Slashdot Mirror
Ask Slashdot: VPN Solution To Connect Mixed-Environment Households?
New submitter RavenLrD20k writes: I am a programmer by trade with a significant amount of training as a Network Administrator (AAS in Computer Networking). I have no problem with how to build three or four separate networks in each location and make them route over the internet. My weakness is in trying to setup a VPN for a secured two-way connection between location A and location B, both mixed OS environments, with the requirement that all of the internet traffic on B gets routed through A first. I've already looked at some boxed solutions, such as LogMeIn Hamachi, but there hasn't been much in the way of mixed environment support. This is a complicated one, so keep reading for more on what RavenLrD20k is trying to accomplish.
Some background: Due to recent events it's become necessary for me to have remote access to all of my Parents' computers which are about 4 hours away(location B) from my home location(location A). This is to facilitate me being able to log in and apply patches and security updates without requiring someone on the other end sending me Desktop Sharing invites (I'm already going to be upgrading their 2 systems to Windows 7 Ultimate on my dime for this purpose). The ISP for Location B also seems to be blocking the Desktop Sharing ports as this method has completely stopped working for us without notice, and router configs have been verified as forwarding the necessary ports. Location B also has 2 grandchildren that will have a Windows 7 Home Edition Laptop (for MS Office based classwork), a Linux Mint Machine (to start, he has full reign to do whatever he wants to this machine after initial setup with the understanding that if he "breaks" it, he fixes it), and several BeagleBone or R-Pi machines for my Son's experiments while he's visiting for the summer.
Location A has two networks. First is the one with the public IP that I run my Linux servers and physically connected Desktop on. This network also has a wireless interface that allows gaming machines and phones on the North side of the house to connect to. Network two is behind the NAT and runs a dual-band wireless connection for devices on the south side. I would rather not have this second network get internet access through the VPN but through the traditional means.
Location A has a 150/30 cable connection with a 2TB cap. Location B has a 20Mb/s symmetrical uncapped Fiber connection. I also have a VPS "in the cloud" running CentOS which has a 1Gbps Inbound 20Mbps(1Gbps burstable) Outbound connection which may be repurposed for this if necessary. I figure this to be common sense but I would prefer that the the connection between the locations be routed as opposed to bridged as to avoid the issues that come with sending broadcast packets over the internet.
As I said, I primarily want this to be able to remote into my parents' systems to provide maintenance and support instead of having to budget an emergency trip when things go awry. On top of this I'd also like some way to be able to monitor/control my son's online activities while he's away (hence my desire to route at least his traffic, if not all Location B internet traffic, through Location A). Also note: I'm not a helicopter parent by any means and only monitor once in a while to get a general idea of what his online trend is; and the extent of "control" is if grandpa and grandma say he needs time off the computer for x days for bad behavior or whatever, I want to be able to enforce that rule where he won't be able to sneak around while they're in bed. This connection will not have any firewalling or blocking enabled by default. I want everyone to have complete open access to the full internet (this too is to help educate my son in smart browsing/chatting and encourage "you break it, you fix it").
Have a question for Slashdot's readers? Take a look at other recent questions first to see if someone else has had a similar question. And if not, ask away! The more details and context you include, the more likely your question will be selected.
Some background: Due to recent events it's become necessary for me to have remote access to all of my Parents' computers which are about 4 hours away(location B) from my home location(location A). This is to facilitate me being able to log in and apply patches and security updates without requiring someone on the other end sending me Desktop Sharing invites (I'm already going to be upgrading their 2 systems to Windows 7 Ultimate on my dime for this purpose). The ISP for Location B also seems to be blocking the Desktop Sharing ports as this method has completely stopped working for us without notice, and router configs have been verified as forwarding the necessary ports. Location B also has 2 grandchildren that will have a Windows 7 Home Edition Laptop (for MS Office based classwork), a Linux Mint Machine (to start, he has full reign to do whatever he wants to this machine after initial setup with the understanding that if he "breaks" it, he fixes it), and several BeagleBone or R-Pi machines for my Son's experiments while he's visiting for the summer.
Location A has two networks. First is the one with the public IP that I run my Linux servers and physically connected Desktop on. This network also has a wireless interface that allows gaming machines and phones on the North side of the house to connect to. Network two is behind the NAT and runs a dual-band wireless connection for devices on the south side. I would rather not have this second network get internet access through the VPN but through the traditional means.
Location A has a 150/30 cable connection with a 2TB cap. Location B has a 20Mb/s symmetrical uncapped Fiber connection. I also have a VPS "in the cloud" running CentOS which has a 1Gbps Inbound 20Mbps(1Gbps burstable) Outbound connection which may be repurposed for this if necessary. I figure this to be common sense but I would prefer that the the connection between the locations be routed as opposed to bridged as to avoid the issues that come with sending broadcast packets over the internet.
As I said, I primarily want this to be able to remote into my parents' systems to provide maintenance and support instead of having to budget an emergency trip when things go awry. On top of this I'd also like some way to be able to monitor/control my son's online activities while he's away (hence my desire to route at least his traffic, if not all Location B internet traffic, through Location A). Also note: I'm not a helicopter parent by any means and only monitor once in a while to get a general idea of what his online trend is; and the extent of "control" is if grandpa and grandma say he needs time off the computer for x days for bad behavior or whatever, I want to be able to enforce that rule where he won't be able to sneak around while they're in bed. This connection will not have any firewalling or blocking enabled by default. I want everyone to have complete open access to the full internet (this too is to help educate my son in smart browsing/chatting and encourage "you break it, you fix it").
Have a question for Slashdot's readers? Take a look at other recent questions first to see if someone else has had a similar question. And if not, ask away! The more details and context you include, the more likely your question will be selected.
Let's go shopping!
