VPN on VMS

[DECxchange]

Hello,
Is it possible to set up a VPN connection directly between two Alphas located at two different sites? Can one of those sites be residential?

I'm using OpenVMS 8.3 on each and running TCP/IP services. I'm also running DECnet Phase V.

Thanks.

[Jon Pinkley · Accepted solution]

Re: "Is it possible to set up a VPN connection directly between two Alphas located at two different sites?"

It depends on your definition of VPN. You can use SSH but I am not aware of any way to tunnel DECnet phase V through an SSH connection. Perhaps Colin Butcher knows of a method.

According to the OpenVMS roadmaps IPSec is coming, but not for a while (2009). http://h71000.www7.hp.com/openvms/roadmap/openvms_roadmaps.htm?jumpid=/go/openvms/roadmaps

I assume you want the two Alphas to be able to communicate using DECnet Phase V vs. just having a user on one Alpha SSH to the other Alpha over the internet.

Re: "Can one of those sites be residential?"

What is different about residential? Dynamic ip address? ISP filtering? Please explain.

Depending on what your requirements are, SSH may be good enough. If you want LAN to LAN (aka Site to Site) VPN, you should at least consider using dedicated devices for the VPN.

Linksys BEFVP41's are "consumer grade" Routers that act as IPSec VPN endpoints. They work reasonably well. As long as one end has a static IP address, they can maintain a VPN connection, and reestablish a new one even if the dynamic IP address is changed. They have hardware encryption chips so the performance is better than for the cheaper Linksys BEFSX41 that does VPN in software. The BEFVP41 are around $110 each, and you will need one on each end. They have ethernet connections for the WAN and LAN (4-port switch), so you will need something that has ethernet handoff.

A similar device I have never used is the D-Link DI-804HV, which is cheaper than the BEFVP41 and gets better reviews on Amazon than the BEFVP41, but it is a discontinued product.

For more money (around 5 times as much) you can get more flexible devices like the Cisco871-SEC-K9, but setting them up without a static IP at each end is more involved.

Jon

[DECxchange]

Jon,
Great info. Thanks. I have AT&T DSL at home and Cavalier DSL at the shop. DECbet copies would be great but I'll settle for TCP/IP stuff.

I also have a buddy in Sweden. It would be nice to be able to let him login with his VAXstation.

I was going to talk to AT&T about it, but it's kind of painful because they only know about PC stuff.

Thanks again.

[Robert Gezelter]

DECxchange,

You should also take a look at the STunnel support. OpenVMS STunnel (available for all three architectures: Itanium, Alpha, and VAX) is described on the HP OpenVMS www site at: http://h71000.www7.hp.com/opensource/opensource.html#stunnel

From the Release Notes (available from the above URL):

"SSL for OpenVMS product is a port of OpenSSL (www.openssl.org) to OpenVMS Alpha & I64. This is a supported layered product that ships with OpenVMS version 7.3-1 or later. The kit also can be downloaded from the HP OpenVMS web site http://h71000.www7.hp.com/openvms/products/ssl/ssl.html)."

- Bob Gezelter, http://www.rlgsc.com

[Hein van den Heuvel]

If I read your question correctly, then I'm afraid my answer will not help much.
On the other hand... if you just want 'simple' access to an OpenVMS server at home from the outside, then you may be able to convince your (DSL) router to do the right thing.
When I needed this once, while travelling, I used a port map defintion to poke a tiny hole through the firewall into the right local target.
You may also check out the 'DMZ' options on the router. Again, sorry if this is too simplistic, but just in case...

fwiw,
Hein.

[Steven Schweda]

Why a VPN? What's wrong with plain old
Telnet, rsh, ssh, and so on?

So far as I know, TCPIP knows nothing about
VPNs, but if you have external gizmos which
provide one, it dosn't need to know anything
about them. One IP router looks the same as
another to it.

> Can one of those sites be residential?

Why should VMS care? antinode.org is
entirely residential, with a DSL connection
through a Cisco 678 DSL modem/router (which
seems to be much more suitable than the junk
which Qwest is offering nowadays).

