Calling all VPN gurus...

[chipzoller]

I'm rather new to setting up and administering VPN connections so got the O'Reilly book on VPNs and am reading other things as I find them. I know what they are and what they do etc. etc.

But I find myself for the first time needing to set one up at a business who uses Bellsouth (thus the Netopia router that comes with their commercial service, which BTW is not an IPSec or otherwise special VPN router) and a VPN connection on a Win. XP pro machine on the LAN.

I'm just curious as to what other VPN-gurus think is the best solution for a VPN connection...just use PPTP (I know many prefer IPSec, but I understand that it's virtually impossible to set up if you don't have a special VPN-IPSec enabled router) through the standard set-up of VPN in Windows XP? I have done this, and it does work, but I wonder if this is the best way. I do want to be as secure as the hardware allows but am not sure if this is enough.

I setup VPN for the express purpose of being able to become part of the LAN to use remote desktop to login to other machines and fix them, not for any standard business practice reason like being able to joint conference, or access company servers, databases, applications etc. I figured this would be more secure than just forwarding those remote desktop ports on the router, which the clients aren't running any firewalls (for simplicity reasons inside the LAN as it might conflict with software, and I prefer to eliminate this aggrivation if at all possible) and have some outsider hammer the machine.

Have I just complete gone wrong here? Am I just an idiot?

Thanks for any suggestions/comments,


Chip

[Neo Neko]

IANAVPNG
But I can suggest this. SSH with port forwarding. It is rather simple and quite effective. If you are running any sort of *nix systems probably including OSX SSH is included. If not http://www.freesshd.com/ should cover you for Windows. Set up one system as the daemon and point port forwarding of port 22 to the system you want to use as your gateway.

Once you have it figured out it is quite simple and effective. You just SSH to the gateway system and with the propper port forwarding access any and all systems on the remote network. You can further automate things by writing batch files or shell scripts. And setting up a login key so you don't have to provide user and pass every time. Not to mention the key is more secure anyway. Enable SSH compression and even VNC or Windows Remote Desktop become usable even over dialup. :D

I have mine set up so I can VNC into my *nix boxes KDM or GDM login screens . Windows as well. But it is not as cool. Under *nix each VNC login gets it's own individual desktop. Not a shared one like windows. Which means that someone can be sitting at the console using the desktop of their choice. And I can VNC in and get my own desktop. No fighting over mouse input or keyboard input. In fact the person sitting at the console might never know I was logged in unless I did something like sending out an administrative alert and reboot the system. I can also provide shell-less logins for friends and family to share files and even stream music and live television. :D And to the outside network all that shows is port 80 for apache and port 22 for SSH. It is very sweet.

But it might not be robust enough for widespread use or rather large networks. But for remote administration it is sweet. I can trouble shoot my dad's Mandriva system remotly without even interrupting him most times.

[chipzoller]

Ok, you'll probably have to explain a bit step-by-step seeing as how we're only dealing with a DSL router and a WinXP box that will act as the incoming VPN server.

So you're suggesting I forward port 22 on the router to the box that SSH is listening on. How does this relate to a VPN connection? I downloaded and installed FreeSSHd to play around with but haven't really experienced anything like this.

I'm afraid I'm well thick on this part seeing as how I'm not an experienced VPN-er, but if you give me some more info. I'm sure I can set it up.

thanks,


Chip

[Neo Neko]

Well honestly I have not used freesshd myself. I am lucky enough to have *nix boxes to work with. So everything tends to be all set up and ready to go from the get go. I would suggest reading their provided documentation and the freesshd forums.

At the most basic level ssh is alot like telnet. Save for the fact that it is encrypted. If you don't know what telnet is it's a program that allows you login and obtain a remote shell over a network. The shell being alot like the old DOS prompts. You can run programs etc from this shell but can only view the output back to the shell. Not the GUI if it is avalible. So its prety basic and not very secure. SSH besides being encrypted also allows for port forwarding via SSH. The best way to explain it is like tunneling. All you open up on your destination firewall/router is port 22. But you can route all sorts of traffic through it from the local network to the remote network. That is where things start to get interesting. You can forward ports on your system to any port on the remote system or any computer on the same network.

A basic example. A host on the remote network 10.0.0.10 has a VNC server running. You want to connect to it to do some administration but not only is port 5800 not forwarded to the system in question it is totally blocked by the firewall. But you have access via port 22 to a computer running a SSHd on the network. So you get your SSH client of choice putty (http://www.chiark.greenend.org.uk/~sgtatham/putty/) being one of my favorites under windows. And set it up. Putty provides a nice GUI with session saving and management. But for simplicitys sake I will give a simple comand line invocation.

putty.exe -ssh -L 8181:10.0.0.10:5800 remotehost.com

This command will open up a SSH connection to remotehost.com and route all traffic from your local port 8181 to port 5800 on the system identified by 10.0.0.10 on the remote network. Once you have logged in start your favorite VNC client on your local system. Connect vnc to port 8181 on your local computer. The VNC login request will be routed to the VNC server on the remote network. And you are up and running.

The documentation at putty's site will show you how to do alot more. Including setting up a dynamic encrypted proxy to the remote network.