Get free satoshi (Bitcoin) and Dogecoins
I recommend either an OpenVPN tunnel with appropriate routing (multi-OS capable) or just use the Linux machines already at the site as tunnel servers using SSH as a VPN (relatively recent versions of SSH required).
AntiFA: An abbreviation for Anti First Amendment.
If I'm understanding the requirements, you will want to use openvpn. It has support for Windows and anything running Linux, all sorts of routing options to play with, etc.
If he can't figure out how to set up VPN in an mixed environment, he should go back to school to get his bachelor's degree. A BS in networking is always valuable, especially in doing consultant work.
Sorry i have nothing to bring to this except a potentially odd question but capped cable?? Really? I thought capped landlines were something relegated to the 90s
Check out PFSense. It will let you handle the VPN routing at the border where it belongs.It is also a really nice firewall and router in general!
It's so funny when people come on a say they have this or that whatever training and lots of experience yet they can't set up a simple system like this. It's child's play and technically I have no training in networking (CS major here but only on paper, school taught me nothing new).
Man, the days watching those packet radio frames slowly flow over JNOS 25 years ago really helped me understand how networking actually works. Not some school/training bullshit.
I'm available to set up your little baby network. $100/hour but I can guarantee it will be finished in 2.
What's wrong with Chrome Remote Desktop?
I'll ignore your insane / paranoid need to monitor every move your son makes ("but only for a little while, so it's fine!")
You could consider TeamViewer instead of setting up a VPN. (Versions available for Windows, Mac and Linux...)
Just use a couple of small business routers with built in VPN. They do all of the different subnets and wireless and all of that stuff. They're a few hundred bucks each.
http://www.cisco.com/c/en/us/p...
I don't respond to AC's.
How much control do you have over the gateways? Also, how do you plan on giving different machines different service?
I wouldn't bother with the routing (some) traffic over the VPN just for a bit of introspection; you can do that on the other gateway just as well, provided you have enough control to run your own software on it. A recent openwrt-capable box with plenty ram and flash could support proxies for logging and whatnot else.
And, of course, have you contacted the ISP about the blocking?
http://blog.ine.com/2008/08/02/dmvpn-explained/
If "mixed environment" only means that there are hosts running various OS's at both locations, it's fairly irrelevant.
Anyway, I am using OpenVPN for what appears to be a similar scenario--routing traffic between a relative's and my house. I don't have Internet traffic from one site being routed through the other, although the VPN certainly could be configured that way.
I will also echo the previous recommendation for PFSense, which I am using on one side of the VPN (running on a fairly inexpensive ALIX board). On the other side, I'm using an Ubiquiti EdgeRouter Lite. I can heartily recommend either one, but particularly the EdgeRouter which can't be beat for its ~$100 street price.
I have a BS in Networking! I work in HR and I network ALL the time!
Sweet! I am gonna apply to those high paid networking jobs now!
I might be totally off base, but I wonder about a program like TeamViewer or LogMeIn. If the security trade-off is acceptable, that might be an alternative to trying to create VPNs.
You could use a raspberry pi if 100Mbit network is enough for you.
VPN virtual appliance or dual homed box to handle the VPNs at each site.
Set up a proxy server and configure firewall rules that enforce traffic passing only through the proxy.
If your goal is to make things simple, this isn't the answer. You're going to end up with lots of "sort of works together" software, all of which will need patching and will occasionally just stop working.
For not many dollars, and a lot less time investment you can use something like logmein remote which will give you nearly always reliable, and secure remote access to the machines. You can even set it up so no one needs to be at the remote machines for you to log in. As long as the machine is booted, you'll be set.
I've used logmein (paid) and it's nearly flawless.
As for monitoring all the URLs your son accesses, you could probably set up a proxy server on the local machine that emails you the URLs daily. But the option of routing the traffic back to your machine via a VPN is just a solution looking for a problem. If^h^hwhen something goes down, you'll be busy rebooting ever bit of hardware along the way.
Good (or just practical) engineers remember... keep it simple stupid.
For your main goal of being able to log into your parents' machines, have you tried TeamViewer?
As for setting up VPN, I think you should be able to do it relatively inexpensively with something like a couple of consumer-grade routers running DD-WRT. The one at location B is set up as a VPN client, and the one at location A is set up as a VPN server. You might want to set up address ranges for DHCP at location B such that they're part of the network at location A but not assigned at location A. That way you can avoid needing to do NAT at location B as well as location A.
OpenVPN is a very robust and open solution.
Best scenario is to set up a Firewall/VPN device at each location on an old desktop computer (preferably no more than 3-4 years old) , using one of the following open firewall distros: VyOS, pfSense, Untangle. Configure a full mesh of tunnels using OpenVPN (it comes built into these FW distros.) The fact that it is a mixed environment doesn't matter, IP is IP, the VPN will pass the traffic regardless. ...and ignore the comments about a BS, degrees are overrated.
Haven't had to do this in years (approximately 15 yrs actually) but when I did, I used FreeS/WAN to hook up a bunch of networks over the internet running on smoothwall. Everything else is routing tables. Man, what a trip down memory lane.
I use a checkpoint security appliance for a similar setup. It costs a few bucks but it's easy. There where other brands that seemed just as good, brand didn't seem to be a major issue. Check the lists of features and maybe talk to a sales person at a place that sells them and then it's pretty easy.
I do almost all my friend/family support with TeamViewer. Mac and Windows without any issues at all. And since TeamViewer can use port 80 and 443 your ISP won't be blocking it. I just set their computer for unattended access and setup an account to login them through.
Now for the issue of watching you son's internet traffic. Be prepared for him to learn how to bypass things...that's what kids do ya know.
I use tinc for precisely this. One tinc on a public-facing server, then any computer in any location connects to it to form a network with the others. A bit tedious to configure, but it works well with both Linux and Windows hosts.
Hi, :) :)
Just buy MikroTik and you will setup this in a hour or so.
