I am planning on running a Virtual Private Network from my Fedora firewall out to a UML virtual colo (running RH9) at another site. That site will be the place I present services to the world; httpd, ssh, sftp, smtp. This is to comply with the "no servers" and dynamic ip restrictions on my Comcast connection to the net; if my firewall always drives an outbound connection to the colocation site, I am not worried about changes of ip address, and I am not opening any inbound ports.
There are a number of options for the VPN - the most attractive are cipe ( http://sites.inka.de/sites/bigred/devel/cipe.html ) and FreeSwan ( http://www.freeswan.org/ ), though I am told that one can do all this through an ssh tunnel. I would rather have simple and secure than super-duper; I have plenty of bandwidth, and will send outbound http and smtp from the firewall, so the main bandwidth user will be incoming spam/b/b/b/b mail.
Anyone have some experiences to share about setting up VPN? Is there anything about either cipe or FreeSwan that is likely to break with FC1 or FC2?
Keith
Unfortunately, Comcast has another restriction for residential customers on their networks - no VPNs! :-(
Larry
I am planning on running a Virtual Private Network from my Fedora firewall out to a UML virtual colo (running RH9) at another site. That site will be the place I present services to the world; httpd, ssh, sftp, smtp. This is to comply with the "no servers" and dynamic ip restrictions on my Comcast connection to the net; if my firewall always drives an outbound connection to the colocation site, I am not worried about changes of ip address, and I am not opening any inbound ports.
There are a number of options for the VPN - the most attractive are cipe ( http://sites.inka.de/sites/bigred/devel/cipe.html ) and FreeSwan ( http://www.freeswan.org/ ), though I am told that one can do all this through an ssh tunnel. I would rather have simple and secure than super-duper; I have plenty of bandwidth, and will send outbound http and smtp from the firewall, so the main bandwidth user will be incoming spam/b/b/b/b mail.
Anyone have some experiences to share about setting up VPN? Is there anything about either cipe or FreeSwan that is likely to break with FC1 or FC2?
Keith
-- Keith Lofstrom keithl@ieee.org Voice (503)-520-1993 KLIC --- Keith Lofstrom Integrated Circuits --- "Your Ideas in Silicon" Design Contracting in Bipolar and CMOS - Analog, Digital, and Scan ICs
-- fedora-list mailing list fedora-list@redhat.com To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
from current comcast support site:
*** FAQs : Connection : Troubleshooting Can I use a VPN connection on the Comcast High-Speed Internet Service?
Yes, you can utilize a VPN connection as a residential customer on the Comcast High-Speed Internet Network. However, it is important to note that Comcast Customer Care cannot provide technical support for your VPN connection. For help setting up, using or troubleshooting your VPN connection, please contact your company's IT department or VPN provider.
If you are able to browse web pages, send and receive your Comcast.net E-Mail, but are unable to use your VPN, the problem is not with your Comcast High-Speed Internet connection. Please contact your VPN provider for assistance. ***
On Sat, 21 Feb 2004, mylist@gmx.net wrote:
Unfortunately, Comcast has another restriction for residential customers on their networks - no VPNs! :-(
Larry
I am planning on running a Virtual Private Network from my Fedora firewall out to a UML virtual colo (running RH9) at another site. That site will be the place I present services to the world; httpd, ssh, sftp, smtp. This is to comply with the "no servers" and dynamic ip restrictions on my Comcast connection to the net; if my firewall always drives an outbound connection to the colocation site, I am not worried about changes of ip address, and I am not opening any inbound ports.
There are a number of options for the VPN - the most attractive are cipe ( http://sites.inka.de/sites/bigred/devel/cipe.html ) and FreeSwan ( http://www.freeswan.org/ ), though I am told that one can do all this through an ssh tunnel. I would rather have simple and secure than super-duper; I have plenty of bandwidth, and will send outbound http and smtp from the firewall, so the main bandwidth user will be incoming spam/b/b/b/b mail.
Anyone have some experiences to share about setting up VPN? Is there anything about either cipe or FreeSwan that is likely to break with FC1 or FC2?
Keith
-- Keith Lofstrom keithl@ieee.org Voice (503)-520-1993 KLIC --- Keith Lofstrom Integrated Circuits --- "Your Ideas in Silicon" Design Contracting in Bipolar and CMOS - Analog, Digital, and Scan ICs
-- fedora-list mailing list fedora-list@redhat.com To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
-- fedora-list mailing list fedora-list@redhat.com To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
The bottom line is that a VPN could work, but Comcast can also block it. They don't mind if their subscribers occasionally use a VPN client to check email from home, for online banking, etc. They don't want permanent VPN connection to outside resources. That's what Comcast@Home Pro is for, which is what the FAQ posted previously refers to. For more info, see the article below or just google "comcast vpn"
http://archive.infoworld.com/articles/op/xml/00/09/04/000904opfoster.xml
Larry
from current comcast support site:
FAQs : Connection : Troubleshooting Can I use a VPN connection on the Comcast High-Speed Internet Service?
