VPN on VMS

[DECxchange]

>You may want to consider a dynamic DNS
>provider, http://www.dyndns.com. You'd >need another system on the internal >network to provide the update agent.

That sounds like a good option. Is that the free service they're offering? What I'm a little consfused about is how it keeps track of old dynamic addresses that I once used, since these old addresses may end up being used by somebody else?

>Can you configure your DSL unit to forward > to the Alphaserver's >address?

Not sure exactly. The this 2-wire DSL modem works is that it has a firewall menu system I can access by entering its IP address. It has a DHCP server in it. It allows you to pick one computer on your network to put it in DMZ mode (allow any protocol through its firewall). You can setup certain ports, but I tried that and it doesn't seem to work. The problem with its DHCP program is it reassigns things autmoatically when the DSL line blips. Maybe AT&T is doing this on purpose so you can't permanently grab a particular dynamic address?

> Have you considered using static private >addressing in your DMZ, this could
>allow you to set static rules.
I don't know what you mean by "static private addressing in your DMZ". DMZ mode as I'm using it here, just means that it allows one computer to be the DMZ computer and that computer will receive any network traffic through the firewall. All other computers on the network (i.e., PCs will only receive HTTP traffic via a browser (like MS Internet Explorer, or AOL, for example).


>Andy

[DECxchange]

It seems that the following that Bob wrote might be the ticket. I'll have to see if this is on the OpenVMS 8.3 eBusiness Product Suite CD. Thanks for the tip!

!!!!
You should also take a look at the STunnel support. OpenVMS STunnel (available for all three architectures: Itanium, Alpha, and VAX) is described on the HP OpenVMS www site at: http://h71000.www7.hp.com/opensource/opensource.html#stunnel

From the Release Notes (available from the above URL):

"SSL for OpenVMS product is a port of OpenSSL (www.openssl.org) to OpenVMS Alpha & I64. This is a supported layered product that ships with OpenVMS version 7.3-1 or later. The kit also can be downloaded from the HP OpenVMS web site http://h71000.www7.hp.com/openvms/products/ssl/ssl.html)."

- Bob Gezelter, http://www.rlgsc.com
!!!!

[DECxchange]

Steve, great information:
>
>That would seem to be the first thing to
>change. I don't see how NAT will be able to
>locate a moving target.
The 2-wire modem I have was supplied by AT&T when I first joined up to their DSL last March. I've asked them for a simpler modem that doesn't diddle with my network (which they don't have supposedly). But they don't understand the problem. They are just a bunch of phone jockeys out of India who can answer PC related questions. I have nothing against India, I think they're nice people. I just want my DSL signal to stay up, that's all. BTW, they're local technicians are responsive and helpful fixing problems, but I have to prod them. They just don't fix them unless somebody is complaining.

>Anything which wants to be a server
>of any sort should have a static address, >at least internally.
Like I said, I don't know how much more stable I can get my internal network. My Alpha never goes down. The DSL line does. It's gotten a lot better because I've kept their feet to the fire. but it still has a ways to go. So theoretically, if they can keep the DSL up, my dynamic address would stay the same, right? Or are they doing this on purpose for some reason?

>Do I have the only good ISP in the country?
Do tell! Who are they?

>Having been at 209.98.249.184 for years,
Wow, that's great. After all, we expect the electric power grid, the (voice) phone lines, the water treatment plants and water pressure to be available 24X7X365.25, why can't DSL do the same? Especially since AT&T brags on TV commercials to allow net meetings in 5 different locations around the globe?

>I have a couple of friends with Cable TV or
>DSL who have only simple-minded non-routing
>Cable or DSL modems, but they also have >them connected to (cheap and nasty) IP >routers, which gives them capabilities >similar to mine.
Would it be too much to ask to find out some brand names and model #s they're using?

Great. Thanks for your help. I'm learning a lot here.

[DECxchange]

Here is the IPsec EAK suggested by M.T. Hollinger, out since August 2007:

http://h71000.www7.hp.com/openvms/products/ipsec/?jumpid=reg_R1002_USEN

I think I'll give this a try first since it is for OpenVMS 8.3. I'll let you know how it works. I may not know until sometime next week.

Thanks guys. Keep posting if you like.

