topic SSL VPN in Operating System - Linux

SSL VPN

Renjith Nair — Wed, 22 Feb 2006 00:25:08 GMT

Can anybody tell me how to implement SSL VPN in linux. Iam having RHEL 4.0, and what are the difference b/w IPsec and CIPE.

thanks for all

Re: SSL VPN

Vitaly Karasik_1 — Wed, 22 Feb 2006 02:52:27 GMT

SSL VPN - you can start with
http://openvpn.net/ OpenVPN is a full-featured SSL VPN solution

As for IPSEC vs. CIPE - as far as I see, IPSEC is more standardised and more popular.

Rgds,
vitaly

Re: SSL VPN

Renjith Nair — Wed, 22 Feb 2006 04:24:53 GMT

but what is the main advantage of this SSL VPN. Can i use it on a web browser and access my local network from any where. Please tell me specifically and will this openvpn supports RHEL 4

thanks

Re: SSL VPN

kcpant — Wed, 22 Feb 2006 04:35:26 GMT

Hi Renjith,

As I understand, SSL VPN is meant for Web browser based access to the applications & resources, based on HTTPS protocol. So, may be the openvpn solution can suffice your requirements for browsing application remotely.

Re: SSL VPN

Vitaly Karasik_1 — Wed, 22 Feb 2006 05:07:52 GMT

Unlike other SSL VPN solutions, openvpn needs openvpn client on remote machines ("OpenVPN is not a web application proxy and does not operate through a web browser.")

As far as I see, openvpn is user-level applications, so it should work with RHEL4.

Re: SSL VPN

Renjith Nair — Wed, 22 Feb 2006 06:01:27 GMT

can i use open ssh to use compatible with web browsers.

Re: SSL VPN

Ivan Ferreira — Wed, 22 Feb 2006 07:22:13 GMT

See the attached pdf file.

Re: SSL VPN

Ivan Ferreira — Wed, 22 Feb 2006 07:25:39 GMT

See attached pdf file.

Re: SSL VPN

iliviu — Thu, 23 Feb 2006 04:01:41 GMT

I did not use CIPE so maybe this answer is a little bit out of subject, but since I invested some time in using these technologies I hope these lines will be useful to someone.

I used both SSL and IPSec VPN on FreeSBD (but the general ideas should be the same on Linux too) so I can forward you my results :

IPsec:
1+ It is standard protocol implemetned in a vast range of equipments (routers, vpn-concentrators, operating systems, etc).
2+ It does not need a software application for client acces (it is implemented in Windows and of course in *x, *BSD, etc)
3- It is rather hard to configure (at least it was for me on FreeBSD with Windows clients)
4- You have to rely on another VPN technology for building a virtual interface (this depends on the implementation you use tunnel vs transport mode). It is advisable to use L2TP/IPsec but I used it like PPTP/IPsec.
5- You may experience severe problems with clients behind NAT (you have to use transport mode and the implementations/standardization of NAT-Traversal is different upon various operating systems).

SSL VPN (OpenVPN):
1- It is not standardized (which means you have to stick around to one solution both on client and server).
2- It needs a client application (but OpenVPN it is supported on various platforms , including Windows and can be configured to run transparently for the user).
3+ It is very easy to configure.
4+ It is using a tun/tap device. So it builds automatically a tunel between the client and the server.
5+ You have no problems with NAT. It works on TCP or UDP with the advantage that implemented on TCP you can even use it through a proxy server. It supports even bridge mode which is a great advantage (for example I used it like such for exporting IPv6 support to clients too).

I hope these ideas will be useful for you, and I hope they are correct. This is the outcome of my practical work with both these technologies SSL and IPsec VPN.

L.