I have similar setup with my parents house, my two brothers where each lives in different country, all private LAN's are interconnected, with ability to select exit output gateway by my brothers or me with few clicks, where routing decision is made based on IP src, destination, etc. They can exit in any country where someone from family lives. Setup is based on PPTP or SSTP tunnels and at top of tunnels MPLS with VPLS is running which allows to everyon of us to switch on-demand to everyones L2 network and use DLNA. So my brother can watch movies from my NAS in another country. Works well over 6 months without single failure. Restarts, power failure and everything is back online without any tinkering. Only downside - you need to have reasonable internet connection to work flawlesly, because often your upstream is your brother downstream
And everything with hardware cost ~80$ each (RB951G-2HnD). What you want more
it's more like indentured service.
go wipro
It may be reasonable to get Mikrotik RouterBoards for each location (this model being my favorite for home use: http://routerboard.com/RB2011UiAS-2HnD-IN) and set up a system of IPSec tunnels between locations. You can then change routes for where you want traffic to go. We use this solution for several of our larger multi-location clients and it works excellently. Can't praise Mikrotik enough vs. the competitors. No software required on any of the endpoints with this method.
I'm not super-network talented, but I recently used two Mikrotik RB951s to set up a permanent VPN tunnel between two houses for much the same reason. I didn't need the additional routing to make all traffic send through point A, but I know we use that setup at work for our remote workers. My arrangement ended up being traffic from each house going out it's own connection, but with a permanent IPSEC tunnel between the two for server synchronization and tech support purposes. The Mikrotiks are fantastic little boxes and an amazing value. There are multiple 951 models, and you may prefer one of the non-wifi Mikrotik products if you don't need the radio (though having a 1w radio has been nice also!)
Slashdot comments... splitting hairs since 1997.
pfsense routers using OpenVPN connection between the two locations (probably location B acting as a Client to location A server, with it set up to route all traffic through the tunnel to A).
Likewise you could also just set up an OpenVPN server at location B and use an OpenVPN client to connect from a machine on "A" to the "B" network for when you need to work on things there (but then you won't have the traffic routing from "B" through "A" before it hits the Internet).
Personally I used a small fanless box from NetGate (that came pre-installed w/pfSense and 6 NICs) to run our SoHo office of ~10 devices on the computer network + another 15 phones on a second network feeding into a second NIC. Load balanced WAN connections from two different providers, and OpenVPN server for remote connections for fixing things at home, and all the bells and usual bells and whistles (for me at least).
This space for rent. All reasonable inquiries will be entertained at proprietors discretion.
Use Tor and the hidden service options to get access to the client devices. This circumvents the ISP snooping and dropping desktop sharing.
BTW are you living in a country withouf netneutrality? Otherwise sue.
Have you considered using SSH tunnels to communicate with each site? You could run SSH servers on each network, open up ports on the upstream firewalls and get your connectivity that way?
You could also bind RDP to a port that is known to be open (http/https?) and set up dual factor authentication.
Setting up VPNs on any standard home router isn't that hard. Where you may run into problems is when IPs change. You may consider setting up DynDNS accounts for ease of use and setting up OpenVPN connections.
Since you didn't mention anything about the subnets behind the endpoints, openvpn will probably be your best/easiest route.
This should give you some ideas:
https://www.dd-wrt.com/wiki/in...
I second many of the above suggestions. pfSense isn't a bad solution, OpenVPN will work, and little Cisco VPN routers are good too. I'd personally just put a Juniper SSG-5 on each end, for the simple reason that they are available on eBay for around 50 bucks each and are relatively easy to configure.
If you have one Linux system there with an account you have access to AND an server on your end that you can SSH into your set. On your server you need an account for them to log into which has their autossh users public key in the authorized_hosts file.
You want an excutable file named /etc/network/if-up.d/reverse-ssh
# Ensures that autossh keeps trying to connect
AUTOSSH_GATETIME=0
su -c "autossh -f -N -R *:$8000:localhost:22 -R *:$8001:localhost:5900 pozer@myserver.com -oLogLevel=error -oUserKnownHostsFile=/dev/null -oStrictHostKeyChecking=no" root
I have autossh run as root and log into the account pozer on myserver.com. At that point you have a computer on your network with port 8000 opened to their Linux box and 8001 available for vnc. I set the looged in users X destkop to autorun run "x11vnc -shared -forever" export their desktop over vnc. I also install UltraVNC on the windows PCs.
If you had a windows PC at 192.168.1.50 you could add "-R *:8002:192.168.1.50:5900" to the above autossh command so you can reacn it with "vncviewer myserver:8002"
If you dont know the IP address till later you can set up a forward tunnel by remoting into their server over ssh. ssh remote@myserver -p 8000 -L *:8002:192.168.1.50:5900"
As long as there is a reverse tunnel you can use to create a connection back to their linux machine you can open up and access any port on their network. you can use vnserver to run a headless desktop in the background on their linux mint PC.
vi +
Works on Windows, Linux (that's where I run my NeoRouter server) and Android. They have a free (beer) version that I used for a couple of year. I'm on the paid version now. http://neorouter.com/
My opinion? See above.
If you have any low power/old machines lying around you can certainly get the A to B IPSEC VPN set up with IPCop pretty easily and cheaply, and IPCop has lots of other stuff like URL filters if you want. It also makes a good OpenVPN server for road warrior type access.
I'm sure there are other, better ways in 2015, but I have used IPCop for years and years now.
well for one thing you can use rdp on nonstandard ports to get remote access. I'd probably just use a ssh tunnel , forwarded internally, to accomplish the remote administration. It's simple when you know what to do but can be tricky to figure out on your own. From there I'd likely use a local pfsense router to filter traffic accordingly. No need to make it all one big network
Sounds like you want a couple of pfSense firewalls -- one at each location.
