Slashdot Mirror
Embedded Linux VPN Router Near Release
An anonymous reader writes "A new open source project aims to build a VPN router that supports all major routing protocols on a standardized hardware platform running embedded Linux. The "Linux Router Project - LR101" started in mid-2003 and plans a first release in January 2004. It is based on a dual-NIC VIA EPIA mainboard and a Travla case, along with Red Hat 8, zebra, FreeS/WAN, IP-tables, an other open source software, all compiled from source."
It would be nice if they have High Availability on their feature list. Some nice solid appliances like this would be interesting.
Is this a stripped down Redhat distro, with a configuration tool that they wrote? Isn't a whole distribution a little bit too much for such a project? Wouldn't a linuxfromscratch installation - with only the bare minimums - be a better idea? Just a thought.
Where's PPTP? for a VPN router, it's kind of desirable ...
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Or, just buy a Linux-based Linksys WRV54G for well under $200 with most, if not all the features of this project. No, I don't mean the WRT54g, I mean the WRV54G. Excellent piece of gear, VPN, firewalling, dmz, wireless (wep/wpa), snmp, yadda yadda.
Snapgear?
If that's true, then it's illegal for a US citizen to contribute to the 2.6.0 kernel too, since that has crypto in it.
all compiled from source.
As opposed to say, a Linksys Router, which we all know is compiled from Cheerios. =)
Do you Gentoo!?
The only market for this is some screwed up and corrupted country like Argentina or Nigeria, where they would get the software for free, use it in the government
...
In Nigeria, the government official in charge of IT is waiting for you to help him unlock those $20M from that deceased german businessman, in order to have funds to buy routers
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Soekris
I want a router where all the binaries were hand assembled, myself.
Is this the same Linux Router Project that was run by that crazy, paranoid survivalist guy? Or is that still dead?
Crypto export laws were relexed a long time ago (during the Clinton administration).
Just goes to support what I've observed about people who claim Mensa membership.
Complexity is Easy. Simplicity is Hard.
...the Linux Router Project, a floppy-based 386-compatible micro-distro which served as the basis for (among other things) Coyote Linux.
Custom firmware for the wrt54g does/will do pretty much the same thing. Progress is very quick. See the forum here:
sveasoft
This isn't the project's fault, I know, but there is a "major", albeit proprietary, VPN protocol that's still not supported on Linux. It's Shiva's SST (Shiva Secure Tunnel). It was originally developed by Shiva, then sold to Intel where it became part of the NetStructure family. I should point out that these VPN gateways also support IPSEC, but some companies - like mine - only permit access using the SST flavor tunnel.
Shiva never had any Linux client software. Intel never developed any either. Then it got sold to HP/Compaq which never developed any Linux client software either. Recently it was sold yet again to a new company called - interestingly enough - Shiva. (No relation to the original company.) Like I said, the SST protocol is proprietary so the lack of support on Linux isn't the fault of the Linux VPN Router project or the FreeSWAN project either. Maybe all that's needed is for someone to contact Shiva/Intel/HP/Shiva to see if they'd be willing to open up the SST spec. I don't know. Unless the Shiva Secure Tunnel protocol offers major advantages over IPSEC I can't imagine any reason why they'd keep it secret. Maybe they're only still using it for backwards compatibility or something, because to me it sure looks like all new developement is geared towards IPSEC. If that's the case I guess I'm screwed. My company flat out refuses to open any IPSEC tunnels on their NetStructure VPN appliances.
The initial PPTP was a total botch, with seven major security flaws. Some of them have since been fixed, but it gives you some idea of the professionalism and quality that didn't go into the basic design. If you want to use a VPN for security, use IPSEC - and this project has FreeS/WAN IPSEC in it. If you really really want to use a VPN to transport lame non-IP legacy Microsoft LAN protocols, go pay Microsoft some money for one of their server projects, and charge the silly customer who's hiring you as a consultant because they don't want to upgrade to the 1990s for it. If you want to use a VPN to carry private IP addresses, but don't actually care about security, use IPSEC anyway, or use GRE tunnels.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
By this logic Windows must be the most buggy software of all since Microsoft makes more money supporting it than all it;s competitors combined! Bigger profits through crappier software!