> I also have a buddy in Sweden. It would be
> nice to be able to let him login with his
> VAXstation.

What stops him now? Your DSL gizmo? (Which
is what, by the way?) If you have a DSL
modem/router, or a DSL modem with a separate
IP router, then you should be able to tell
the (NAT-capable) router to pass FTP (ports
20,21), ssh (port 22), Telnet (port 23),
rexec,rlogin (ports 512,513), X (ports 6000,
6001, ...), and so on to the machine of your
choice. I routinely log into my main Alpha
from other sites, usually by Telnet. (It
also does DNS and SMTP, and the FTP and HTTP
servers.)

> DECbet copies would be great but I'll
> settle for TCP/IP stuff.

I don't use it, but I gather that DECnet Plus
can do DECnet over IP.

It often helps to (define and) state your
actual requirements, rather than ask how to
implement what may be the wrong solution (a
VPN).

[M. T. Hollinger]

Note that IPsec is already available from HP for OpenVMS in early adopter's kit (EAK) form, but not for the VAX platform. SSH is fully supported, including port forwarding, for Alpha and Integrity systems.

Particularly for a home configuration involving an old VAXstation, I'd agree with the other responses that the easiest way to set up a VPN (if you actually need one) would involve consumer-grade router boxes.

- Mark

[DECxchange]

Hello,
Thank for you for all of your responses, advice, and interest. As Steve pointed out, here is my situation.

At home, I have DSL through AT&T. I have a 2-Wire 2701HG-B Gateway. The 2-wire allows me to implement DMZ for one computer on the inside of its Firewall.

So in order for me to serve web pages with my Alphaserver OpenVMS 8.3 eBusiness web server, I set the DMZ for the Alpha's DHCP assigned (by the 2-Wire) IP address.

This is changing the subject al little, but tne trouble is, I'm using dynamic IP addressing. Static would cost me an additional $69/month, in addition to the $24/month just to have DSL. So you can see why I wouldn't buy static!!!!

BTW, so every time the DSL line drops and comes back, I the 2-wire assigns a new address to the DMZ computer, which is no longer the Alpha's IP name (e.g., decxchange.com). It assigns DMZ to .2wire.com or something like that.

So to fix this, I need to shut down and restart TCPIP services on the Alpha, reassign DMZ on the 2-wire, then go to AT&T's "Small Business" web site, and reassign address forwarding.

This happens WAY to often, and I just don't have time to babysit it. OK, so that's another issue that needs to be fixed. Back to the subject at hand.

On the other end, a small business in town, they have DSL through a company called Cavalier. It looks like he has just a DSL modem given to him by Cavalier. So I was going to call Cavalier next week and find out how his IP addresses are assigned to his PCs and what kind of firewall (if any?) is in use.

So I wanted to put another one of my Alphas in his busines's shop and set up either or both a TCP/IP and DECnet OSI Phase V link between home and his shop. I wanted to setup a web site that Alphas at either location could be a backup to each other.

Now all of your ideas look promising and I'm going to investigate them. I still have a lot to learn at this level of internet setup, as you probably can see.

Thanks for having a constructive conversation with me. Any other useful comments are welcomed.

[Andy Bustamante]

You may want to consider a dynamic DNS provider, http://www.dyndns.com. You'd need another system on the internal network to provide the update agent.

Can you configure your DSL unit to forward to the Alphaserver's address? Have you considered using static private addressing in your DMZ, this could allow you to set static rules.


Andy

[Steven Schweda]

> [...] the Alpha's DHCP assigned (by the
> 2-Wire) IP address.

That would seem to be the first thing to
change. I don't see how NAT will be able to
locate a moving target. Around here, all the
normal systems have static (10.0.0.x) IP
addresses. The Cisco 678 is configured to
offer DHCP (at 10.0.0.224 - .239) for
transient client-only systems who happen to
visit. Anything which wants to be a server
of any sort should have a static address, at
least internally.

> Static would cost me an additional
> $69/month [...]

