Re: net-to-net vpn
| Newsgroups | gmane.comp.security.ipcop.user |
|---|---|
| Message-ID | <[email protected]> |
On Tue, June 2, 2015 8:10 am, G.W. Haywood wrote: > I routinely use OpenVPN to implement VPNs which pass through IPCop > machines, but I do not normally run OpenVPN on the IPCop machines > themselves. It is more flexible to run OpenVPN on a machine or > machines inside the firewalled perimeter, and the encryption can > then be handled by a machine easily capable of the encryption > overhead, which can be substantial. A good point regarding overhead. This scheme -- using a machine inside the LAN as a VPN terminal -- is mentioned in the documentation of the Debian OpenVPN package. I found the scheme attractive, but I was reluctant to invest time learning how to configure the internal firewall of a Debian machine, or to learn a firewall configuration tool such as Shorewall. > Set up machines which run OpenVPN to be able to route packets ... > "/bin/echo 1 > /proc/sys/net/ipv4/ip_forward" Where is this documented? I find no man page for "ip_forward". > and then simply poke appropriate holes in the firewall(s) to allow > the traffic. Is anything needed other than to forward port 1194 to the VPN machine? > Machines on the LAN which need access to the VPN(s) > will have routing table entries (for the tunnel IPs) which point to > the OpenVPN machines rather than the default gateway. Is this done internally on each machine which needs access to the VPN? RH ------------------------------------------------------------------------------ _______________________________________________ IPCop-user mailing list [email protected] Manage your subscription or unsubscribe https://lists.sourceforge.net/lists/listinfo/ipcop-user