1) OpenVPN between the sites.
2) Sites can even be on different subnets, just need to configure the firewall rules to allow traffic to pass. This will allow you to remote into systems at site B.
3) Configure each computer to route through the network - WAN (local ISP) or VPN (back to Site A).
4) Setup DHCP with MAC Static mappings - this will allow you the ability to later disable any/all/restrict Internet access to devices as necessary.
5) Install some time monitoring software (PCs - TimeBoss, for example. You probably won't use the limiting features, just the capability to take/and send screenshots of activity to yourself. For the Linux - probably need to install some screen shot software and create a cron job to take a screenshot and email the result).
You could do some of this with some routers with DD-WRT, but you'll have finer control with a couple of pfSense rigs -- you can get some HP T5740 Thin Clients with pfSense and three 1GB NICs for around $100/ea on eBay.
Instead of routing all of B's traffic through A, why not install a dedicated box at B for monitoring and maintenance purposes? You can route all of B's traffic through this box and log/limit it, as well as use this box to remote desktop/ssh/whatever into the other machines at B.
Then you've reduced your problem to simply needing to VPN or ssh tunnel from A into this one box at B, which I will leave as an exercise for the reader.
I have a similar situation for remote access, but my parents are 12 hours away.
I use Splashtop with the remote access feature (paid feature). No approval to access the machine is required.
I use Sophos UTM(next gen firewall, formerly Astaros(sp?)) for Web filtering, spam and anti-virus protection in my home as I was tired of trying to tie solutions together to make them work and SPAM was really starting to get bad. As you are doing this for personal use, you can get their Home use virtual license for free and run it on an old computer with esxi. Since it is a full fledged firewall you can also setup VPN connections if you want to. As you are covering multiple house holds you will need a user in each household to get a separate license for home use. Or you could purchase their appliances. With this you can create web filter rules with time based restriction, user based restrictions, ip address restrictions etc...
Splashtop Remote desktop solution:
http://www.splashtop.com/
Sophos UTM home use:
https://www.sophos.com/en-us/products/free-tools/sophos-utm-home-edition.aspx
Get some IPv6 endpoints (and subnets) from he tunnelbroken and set up some basic ipv6 linux firewalls at both ends. Ditch all the crazy NAT/VPN crap and just go 100% peer to peer.
Using a PFsense with multiple nics you could set up numerous networks and control routing between the networks at that point. Also pfsense can fully intergrate openvpn into the Scheme and has a firewall and filtering to be able to tell where everyone in the network is going. It also allows for port forwarding for you Linux box. did I mention all of this is done through a GUI interface. Software can be downloaded at: https://www.pfsense.org/
OpenVPN does exactly what you need. You can link your locations with a site-to-site tunnel and include the nets on both sides.
https://openvpn.net/index.php/...
You can set one of the VPN gateways as the default gateway for the other net and OpenVPN runs on all sorts of hardware including WLAN routers and iOS devices.
Microsft spel chekar vor sail, worgs grate !!!
This is trivially simple with OpenBSD if you control pc hardware on both ends acting as your router/firewall, even for default routing packets through a tunnel. Alix makes inexpensive, high quality hardware that is OpenBSD compatible.
For Location A: /etc/ipsec.conf: /etc/hostname.gif0
location_a = "10.0.0.0/24, 72.82.92.102"
location_b = "192.168.1.0/24, 102.92.82.72"
ike esp from {$location_a} to {$location_b} peer 72.82.92.102 psk MyPreSharedKey
10.11.12.1 10.11.12.2 netmask 0xffffffff up
giftunnel 72.82.92.102 102.92.82.72
For Location B: /etc/ipsec.conf: /etc/hostname.gif0
location_a = "10.0.0.0/24, 72.82.92.102"
location_b = "192.168.1.0/24, 102.92.82.72"
ike esp from {$location_b} to {$location_a} peer 102.92.82.72 psk MyPreSharedKey
10.11.12.2 10.11.12.1 netmask 0xffffffff up
giftunnel 102.92.82.72 72.82.92.102
Set a static route in location B for 72.82.92.102 to your ISP's router, then set your default route to 10.11.12.1 in location B's router.
auth hmac-sha2-256 enc aes will be your default transform, which is fine.
The rest is openbsd's pf.conf semantics (which is *the* bleeding edge of PF development) and a few OS tweaks to sysctl.conf and rc.conf.local. /etc/rc.conf.local
net.inet.ip.forwarding=1
net.inet.ip.redirect=0
net.inet.ipcomp.enable=1
isakmpd_flags="-K"
ipsec=YES
I would put a pfSense Gateway at each site to talk to the other sites, with the the Gateway at Site A having an extra couple of network cards for the Gateway and other subnets. Build your hardware based on traffic load, a couple of Raspberries should be find.
Ignore the Mixed environment, and feel safe knowing you are tunneling traffic for all the devices, computers, iPads, Phones XBox etc over your Site A connection and can monitor and log traffic to your hearts content.
Keep in mind if your son is smart, it doesn't take more than an email address to setup some of the free trial VPS, and ssh into them to tunnel a SOCKS Proxy out and create his own unmonitored tunnel through your tunnel to go to whatever websites he chooses to go to.
Just saying if you build better mouse traps you breed smarter mice.