Do I have the only good ISP in the country?

Having been at 209.98.249.184 for years, I
don't need to worry about it, but I gather
that a dynamic DNS provider can be used to
cope with a changing external address.
Internally, it's up to you to create a stable
environment.

I have a couple of friends with Cable TV or
DSL who have only simple-minded non-routing
Cable or DSL modems, but they also have them
connected to (cheap and nasty) IP routers,
which gives them capabilities similar to
mine.

[DECxchange]

>You may want to consider a dynamic DNS
>provider, http://www.dyndns.com. You'd >need another system on the internal >network to provide the update agent.

That sounds like a good option. Is that the free service they're offering? What I'm a little consfused about is how it keeps track of old dynamic addresses that I once used, since these old addresses may end up being used by somebody else?

>Can you configure your DSL unit to forward > to the Alphaserver's >address?

Not sure exactly. The this 2-wire DSL modem works is that it has a firewall menu system I can access by entering its IP address. It has a DHCP server in it. It allows you to pick one computer on your network to put it in DMZ mode (allow any protocol through its firewall). You can setup certain ports, but I tried that and it doesn't seem to work. The problem with its DHCP program is it reassigns things autmoatically when the DSL line blips. Maybe AT&T is doing this on purpose so you can't permanently grab a particular dynamic address?

> Have you considered using static private >addressing in your DMZ, this could
>allow you to set static rules.
I don't know what you mean by "static private addressing in your DMZ". DMZ mode as I'm using it here, just means that it allows one computer to be the DMZ computer and that computer will receive any network traffic through the firewall. All other computers on the network (i.e., PCs will only receive HTTP traffic via a browser (like MS Internet Explorer, or AOL, for example).


>Andy

[DECxchange]

It seems that the following that Bob wrote might be the ticket. I'll have to see if this is on the OpenVMS 8.3 eBusiness Product Suite CD. Thanks for the tip!

!!!!
You should also take a look at the STunnel support. OpenVMS STunnel (available for all three architectures: Itanium, Alpha, and VAX) is described on the HP OpenVMS www site at: http://h71000.www7.hp.com/opensource/opensource.html#stunnel

From the Release Notes (available from the above URL):

"SSL for OpenVMS product is a port of OpenSSL (www.openssl.org) to OpenVMS Alpha & I64. This is a supported layered product that ships with OpenVMS version 7.3-1 or later. The kit also can be downloaded from the HP OpenVMS web site http://h71000.www7.hp.com/openvms/products/ssl/ssl.html)."

- Bob Gezelter, http://www.rlgsc.com
!!!!

[DECxchange]

Steve, great information:
>
>That would seem to be the first thing to
>change. I don't see how NAT will be able to
>locate a moving target.
The 2-wire modem I have was supplied by AT&T when I first joined up to their DSL last March. I've asked them for a simpler modem that doesn't diddle with my network (which they don't have supposedly). But they don't understand the problem. They are just a bunch of phone jockeys out of India who can answer PC related questions. I have nothing against India, I think they're nice people. I just want my DSL signal to stay up, that's all. BTW, they're local technicians are responsive and helpful fixing problems, but I have to prod them. They just don't fix them unless somebody is complaining.

>Anything which wants to be a server
>of any sort should have a static address, >at least internally.
Like I said, I don't know how much more stable I can get my internal network. My Alpha never goes down. The DSL line does. It's gotten a lot better because I've kept their feet to the fire. but it still has a ways to go. So theoretically, if they can keep the DSL up, my dynamic address would stay the same, right? Or are they doing this on purpose for some reason?

>Do I have the only good ISP in the country?
Do tell! Who are they?

>Having been at 209.98.249.184 for years,
Wow, that's great. After all, we expect the electric power grid, the (voice) phone lines, the water treatment plants and water pressure to be available 24X7X365.25, why can't DSL do the same? Especially since AT&T brags on TV commercials to allow net meetings in 5 different locations around the globe?