Yes, you can utilize a VPN connection as a residential customer on the Comcast High-Speed Internet Network. However, it is important to note that Comcast Customer Care cannot provide technical support for your VPN connection. For help setting up, using or troubleshooting your VPN connection, please contact your company's IT department or VPN provider.
If you are able to browse web pages, send and receive your Comcast.net E-Mail, but are unable to use your VPN, the problem is not with your Comcast High-Speed Internet connection. Please contact your VPN provider for assistance.
On Sat, 21 Feb 2004, mylist@gmx.net wrote:
Unfortunately, Comcast has another restriction for residential customers on their networks - no VPNs! :-(
Larry
I am planning on running a Virtual Private Network from my Fedora firewall out to a UML virtual colo (running RH9) at another site. That site will be the place I present services to the world; httpd, ssh, sftp, smtp. This is to comply with the "no servers" and dynamic ip restrictions on my Comcast connection to the net; if my firewall always drives an outbound connection to the colocation site, I am not worried about changes of ip address, and I am not opening any inbound ports.
There are a number of options for the VPN - the most attractive are cipe ( http://sites.inka.de/sites/bigred/devel/cipe.html ) and FreeSwan ( http://www.freeswan.org/ ), though I am told that one can do all this through an ssh tunnel. I would rather have simple and secure than super-duper; I have plenty of bandwidth, and will send outbound http and smtp from the firewall, so the main bandwidth user will be incoming spam/b/b/b/b mail.
Anyone have some experiences to share about setting up VPN? Is there anything about either cipe or FreeSwan that is likely to break with FC1 or FC2?
Keith
-- Keith Lofstrom keithl@ieee.org Voice (503)-520-1993 KLIC --- Keith Lofstrom Integrated Circuits --- "Your Ideas in
Silicon"
Design Contracting in Bipolar and CMOS - Analog, Digital, and Scan ICs
-- fedora-list mailing list fedora-list@redhat.com To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
-- fedora-list mailing list fedora-list@redhat.com To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
-- fedora-list mailing list fedora-list@redhat.com To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
On Feb 20, 2004, Keith Lofstrom keithl@kl-ic.com wrote:
There are a number of options for the VPN - the most attractive are cipe ( http://sites.inka.de/sites/bigred/devel/cipe.html ) and FreeSwan ( http://www.freeswan.org/
Cipe is probably not a good idea, as FC2 apparently won't have cipe built into it. IPsec is probably the way to go, if you have fixed IP addresses on both ends. If one of them has dynamic IP addresses and you'd like to be able to reach it from the end with fixed IP addresses, you may be in for some interesting challenges. I'm still trying to figure out how to do that myself, to enable me to reach my home network (on a dynamic IP) from the university. There are several ugly ways to accomplish them, but none of them are as easy as cipe's dynamic IP handling. The one option I'm looking into is unencrypted vtun over encrypted IPsec, but vtun isn't in the distro either :-(
Keith,
I looked at freeswan and IPsec as well as doing SSH tunnels, and the best software I found for a quick and simple yet secure VPN is OpenVPN.
Its easy to set up, they have RPMs for everything you need (except for one thing which you can get off freshrpms) and it works REALLY well.
I run a VPN between here and an office in Moscow and it was fairly trivial to get working. Just follow the documentation closely.
The thing with FreeSwan and others is that they are very complicated and/or use bizzare protocols such as GRE which sometimes get filtered.
OpenVPN just uses UDP for encapsulation, and TLS for the session negotiation and OpenSSL for the encryption, so its very straightforward. You can also set up a floating endpoint with no problems.
Hope this helps,
\n
On Feb 21, 2004, at 9:44 AM, Keith Lofstrom wrote:
I am planning on running a Virtual Private Network from my Fedora firewall out to a UML virtual colo (running RH9) at another site. That site will be the place I present services to the world; httpd, ssh, sftp, smtp. This is to comply with the "no servers" and dynamic ip restrictions on my Comcast connection to the net; if my firewall always drives an outbound connection to the colocation site, I am not worried about changes of ip address, and I am not opening any inbound ports.
There are a number of options for the VPN - the most attractive are cipe ( http://sites.inka.de/sites/bigred/devel/cipe.html ) and FreeSwan ( http://www.freeswan.org/ ), though I am told that one can do all this through an ssh tunnel. I would rather have simple and secure than super-duper; I have plenty of bandwidth, and will send outbound http and smtp from the firewall, so the main bandwidth user will be incoming spam/b/b/b/b mail.