Hi,
I have put together a system which does exactly that. I did it by putting openwrt on two routers, one at each location. I needed to add the tun/tap driver module. This module allows a programmer to send a complete packet from userspace and inject it like it was coming from a network adapter. It has two ends, an interface for the network side, called tap0 or tun0, and a file handle for the program side (something like /dev/tun/0). I then use brctr to add the tun0 to the list of bridged adapters. There are two programs. One is a server at site A that accepts a connection from site B. Site A has a static IP. It takes the packets from the remote and pushes them through the bridge. I use the tap0 interface so that the ethernet layer is still intact in the packet which allows the bridge to do it's routing magic. The B side is a client program which does the same thing, except it automatically makes the connection to site A when the router boots. I modified the A side to run through inetd. The B side runs the connecting client at startup. Router A has IP address 172.16.0.1, while router B has IP address of 172.16.1.1. The netmask is 255.255.0.0 so that broadcasts will go across the network. Each router manages it's own DHCP, and gives itself as the default route. The router uses it's own range of 172.16.X.2 - 254 for leases. You probably don't need to route all internet traffic through A, as you could always log into B and block traffic there. To have the DHCP work correctly, the program that connects the two routers has to block all DHCP traffic from transferring over the link. BTW, the link is a simple TCP connection that resets on error.
I understand the issues that can arrive by sending ethernet packets over tcp (with the timeout problems for retries), but I really have not experienced any problems in this realm.
The end result is a bridged level 2 network, but each with it's own IP configuration.
If you are interested in this type of solution, or for more details, try me at gmail, jkevinm.66.
In your desciption, you have lots of different random things you're trying to do, and it'd take me some time to parse it out, and then I'd have questions.
But you say, "I primarily want this to be able to remote into my parents' systems to provide maintenance and support instead of having to budget an emergency trip when things go awry." Ok, so my first question would be, do you really want VPN for that? It might be easier to go with some kind of remote-control service or MDM. LogMeIn comes to mind as something that does not require someone to send an invitation, though it's not free anymore. Speaking of LogMeIn, you could also look into their Hamachi service as a VPN. (For the record, I have no affiliation with LogMeIn).
You could set up routers on each site that are capable of creating a VPN tunnel, and then just create a VPN tunnel between them. I think DD-WRT supports this, if you can't find anything else to do the job, and Buffalo makes routers with it pre-installed. I haven't used them, but I'd bet I could get something working with that. On the other hand, the reason I've never done that is that site-to-site VPN tunnels can be just finicky enough that I wouldn't bother with them unless I need a constant ongoing connection between two locations for a serious purpose, and when I do need that, I get professional gear. As a result, I can't verify the reliability of VPN for any consumer level gear.
I would also wonder, if the ISP is blocking "desktop sharing ports", might they also be blocking common VPN ports? Can you just change the "desktop sharing ports"? Maybe you can do a NAT on the firewall to redirect the ports, and then you don't need to reconfigure the desktops to use different ports.
"Due to recent events" and "(hence my desire to route at least his traffic, if not all Location B internet traffic, through Location A)" just screams someone trying to perform a technical solution to a human relationship problem. Why would the people in Location B (4 hours away) ever want their internet traffic routed through Location A?
I see this crap all the time at work....We want to do X,Y,Z. That's all fine and good but lets start with what the problem is....X,Y,Z may not be the best solution for your problem.
I use it extensively. *single port* so easier to get through a NAT, works with Synology Raids too, Android, Windows, Linux the lot. Encrypted.
As others have said, easiest and most foolproof way is pfsense box. I prefer these ALIX boxes but you could do it for "free" with a couple old PCs or any number of old routers that can run pfsense.
http://store.netgate.com/Netgate-m1n1wall-2D13-Black-P216.aspx
There are two issues here:
1. Unrestricted traffic flow between machines for administrative purposes
2. Content filtering/restrictions for a child.
#1 is easy in theory, just use a VPN router type product. I do this a lot professionally and I would say most of the solutions out there would be painful for a novice. You also have some fun challenges in that the 20 meg cable modem side is going to have dynamic addressing most likely. That detonates the ability of using anything from Ubiquiti or using anything vyatta or based on SWAN as they don't support aggressive mode IKE. You can do main mode and certificates but it's a bloodbath.
Above recommendation was to use DD-WRT. Ive tried and it's been ok at times and painful at times. The only device I had that it was "good" on was a wrt-54g. The other platforms I tried it on had poor sucess and many features were broken. You can try that (good luck) or use pfsense on an intel platform box. Pfsense was ok, but I certainly experienced more latency with it than a commercial firewall.
My recommendation would be to use ebay to buy two netscreen/Juniper firewalls, one a SSG-5 and the other a SSG-140. You can google "netscreen route based VPN". These are older enterprise firewalls but should be fine for personal use. There is plenty of documentation out there on how these things work and they provide the most functionality/least pain of anything Ive worked with.
#2 is difficult. If you install something on the machine it always seems to cause problems. Something at the network level is not going to be feasable for a home environment. You could try pfsense or dans guardian or something less than enterpeise but again it's not great.
I have 3 VPS and 2 mixed networks. All of them can communicate with each other over different subnets
Make one of the VPS servers your master OpenVPN server
Connect all the other VPS, or network gateways to the Master as clients.
Make sure you advertise the routes using server side client config directives (usually in $path/openvpn/ccd/$name_of_certificate)
Problem solved.
Can even go a little more advanced, setup a vps in another country, and use static routes to make it appear like you are local when you hit certain websites (say BBC iplayer..)....
I came, I conquered, I coredumped
The VPN would be the bottleneck screwing bandwidth for the remote side. Not to mention creating an unnecessary SPOF.
Instead you should create a mgmt network across the vpn.
Setup server at the remote location running both your monitoring software and vpn server (openvpn). Manage the monitoring software by connecting with openvpn client. Manage others computers the same way.
It sounds like the motivation for the change isn't that remote desktop didn't work well, but that it has stopped working, so you don't have a good way to remotely administer their machines. If so, rather than setting up a VPN, a remote desktop that does work would would do the job.
Chrome Remote Desktop (a Chrome browser extension from Google) does this quite handily. You can set up one-time remote sessions, where someone on the other end has to give you an invitation for each connection, or you can set up persistent connections which you can use any time. It's cross-platform (Windows, Mac, Linux).