>I have a couple of friends with Cable TV or
>DSL who have only simple-minded non-routing
>Cable or DSL modems, but they also have >them connected to (cheap and nasty) IP >routers, which gives them capabilities >similar to mine.
Would it be too much to ask to find out some brand names and model #s they're using?

Great. Thanks for your help. I'm learning a lot here.

[DECxchange]

Here is the IPsec EAK suggested by M.T. Hollinger, out since August 2007:

http://h71000.www7.hp.com/openvms/products/ipsec/?jumpid=reg_R1002_USEN

I think I'll give this a try first since it is for OpenVMS 8.3. I'll let you know how it works. I may not know until sometime next week.

Thanks guys. Keep posting if you like.

[Steven Schweda]

> [...] I don't know how much more stable I
> can get my internal network.

By "stable", I meant "stable", not
"reliable". That is, the IP address of a
server should be static, not dynamic.

> Do tell! Who are they?

visi.com, but they're probably too local to
be useful to you. The do offer a static IP
address at no extra cost. There's an
occasional outage, but I'm always at the same
external address when there's any service at
all. Internally, as I said, every normal
system has a static address, too. (Alp, the
main Alpha system is 10.0.0.9, for example.
The Cisco 678 directs most (but not all)
external requests to it.)

> Would it be too much to ask to find out
> some brand names and model #s they're
> using?

Yup. Some Linksys thing, some other thing --
whatever was cheap at the local Micro Center
store when the need arose. Everything seemed
to be as NAT-capable as needed. My friends
tend not to run servers at home, but I've
gotten X through to the PC or Mac I was
trying to use when I needed to, and I assume
that if port 6000 or 6001 works, then 23 or
80 should be possible, too.

> You can setup certain ports, but I tried
> that and it doesn't seem to work.

That sounds like the thing to be doing. A
quick Google search found a spec sheet on a
2701HG-E (not "-B"), and what looks like a
user's guide.

http://www.2wire.com/?p=106
http://www.2wire.com/pages/pdfs/5100-000562-000_2W_Rev_A_0107.pdf

http://www.2wire.com/?p=266
http://www.2wire.com/pages/pdfs/5100-000326-000.Rev.A.pdf

[...]
NAT/PAT Support
· Standard NAT/PAT between LAN and WAN
· Automated NAT Pass-Thru for LAN client-initiated VPN tunnels
(IPSec, PPTP, L2TP), SIP, H.323, RTP
· Easy to configure NAT pass-through (pinholes) for common
applications (games, servers, etc.)
· DMZplus for automatic WAN IP assignment to a local PC
[...]


I think that you don't want the DMZplus
thing, but without a gizmo in hand for
experimentation, my opinion may have little
value. The "pinholes" approach sounds like
what I do (for a lot of pins).

[DECxchange]

Steve,
Yep, I looked at that reference you saw on Google before. I set it up that way and it didn't seem to work. Of course, I didn't spend a whole lot of time on it. It was easier to go ahead with DMZplus. Of course, I don't like that either, but I let VMS deal with it. And, the 2-wire blocks incoming traffic for the PCs on my network. besides, I would just shut certain things off in TCPIP$CONFIG if I needed to.

I had planned on one day revisiting opening particular ports instead of DMZplus.

That's interesting that your provider was nice enough to give you a static IP address. I think if AT&T did this, the problem would be solved completely, don't you think?

Thanks again.

[Steven Schweda]

> [...] I think if AT&T did this, the problem
> would be solved completely, don't you
> think?

I try not to. But no, a static external
address lets you do external DNS easily (I
do my own, in fact), but that makes no
difference to what happens on your internal
LAN. The whole NAT-PAT situation remains the
same.

[Doug Phillips]

DECxchange,

Re: dyndns.org

To use these services, you don't connect remotely via the IP address, but via a static sub-domain name (hostname) which aliases to your dynamic IP.

When you set up an account there, you choose a hostname to use with one of their domain names, such as "myhostname.dyndns.org" and use that. They have some other domain name choices if you don't like dyndns.org, or you can buy your own domain name.