[Steven Schweda]

> [...] I don't know how much more stable I
> can get my internal network.

By "stable", I meant "stable", not
"reliable". That is, the IP address of a
server should be static, not dynamic.

> Do tell! Who are they?

visi.com, but they're probably too local to
be useful to you. The do offer a static IP
address at no extra cost. There's an
occasional outage, but I'm always at the same
external address when there's any service at
all. Internally, as I said, every normal
system has a static address, too. (Alp, the
main Alpha system is 10.0.0.9, for example.
The Cisco 678 directs most (but not all)
external requests to it.)

> Would it be too much to ask to find out
> some brand names and model #s they're
> using?

Yup. Some Linksys thing, some other thing --
whatever was cheap at the local Micro Center
store when the need arose. Everything seemed
to be as NAT-capable as needed. My friends
tend not to run servers at home, but I've
gotten X through to the PC or Mac I was
trying to use when I needed to, and I assume
that if port 6000 or 6001 works, then 23 or
80 should be possible, too.

> You can setup certain ports, but I tried
> that and it doesn't seem to work.

That sounds like the thing to be doing. A
quick Google search found a spec sheet on a
2701HG-E (not "-B"), and what looks like a
user's guide.

http://www.2wire.com/?p=106
http://www.2wire.com/pages/pdfs/5100-000562-000_2W_Rev_A_0107.pdf

http://www.2wire.com/?p=266
http://www.2wire.com/pages/pdfs/5100-000326-000.Rev.A.pdf

[...]
NAT/PAT Support
· Standard NAT/PAT between LAN and WAN
· Automated NAT Pass-Thru for LAN client-initiated VPN tunnels
(IPSec, PPTP, L2TP), SIP, H.323, RTP
· Easy to configure NAT pass-through (pinholes) for common
applications (games, servers, etc.)
· DMZplus for automatic WAN IP assignment to a local PC
[...]


I think that you don't want the DMZplus
thing, but without a gizmo in hand for
experimentation, my opinion may have little
value. The "pinholes" approach sounds like
what I do (for a lot of pins).

[DECxchange]

Steve,
Yep, I looked at that reference you saw on Google before. I set it up that way and it didn't seem to work. Of course, I didn't spend a whole lot of time on it. It was easier to go ahead with DMZplus. Of course, I don't like that either, but I let VMS deal with it. And, the 2-wire blocks incoming traffic for the PCs on my network. besides, I would just shut certain things off in TCPIP$CONFIG if I needed to.

I had planned on one day revisiting opening particular ports instead of DMZplus.

That's interesting that your provider was nice enough to give you a static IP address. I think if AT&T did this, the problem would be solved completely, don't you think?

Thanks again.

[Steven Schweda]

> [...] I think if AT&T did this, the problem
> would be solved completely, don't you
> think?

I try not to. But no, a static external
address lets you do external DNS easily (I
do my own, in fact), but that makes no
difference to what happens on your internal
LAN. The whole NAT-PAT situation remains the
same.

[Doug Phillips]

DECxchange,

Re: dyndns.org

To use these services, you don't connect remotely via the IP address, but via a static sub-domain name (hostname) which aliases to your dynamic IP.

When you set up an account there, you choose a hostname to use with one of their domain names, such as "myhostname.dyndns.org" and use that. They have some other domain name choices if you don't like dyndns.org, or you can buy your own domain name.

At your host end, you run an "update client" that notifies dyndns.org when your IP changes, and they change the alias to the new IP. There are free downloadable update clients for Win/Linux and Opera at the dyndns site, and google will find others. Some routers have one built-in, but my Linksys' dyndns function doesn't seem to actually work.

Dyndns has a free service that requires you to update at least once per month to keep the name active. If your IP hasn't changed, so you haven't updated, they're even nice enough to send you an email with a handy "click here to keep your account active" link. A premium account that removes that requirement is fairly inexpensive, but it's hard to beat free unless you need some of their other services.

I use dyndns to connect to my home system when I'm "on the road" and found it to work well.

-Doug

[DECxchange]

Steve,
That's OK, you don't have to if you don't want to ;)

Doug,
Thanks for the additional info on dyndns. I'll have to give it a try.

[V. Nyga]

@Steve,
could you check this thread PLEASE :-)
http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1182224
V.