mid-1997 and plans a first release "When it's done", according to product manager George Broussard. DNF is based on a yet to be defined 3D engine, though the team stated that "Development is progressing smoothly, we should have some screenshots up soon". The game when completed will support 4 player deathmatch, as per it's 1997 spec. However the team is looking to the future, and expects the game to run well under Windows Longhorn. Linux support may be planned for the future.
wbs.
Huh?
[] Cowboy Neal VP's my N.
Having programmed some of these "beauties" in connection with a microcontroller, i must say they are shooting themselves in the foot. The first word that comes to my mouth is YUCK! I know all these 3Com and Intel network cards are more expensive, but they save time and money in the long run.
/Pedro
When I fly I feel safer if I know that there are no guns on board - legal or illegal.
..make sure that you have read this
Discusses some serious considerations before deciding to use ipsec and ike. And since ipsec/ike is the only serious solution in many cases, these concerns should not be taken lightly. For example did you know that the ike implementation in 2000/XP simply checks the signer of the servers certificate and not the actual identity that is signed? This means that any other user with a certificate which is signed by the same authority as you can impersonate the server.
The article is very lengthy, I know, but definitely worth your time.
There's a number of such projects out there ... Smoothwall is one. IPCop for another (although it is forked from Smoothwall.) I don't see this project as offering that much over similar ones.
The higher the technology, the sharper that two-edged sword.
I beg to differ, Sir/Madam. So stick that in your pipe and combust it! (Proud member of British Mensa, a Linux user for over two years now and my first AS exam is on the 8th Jan so I think I've made my point.)
I was a Mensa member. (I haven't paid my dues in a long time.) I just barely passed the test to get into the club. So, I may be the Mensa member with the lowest IQ.
I would like to see something that would let me access existing VPN routers from home.
Well, I had the same idea but, unfortunatly, I had nothing but trouble using OpenBSD and I tried the last 3 releases. ;)
Basicaly, I had complete system freezes when under heavy load and unstable network drivers (can't remember wich ones right now but the interface dropped at random times).
I don't know if was me but I used the same hardware with IpCop (VIA-M boards actualy) without a hitch so I decided to stick with it.
I will probably try OpenBSD again as I like the idea but at least for me, right now, it's a dead fish - pun intended
Scientia est Potentia
You had my attention up to the point where you mentioned "redhat". The company that doesn't care about their nonprofit distro. Whoopie, now you got a vpn on it.
Your company is very naive then. They are probably using the "nobody else is using it, so it will be more secure" argument.
Give somebody who can make that decision the results of the following google search - security in obscurity
The first article in this Crypto-Gram also explains the problem - Secrecy, Security, and Obscurity
The Internet's nature is peer to peer - 20050301_cs_profs.pdf
micro linux systems still need to be under $50 to really work and get widespread use.
http://www.m0n0.ch/wall
If your interested in Linux or embedded VPN solutions, check out m0n0wall. Its excellent!
Umm...you guys do realize that www.snapgear.com has had embedded, ipsec/iptables equipped routers based on linux for years right? They're enterprise quality and I've had several deployed for over a year. This isn't new, nor is it exciting. Also, embedded implies that its not x86...or using a hard drive. This is a mini-itx based "router" running a distro that has no business being used as such.
Calling Linux running on a PC "embedded" is insulting to some of us who really do embedded programming.
you can reinvet the wheel or you could just use one of the router distros under the LEAF project
"Use BSD.. uhh.. becuase I said so! Forget facts, reason, or logic, JUST USE IT!"
I'd like to see one based on this bad boy.
4 gigE ports, each on it's own PCI-X controller. Between the two Xeons and whatever amount of memory you through at it, one of these could *easily* handle a great deal of BGP sessions, load-balancing, failover, as well as VPN and encryption.
With a board like that, a couple of Xeons, and a gig of memory, these could out-perform some very, very expensive commercial routers.
steve
Oh, you're not stuck, you're just unable to let go of the onion rings.
I'll have to agree about Mono, (which I'm using now) and point out that there are quite a few other options. Mono's Web-based admin interface should make anyone who's worked with Firewall-1 feel right at home.
It would appear that while the LRP labored on defining and then implementing The Ultimate Solution, the rest of the world may have caught up, if not passed them.
Andrew Warenczak, the guy who designed the box, is looking at making a half-height version, making 4 completely independent servers in one RU of 19" rack.
Got time? Spend some of it coding or testing
Yes. Give it to me, I want your yummy cowshit all over me!
found here
Why waste money on Xeon and a electric bill?
Consider a more elegant and efficient approach. (I hate Xeons and Pentium 4s...Too much wasted heat.)
VPN/encryption hardware PCI card + Pentium-M 1.7Ghz + Radysis mATX mobo + 4-port Intel NIC.
The VPN/encryption hardware PCI card (see SafeNet or HifNET), relieves the CPU and allows the CPU to focus on other uses.
Heck, Soekris Engineering sell HifNET based ones in PCI and Mini-PCI form. So that low end CPU they sell can prove to be quite capable.