At your host end, you run an "update client" that notifies dyndns.org when your IP changes, and they change the alias to the new IP. There are free downloadable update clients for Win/Linux and Opera at the dyndns site, and google will find others. Some routers have one built-in, but my Linksys' dyndns function doesn't seem to actually work.

Dyndns has a free service that requires you to update at least once per month to keep the name active. If your IP hasn't changed, so you haven't updated, they're even nice enough to send you an email with a handy "click here to keep your account active" link. A premium account that removes that requirement is fairly inexpensive, but it's hard to beat free unless you need some of their other services.

I use dyndns to connect to my home system when I'm "on the road" and found it to work well.

-Doug

[DECxchange]

Steve,
That's OK, you don't have to if you don't want to ;)

Doug,
Thanks for the additional info on dyndns. I'll have to give it a try.

[V. Nyga]

@Steve,
could you check this thread PLEASE :-)
http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1182224
V.

[Jon Pinkley]

DECxchange,

As Steven said in another thread: "Everything's complicated."

I skimmed the documentation in the VMS IPSec EAK. I see nothing about NAT traversal.

Google for NAT IPSec and you will find many hits describing how IPSec and NAT interact.

Bottom line: I don't think you will be able to get it to work without reconfiguring both ends every time either IP address changes. Specifically, the setup uses numeric IP addresses, not FQDN (fully qualified domain names) for the endpoints.

So even if you have an external DNS (e.g. dyndns) that can be changed automatically when your ISP assigns you a different IP address via PPPoE, the IPSec configuration will need to be changed.

There is a reason businesses are willing to pay for static IP addresses, it is cheaper than dealing with the problems dynamic addresses cause.

More details: NAT and IPSec don't mix well. AH (Authentication Header) absolutely will not work. ESP in Tunnel mode can work as long as the implementation supports NAT-T (NAT traversal) and the routers between the systems are not blocking the required protocols/ports; if the routers at each customer premise (i.e. your 2-Wire) support IPSec passthrough, then NAT-T should work. But the EAK documentation doesn't mention it, so it may or may not support it. Here's a reasonably readable description of what IPSec is
http://www.unixwiz.net/techtips/iguide-ipsec.html See the section "AH and NAT - Not Gonna Happen" for the technical reasons that it will not work.

Ok, I am finally going to get to my point.

If all you need is the ability to connect to the other system, and you want to do so in a manner that will prevent something on the route between the endpoints being able to see your packets in clear text, then something like SSH is the most straightforward way to achieve that. SSH and SSL are NAT friendly, so your 2-wire can be set up to allow NAT to a fixed inside IP address. For copying files between systems, you have several choices. The easiest is FTP, but that is not secure, and even the passwords are send in clear text. You can encrypt the data before you send it, or you can use tools like scp or SFTP.

If you do decide to try the IPSec EAC, I would highly recommend getting it working with fixed IP addresses on the same LAN first, then tackling the other problems one at a time. You will definitely learn the most by doing the IPSec on the Alpha, but you will spend a considerable amount of time, and if you have a real job, you would be more likely to get a dedicated box that connects directly to your ISP (without NAT interference) working much more easily than using the IPSec EAK.

The BEFVP41 has a mode that allows the "remote gateway" to be specified using a FQDN, so in theory, you should be able to establish a connection between two BEFVP41's that have dynamic ip addresses. I have never used that mode, since the spokes always connected to a BEFVP41 with a static IP address.

However, I believe the built in dyndns support is broken in the BEFVP41 (it registers every time it goes through a PPPoE negotiation, even if it is given the same external IP address. dyndns.org will disable accounts that do this very often. There are ways around that problem, specifically a PC can run an application that can determine that the external IP address has changed (by asking a external system what ip address the connection is coming from) and then using that information to update the dyndns.

One downside of the BEFVP41; Technical support is essentially non-existent. Linksys was bought by Cisco, and Cisco has little incentive to compete with their IOS routers. The latest firmware for the BEFVP41 is from Jan 2005, and there are unresolved bugs.

Good luck,

Jon