Anyone have some experiences to share about setting up VPN? Is there anything about either cipe or FreeSwan that is likely to break with FC1 or FC2?
Keith
-- Keith Lofstrom keithl@ieee.org Voice (503)-520-1993 KLIC --- Keith Lofstrom Integrated Circuits --- "Your Ideas in Silicon" Design Contracting in Bipolar and CMOS - Analog, Digital, and Scan ICs
-- fedora-list mailing list fedora-list@redhat.com To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
On Sat, 2004-02-21 at 23:25, Nathan Ollerenshaw wrote:
Keith,
I looked at freeswan and IPsec as well as doing SSH tunnels, and the best software I found for a quick and simple yet secure VPN is OpenVPN.
Its easy to set up, they have RPMs for everything you need (except for one thing which you can get off freshrpms) and it works REALLY well.
I run a VPN between here and an office in Moscow and it was fairly trivial to get working. Just follow the documentation closely.
The thing with FreeSwan and others is that they are very complicated and/or use bizzare protocols such as GRE which sometimes get filtered.
OpenVPN just uses UDP for encapsulation, and TLS for the session negotiation and OpenSSL for the encryption, so its very straightforward. You can also set up a floating endpoint with no problems.
Hope this helps,
Do you know if this will work with a standard corporate firewall? The MS Admins where I work block SSH but let Telnet!
Looking at the OpenVPN expample they have this simple setup:
On may: openvpn --remote june.kg --dev tun1 --ifconfig \ 10.4.0.1 10.4.0.2 --verb 9
On june: openvpn --remote may.kg --dev tun1 --ifconfig \ 10.4.0.2 10.4.0.1 --verb 9
The problem with this is that I want to have a VPN from my home network to my corporate desktop. The work desktop does not have an Internet addressable IP/name. My home PC has a dynamic IP although I use dydns.org so I can always get to it. So how would I enter the --remote name/IP for my corporate desktop from home?
I guess I could use SSH on another port, though a VPN would have more utility and let me mount samba shares from my home FC1 desktop to my work FC1 desktop.
Jim Drabb
On Sun, 2004-02-22 at 13:37, James Drabb wrote:
Do you know if this will work with a standard corporate firewall? The MS Admins where I work block SSH but let Telnet!
Looking at the OpenVPN expample they have this simple setup:
On may: openvpn --remote june.kg --dev tun1 --ifconfig \ 10.4.0.1 10.4.0.2 --verb 9
On june: openvpn --remote may.kg --dev tun1 --ifconfig \ 10.4.0.2 10.4.0.1 --verb 9
The problem with this is that I want to have a VPN from my home network to my corporate desktop. The work desktop does not have an Internet addressable IP/name. My home PC has a dynamic IP although I use dydns.org so I can always get to it. So how would I enter the --remote name/IP for my corporate desktop from home?
I guess I could use SSH on another port, though a VPN would have more utility and let me mount samba shares from my home FC1 desktop to my work FC1 desktop.
Jim Drabb
Jim,
You could look at the August 2003 issue of Linux Journal. There is a solution to a similar problem solved using a program called vtun.
As for tunneling SMB through SSH, it works.
Travis
I am planning on running a Virtual Private Network from my Fedora firewall out to a UML virtual colo (running RH9) at another site. That site will be the place I present services to the world; httpd, ssh, sftp, smtp. This is to comply with the "no servers" and dynamic ip restrictions on my Comcast connection to the net; if my firewall always drives an outbound connection to the colocation site, I am not worried about changes of ip address, and I am not opening any inbound ports.
There are a number of options for the VPN - the most attractive are cipe ( http://sites.inka.de/sites/bigred/devel/cipe.html ) and FreeSwan ( http://www.freeswan.org/ ), though I am told that one can do all this through an ssh tunnel. I would rather have simple and secure than super-duper; I have plenty of bandwidth, and will send outbound http and smtp from the firewall, so the main bandwidth user will be incoming spam/b/b/b/b mail.
Anyone have some experiences to share about setting up VPN? Is there anything about either cipe or FreeSwan that is likely to break with FC1 or FC2?
Keith
I think you can found all info about Fedora in this post about VPNs https://www.techtimes.com/articles/245819/20191027/the-best-vpn-services-wha.... I hope it's will help you protect your problem.
-
Alexandre Oliva -
Claire Filloux -
James Drabb -
Keith Lofstrom -
mylist＠gmx.net -
Nathan Ollerenshaw -
ToddB -
Travis Fraser