I haven't looked into the underlying network protocols in detail, but I understand it uses libjingle, which implements ICE for NAT traversal (https://tools.ietf.org/html/rfc5245). What I do know is that I've used it in many bizarre network configurations and it's been flawless... if both hosts can reach the net, they can reach one another.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Just buy sonicwalls for each location. Site to Site VPN and they support crazy configs like these.
You can either spend the money on the right solution, or spend the time (which is money) in frustration and cobbling other junk together. Your choice.
In my opinion you are making this issue more complicated than it really is. You really don't need site-to-site VPNs and custom routing to accomplish your goals.
If I understand you correctly your goals are:
1) To have remote access to machines (Linux, Windows, others) in few remote networks.
Just set up VPN server in each of these remote networks. OpenVPN is probably a good way to go. It would run on any Linux machine, Windows machine (if you dare), even on some routers (f.e. DD-WRT compatible). If these networks are behind dynamic IPs you will also need somekind of dynamic DNS service.
Having VPN server running in all locations you just login to it and access whatever machine in that network remotely. For Windows machines DameWare is probably not a bad idea. It is commercial software but you only need to pay for one license - the license is for an operator (you), not for client machines. You could also use VNC - why not? For Linux machines SSH is a no brainer. And other devices (like printers, networking gear, etc.) probably have HTTP interface anyway.
Also you wrote: "me being able to log in and apply patches and security updates without requiring someone on the other end sending me Desktop Sharing invites". Well are you aware that you DO NOT need to log in to Windows systems to apply patches and security updates? It just happens automatically. Just turn on Windows Update.
And since it looks like you are required to take 4hr trips to fix your parents computers that makes you basically their administrator - DO NOT give them administrator rights on their machines. Set them up with quite secure configuration - no admin rights, antivirus software running and set to automatic, backup running and set to automatic, updates running and set to automatic. If you do so I hardly see a need to physicaly access their machines (modulo hardware failures).
2) You have described your second goal in such convulted way with buts/ifs and so on that I need to cite this mess: "I'd also like some way to be able to monitor/control my son's online activities while he's away (hence my desire to route at least his traffic, if not all Location B internet traffic, through Location A). Also note: I'm not a helicopter parent by any means and only monitor once in a while to get a general idea of what his online trend is; and the extent of "control" is if grandpa and grandma say he needs time off the computer for x days for bad behavior or whatever, I want to be able to enforce that rule where he won't be able to sneak around while they're in bed. This connection will not have any firewalling or blocking enabled by default.".
So basically you want to:
* monitor your sons network usage
* enforce policies on your son (like no Internet after eight since you were bad)
* enforce password usage (or other form of authentication) on your users since you don't want to allow your son to use their grandpas computers while they are not around physically guarding the machines
Well what you basically wish for is corporate-like network with authentication to local systems and to network usage. It can't be done without enterprise class systems - you will need an internet access proxy/gateway for accounting and enforicing access policies for network, user directory to enforce password usage and restrict access to certain machines for certain users (namely your son), network access protection system (and network hardware supporting it) so your son can't just use his Linux machine to access network however he likes.
That means that you are contradictiong yourself by saying that you dont want to have any firewall or blocking - you do.
How you are claiming that you have any training in network administration is beyond my understanding.
I'd recommend you look at something like the Meraki MX64/MX64W at all three locations, it will do all of the necessary tunneling and filtering you need (with the advanced security license), as well as allow you to monitor what is happening on the network.
Additionally, it's all cloud managed so you can view and configure the device from anywhere.
I deploy these at work for our remote offices, and just purchased a similar setup at home (an MX64 and two MR18). I can filter what my kids get to as well as easily support remote backups and administration at my parents home.
TeamViewer is similar to remote desktop, and quite good. It's free for personal use. You might want to try that, or simply changing Remote Desktop's ports, before launching into complicated stuff, mister Network Admin.
The Cloud - because you don't care if your apps and data are up in the air.
I'm not sure if anyone has posted this option, sorry didn't read all of the comments. Sophos UTM with a home license. All you need it some low end dedicated hardware at each location and super easy to setup, Site to site, routing and all.
Yes, you could go through the trouble of setting up VPN, etc. and it would work. But VPN connections can be tricky if you don't know what you are doing.
Personally, I've been using Teamviewer (Free for private use) for remote control. They have Windows, MAC, UNIX, and mobile clients. You do have to know the password on the client that you are connecting to and I believe that you can set it to a permanent one, but I've never needed to. I just get my Dad to read the 4 or 5 digit random number back to me. I believe that you can set it up to be always-on if you buy a license.
https://www.teamviewer.com/en/...
As for monitoring your kid's Internet access, it isn't going to work. He'll quickly find out that Grandpa's computer has access to everything... (grin)
The easiest thing to do is install a monitoring program on his computer and buy a 802.11ac router for home and a router for grandpa that has built-in Parental Controls. You could then check the program logs on your kid's computer and the logs on the router.
Unless you really have your heart set on learning how to configure VPNs and understand IP networking, it's just not worth it for Remote Control and Parental Monitoring.
However, if you also plan to use the link for backups between their home and yours then it might make sense as backup services like Carbonite can be costly. In that case, the Meraki solution proposed by a previous commenter would be a good place to start.
I'm surprised no one mentioned Softether https://www.softether.org/ - with multi-protocol support and site-to-site capability, it should be able to cover all your needs. Setup a server in the cloud - DigitalOcean is a cheap and excellent host - with Softether. Setup another softether client in your household on an old machine and set the two to do a site-to-site. From the digital ocean installation, ensure that the gateway is whatever you like to be (another VPN to work, perhaps?) and you're all set.
Since I've tried https://www.zerotier.com I don't even want to look at anything else. Works everywhere, on any configuration, don't need to configure anything other than the virtual networks you want to make. It's really impressive how easy it works and how well it works behind companies' firewalls (without their tech support actually knowing I'm using it).
