Slashdot Mirror
Embedded Linux VPN Router Near Release
An anonymous reader writes "A new open source project aims to build a VPN router that supports all major routing protocols on a standardized hardware platform running embedded Linux. The "Linux Router Project - LR101" started in mid-2003 and plans a first release in January 2004. It is based on a dual-NIC VIA EPIA mainboard and a Travla case, along with Red Hat 8, zebra, FreeS/WAN, IP-tables, an other open source software, all compiled from source."
It would be nice if they have High Availability on their feature list. Some nice solid appliances like this would be interesting.
Is this a stripped down Redhat distro, with a configuration tool that they wrote? Isn't a whole distribution a little bit too much for such a project? Wouldn't a linuxfromscratch installation - with only the bare minimums - be a better idea? Just a thought.
Where's PPTP? for a VPN router, it's kind of desirable ...
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Or, just buy a Linux-based Linksys WRV54G for well under $200 with most, if not all the features of this project. No, I don't mean the WRT54g, I mean the WRV54G. Excellent piece of gear, VPN, firewalling, dmz, wireless (wep/wpa), snmp, yadda yadda.
If that's true, then it's illegal for a US citizen to contribute to the 2.6.0 kernel too, since that has crypto in it.
all compiled from source.
As opposed to say, a Linksys Router, which we all know is compiled from Cheerios. =)
Do you Gentoo!?
Soekris
Crypto export laws were relexed a long time ago (during the Clinton administration).
Just goes to support what I've observed about people who claim Mensa membership.
Complexity is Easy. Simplicity is Hard.
...the Linux Router Project, a floppy-based 386-compatible micro-distro which served as the basis for (among other things) Coyote Linux.
Custom firmware for the wrt54g does/will do pretty much the same thing. Progress is very quick. See the forum here:
sveasoft
The initial PPTP was a total botch, with seven major security flaws. Some of them have since been fixed, but it gives you some idea of the professionalism and quality that didn't go into the basic design. If you want to use a VPN for security, use IPSEC - and this project has FreeS/WAN IPSEC in it. If you really really want to use a VPN to transport lame non-IP legacy Microsoft LAN protocols, go pay Microsoft some money for one of their server projects, and charge the silly customer who's hiring you as a consultant because they don't want to upgrade to the 1990s for it. If you want to use a VPN to carry private IP addresses, but don't actually care about security, use IPSEC anyway, or use GRE tunnels.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
I administered a Shiva vpn server in 2000/2001. I would have preferred to use the open standard IPSEC vs the proprietary SST; however their IPSEC option would not support RADIUS authentication. That was the deciding factor for going with SST. Aside from that it wasn't a bad product.
It actually predates Shiva.
It was developed by Infocrypt, which Shiva bought, and Shiva was in turn eaten by Intel.
SST is legacy, as LANRovers have had IPSEC support since at least version 6.7.
If your company doesn't use IPSec, it's probably going to get left behind when Intel finally dumps the old and crufty SST protocol.
"You've got an invalid haircut" -Warren Zevon - Life'll Kill Ya
Having programmed some of these "beauties" in connection with a microcontroller, i must say they are shooting themselves in the foot. The first word that comes to my mouth is YUCK! I know all these 3Com and Intel network cards are more expensive, but they save time and money in the long run.
/Pedro
Indeed, export of cryptographic technology from USA is hampered with strong restrictions. So many Open Source projects are quite careful to avoid breaking laws by having (much) development done outside USA, and also letting release builds be done outside US as well.
For instance, OpenBSD has offered strong encryption for several years. The OpenBSD project is located in Canada, and a lot of development/release builds are done outside US. As Integrated Crypto shows :
..make sure that you have read this
Discusses some serious considerations before deciding to use ipsec and ike. And since ipsec/ike is the only serious solution in many cases, these concerns should not be taken lightly. For example did you know that the ike implementation in 2000/XP simply checks the signer of the servers certificate and not the actual identity that is signed? This means that any other user with a certificate which is signed by the same authority as you can impersonate the server.
The article is very lengthy, I know, but definitely worth your time.