You'd honestly use WinXP as a router? I pray to god that you aren't responsible for network infrastructure at any company with sensitive data. This product has lead it's producer to start limiting it's patches to once a month mass bug updates because otherwise patching was causing it's uses too much downtime and man power. Your position is laughable.
....and its cool now?
Regards
elFarto
Having programmed some of these "beauties" in connection with a microcontroller, i must say they are shooting themselves in the foot. The first word that comes to my mouth is YUCK! I know all these 3Com and Intel network cards are more expensive, but they save time and money in the long run.
/Pedro
Indeed, export of cryptographic technology from USA is hampered with strong restrictions. So many Open Source projects are quite careful to avoid breaking laws by having (much) development done outside USA, and also letting release builds be done outside US as well.
For instance, OpenBSD has offered strong encryption for several years. The OpenBSD project is located in Canada, and a lot of development/release builds are done outside US. As Integrated Crypto shows :
..make sure that you have read this
Discusses some serious considerations before deciding to use ipsec and ike. And since ipsec/ike is the only serious solution in many cases, these concerns should not be taken lightly. For example did you know that the ike implementation in 2000/XP simply checks the signer of the servers certificate and not the actual identity that is signed? This means that any other user with a certificate which is signed by the same authority as you can impersonate the server.
The article is very lengthy, I know, but definitely worth your time.
There's a number of such projects out there ... Smoothwall is one. IPCop for another (although it is forked from Smoothwall.) I don't see this project as offering that much over similar ones.
The higher the technology, the sharper that two-edged sword.
I beg to differ, Sir/Madam. So stick that in your pipe and combust it! (Proud member of British Mensa, a Linux user for over two years now and my first AS exam is on the 8th Jan so I think I've made my point.)
I was a Mensa member. (I haven't paid my dues in a long time.) I just barely passed the test to get into the club. So, I may be the Mensa member with the lowest IQ.
I would like to see something that would let me access existing VPN routers from home.
Well, I had the same idea but, unfortunatly, I had nothing but trouble using OpenBSD and I tried the last 3 releases. ;)
Basicaly, I had complete system freezes when under heavy load and unstable network drivers (can't remember wich ones right now but the interface dropped at random times).
I don't know if was me but I used the same hardware with IpCop (VIA-M boards actualy) without a hitch so I decided to stick with it.
I will probably try OpenBSD again as I like the idea but at least for me, right now, it's a dead fish - pun intended
Scientia est Potentia
You had my attention up to the point where you mentioned "redhat". The company that doesn't care about their nonprofit distro. Whoopie, now you got a vpn on it.
Your company is very naive then. They are probably using the "nobody else is using it, so it will be more secure" argument.
Give somebody who can make that decision the results of the following google search - security in obscurity
The first article in this Crypto-Gram also explains the problem - Secrecy, Security, and Obscurity
The Internet's nature is peer to peer - 20050301_cs_profs.pdf
http://www.m0n0.ch/wall
If your interested in Linux or embedded VPN solutions, check out m0n0wall. Its excellent!
Umm...you guys do realize that www.snapgear.com has had embedded, ipsec/iptables equipped routers based on linux for years right? They're enterprise quality and I've had several deployed for over a year. This isn't new, nor is it exciting. Also, embedded implies that its not x86...or using a hard drive. This is a mini-itx based "router" running a distro that has no business being used as such.
I'd like to see one based on this bad boy.
4 gigE ports, each on it's own PCI-X controller. Between the two Xeons and whatever amount of memory you through at it, one of these could *easily* handle a great deal of BGP sessions, load-balancing, failover, as well as VPN and encryption.
With a board like that, a couple of Xeons, and a gig of memory, these could out-perform some very, very expensive commercial routers.
steve
Oh, you're not stuck, you're just unable to let go of the onion rings.
Andrew Warenczak, the guy who designed the box, is looking at making a half-height version, making 4 completely independent servers in one RU of 19" rack.
Got time? Spend some of it coding or testing