It will cost you some bucks, but the simplest-to-maintain connection would be a dedicated machine at the far end to act as a firewall that forces all traffic through a VPN, and some box at your end to receive the VPN's traffic and route it wherever it needs to go.
Doing it this way means there is no special software to install on the clients and nothing will "break" when Windows 10 or Raspberry Pi's next OS revision comes out.
For appliances like these, I would recommend you consider one of the specialized distributions that are built with this kind of thing - and the security that goes with them - in mind. A decade ago I would've said OpenBSD but there may be something better out there now.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
You don't need to route the traffic from their network to yours. You are making this way way way more difficult than it needs to be. Setup a router at the grandparents end which has everything running through it. Set it up with a squid proxy and all the traffic will be loggable there.
Next configure that route to be a vpn server and you connect into it whenever you want. Once connected you can read the logs and check your sons internet habits and you can access the rest of the network to fix their machines.
Unless I am missing something there is nothing in your spec that actually requires a site to site connection. Christ you could probably get away with a few non standard port forwards and just ssh directly into your sons laptop.
There are two ways of doing this.
One is to look for alternative remote desktop software that does work. I've had success with TeamViewer - YMMV.
Two is to put in a lan-to-lan VPN at each site and configure your routing appropriately - either go with something like DD-WRT or get something that will do it out of the box like a Ubiquity EdgeRouter Lite ($100 and it has 3x gigabit ports and enough horsepower to route at an appreciable fraction of that rate)
https://www.ubnt.com/edgemax/e...
Specialist Mac support for creative pros, Melbourne
Use OpenWRT routers at each end and use IPSEC tunnels. As long as one end has a static IP, that can be the one that the others always 'dial in' to.
I think it's the best open source firewall platform with the added value of packages. HassSeattle
This is a job fo IPsec tunnels. OpenVPN could also do the job. Linux, FreeBSD and OpenBSD has been cited. NetBSD can do it too. IMO NetBSD may have the path of least resistance but that is personal opinion.
My question is: If you know what you're doing, why wasn't this the obvious solution for you before you posted?
As for needing enough CPU power, don't worry.. Back in the '90s, UBC Comp Sci was using a bunch of 30MZ pentiums to route between 10Megabit networks (mostly thicknet, with some thinnet). The reason why they used 30Mz machines??? The supplier ran out of 25Mz machines. .. So I figure that just about anything that runs over 300Mz would be overkill for your particular problem -- and anything less is probably no longer supported in many of the current distros.
Sometimes boldness is in fashion. Sometimes only the brave will be bold.
Easily achieved with Cisco hardware ( read that enterprise class ) but can't swear to it via PfSense. Talking a beefy and / or $$$ router though for the speeds you quoted in the Cisco world.
PfSense will do a few flavors of VPN, but I've never tried to get it working with any sort of logic to flag which traffic should bring the tunnel up and which should go out unencrypted.
However this link is informational:
https://doc.pfsense.org/index....
Since it's a mixed environment, it would probably be best to do it at the router level.
To manage my Mom's computer at Location MOM from Location ME:
1. WRT54G router at location MOM running Linux and OpenSSH server
2. On each computer at Location MOM: RealVNC installed or a login with Remote Desktop access
3. From location ME, use SSH to port-forward port 3389 (RDC) or 5900 (VNC) to my computer
4. Remote Desktop into localhost:XXXX
Example:
>> ssh routerlogin@myMomsRouterIpAddress -L 10000:momscomputername:3389
Remote desktop to localhost:10000
I use Cygwin for the SSH stuff on my desktop at location ME.
I could also just statically expose the ports for each computer at location MOM via the router UI and skip all the SSH forwarding but I don't think exposing Remote Desktop to the entire internet is smart/secure for a generally unmonitored network.
I used OpenWRT with OpenVPN on TP-Link Archer C7s Which are an AC1750 (2.4ghz and 5ghz) WiFi Router available for less than $100 on Amazon.
The only thing that does not appear to work on OpenWRT is the hardware NAT which is not likely to be any problem for a home network connected to current Cable Modem speeds under 100Mb/s.
This allowed us to create dedicated virtual links and to map access so that only those networks accessing across OpenVPN had local network privleges. Use DDNS (like on Afraid.org) to connect the OpenWRT routers each other so even if the ISP changes the DHCP IP addresses on reboot and you are good to go.
There are also lots of resources free on the routers after the OpenWRT install to add lots of added OpenWRT packages.
Site to site VPN.
As to how you do this there are very very many ways to do it. Take your pick.
Take a look,
https://goo.gl/kRhdMh
http://saima.info/products-3/v...
cualquier vaina hagase el muerto
You need two raspberry PI2B computers, dynamic dns, and openvpn.
Dynamc DNS service to tack B side ip addresses
OpenVPN to create the VPN
Leave the VPN on all the time using the raspberryPIs
ip route add 192.168.2.0/24 via 192.168.1.100
(assumes your A side raspberrypi is .100, and your net is 192.168.1.0 and their net is .2.0)
If you can't port-forward VPN through your ISP, you can fool it by "router hole punching"
Go download: https://www.sophos.com/en-us/p... You'll have a free licence for 50 ip addresses per side. Beauty is.. its linux; supports more hardware options than pfsense. I use this to do exactly what you're wanting to do. I built small cheap computers($250 a pop from newegg, tri nic'd) to be the "FW", installed the UTM box to every family household that needed one and setup site-to-site VPN between them. Works perfectly and it easy to manage.
/thread
Sheesh.
Many ISPs block ports that are abused by default, protecting idiots from themselves. Most ISPs allow unblocking on request.
Cisco devices have a feature called VTI - virtual tunnel interface. Basically it's an IPSec-protected GRE tunnel, but it looks like just another interface on the router.
