Re: Which VPN solution is best Practice

On Sun, Sep 12, 2004 at 01:25:07PM -0500, Bill Yazji wrote:
> Your question is quite loaded....
> 
> There is no "one answer" or a solution that fits all cases.....
> 
> IPSec is probably the safest VPN method in my opinion...

I'd have to say that from your description, IPsec sounds pretty
appropriate, too.

As long as the sites don't need to talk to each other... then IPsec
becomes complicated (although there are ways around that :)

> -----Original Message-----
> From: [email protected]
> [mailto:[email protected]] On Behalf Of stu
> Sent: Sunday, September 12, 2004 11:07 AM
> To: [email protected]
> Subject: [VPN] Which VPN solution is best Practice
> 
> With all the options out there for linux, IPSec, PPTP, SSL Tunnel etc Which
> is best "safest" free vpn to use.
> 
> I want to be able to link mulitple satelite offices to a head office, where
> they will connect to a central server for services.
> 
> Each office will have ADSL connecting to the internet and Dynamic IP
> addresses, although I can use dynamic update client to make sure the domain
> name for each site gets updated as the ip changes. 
> So that is probably a consideration for the choice, needs to support domain
> name and not ip address.

Not necessarily.

If you were using IPsec, you could say "allow connections from any IP
address" on the head office box, and then make the satellite offices
initiate the IPsec session.

Only problem there is when (if?) your IPsec implementation becomes
remotely exploitable, it's listening on the public internet for
connections from anywhere (although I guess you could constrain it to a
set of netblocks, related to the ISP(s?) that the branches use).

One of the *S/WAN forks (OpenS/WAN might be worth a try) should be able
to handle this situation pretty well.

-- 
Russell Howe       | Why be just another cog in the machine,
[email protected] | when you can be the spanner in the works?