Then you just set up your routing rules. Policy-based routing will allow you make decisions based on the source IP.
This stuff works great in a SOHO environment. Doesn't scale well, though.
Get a small NAS, such as a QNAP or Synology.
They both have OpenVPN built in, so use that. Then you have a NAS for centralized backups (because if you're managing remotely you want to make sure they're stuff is backed up, right?) and your VPN connectivity.
Win win situation. If you get creative, you can even cross-replicate the NAS's so you have a true offsite backup.
Softether can be run on windows and linux and one server can provide openvpn, l2tp, sstp and has a nice gui server manager you can run on a windows machine you have access to.
pertino is another idea, this is a software defined network that can link all those locations together. It might not have enough admin options for the whole family to keep chill.
Softether.net and pertino.com
From what I understand of your requirements, you want to be able to remote into Mixed OS systems to do technical support more then the need for a VPN. In that case I would recommend Screen Connect. It works like it uses SSL and has client initiated connections and persistent clients. Since it is a piece of installed software it can be installed anywhere you need it. It is a little pricey at $375 for a single persistent self-hosted solution. The licence includes one year of software updates and support. On top of it, if you do not want to renew after the year is up you can continue to use it without additional cost. https://www.screenconnect.com/
Agreed - you'll also want to take it a step further by changing the port you're using. Per the OP:
"The ISP for Location B also seems to be blocking the Desktop Sharing ports as this method has completely stopped working for us without notice"
I've encountered this myself with SSH - if I funnel too much traffic through my suckcast connection, they start blocking port 22. Calling their support line ends in frustration due to their support reps having 0 knowledge of what the network engineering teams do there. I've found that turning off my modem overnight, to obtain a new IP address the next morning seems to clear it up. On a side note, I wonder if it affects the next customer who leases that IP? ;)
I've been experimenting with SSLH to mask my ssh traffic over port 443 and it seems to be working well for me. This may be an option for you.
Come on, OpenVPN isn't all that hard! There's like a billion issues around IPsec and OpenVPN sidesteps them all. It's also multi-platform so IMO it seems to be exactly fitting into your environment. Just give it a try.
Pay a little more for business class broadband service with at least one assignable static IP per site. That will make all of the difference and the ISP will be obligated to support your needs. They won't block ports, throttle you, or change terms of service on a whim.
Everything you are trying to do would be MUCH easier with static IP's. Once that is done, look into old Cisco 1800 series routers (like 1841 for $99 on ebay) or ASA 5500 series firewalls. There is a lot of documentation for VPN's with Cisco on Youtube. For free, PFSense could work nicely also.
If you want to monitor sons internet habits, enable Netflow on Cisco router and get a free software from ManageEngine or Solarwinds to collect flow data from router.
I know this is old now, but honestly you're overthinking this.
First, as others have mentioned here you can use TeamViewer to do remote desktop support, and it's free. No need to upgrade to Windows 7 Ultimate or anything else for that matter. I've used it on OSX, Windows and Linux and it works like a champ. I've supported family and friends... and even had a commercial license for TeamViewer for a while because it really is so easy to use and maintain that I found it invaluable. I don't do that job any more, but I still maintain TeamViewer on my computers in my house so I can get into them and manage/maintain them while I'm on a business trip. Same on my son's laptop so if he has a problem I can support him remotely.
Now of course comes to your son. Don't. Seriously... kids are going to be kids, and they're going to work around any controls you put on a computer. The only thing you are LEGALLY required to do is to control what he has access to at YOUR home. Once he's off your network, anything he does is the responsibility of the party that owns the network he's using. Yes, he should be held responsible by you as a parent, but legally there's nothing forcing you to do this. Plus, kids are going to find workarounds regardless; my son is 15 so you can imagine the battles I've had with him over the years. As it stands now, I manage his Internet access at home using a Sonicwall TZ-215 firewall that has Gateway Anti-Virus and some content controls turned on. Honestly, I don't block porn... he's 15... but I do block some categories I personally find distasteful; hate speech and the like. If he needs something for a particular essay he's doing for school that's blocked, he can ask me to unblock it and he does. This way there's mutual trust going on, which to be honest is the RIGHT way to parent.
I also don't check the logs to see where he's going on the web. Just so long as he's not doing anything illegal (and yes, I do block bittorrent for that reason) that could get me in legal hot water I don't particularly concern myself with it. I check his laptop for malware and to make sure updates are in place periodically, but beyond that I don't see the need to get overly stressed about it. Besides, we have an understanding that if he does anything bad that gets his computer malware that's going to be too much trouble to clean up (like more than 30 minutes of work on my part) then his machine gets re-imaged and he gets to reinstall everything, restore his own files etc. I make him responsible for his backups as well.
Is my system perfect? No, but it works. And right now I have a 15 year old boy who may or may not go on porn sites occasionally (I really don't care), plays games occasionally... but generally is a well-behaved kid when it comes to technology.
I guess what I don't get about your requirements; if your primary reason for the site B connection is supporting your parents, then why backhaul all the Internet traffic across your own network? With a decent managed firewall you can do all the controls you like, and there are web-managed options as well. Some of them even support OpenVPN natively or some IPSec variant that you can create a virtual private network for managing stuff. If you really want content controls on your parents network then you really need to review what you're trying to accomplish here. You don't have to get something as fancy as a Sonicwall, there are plenty of other cheaper options but that is certainly one.
I do have a VPN as well as my TeamViewer connections... honestly SSH is easier to manage my Linux boxes than TeamViewer most of the time because I don't need a GUI. As a result, all my Linux boxes partake in an OpenVPN network against a hub system hosted on Linode (where my web server is also hosted). I have the OpenVPN client on my laptops so when I'm out and about I can join the network and SSH to any of the systems no matter where I am (I keep a HOSTS file with all the IP's). Bonus; I can host my own mail server on my home box without using the storage on the L