RE: VPNs over NoCatAuth

Have the users uncheck the "use default gateway on remote network" checkbox
in the adv tcp-ip properties of the VPN connection.

If they need to use the "gw on remote network" to reach hosts through the
vpn that are not on the local segment of the vpn server they can always add
routes for the hosts they need to reach:

route add <host_they_need_to_reach> <ip_they_recieved_in_the_vpn>





-----Original Message-----
From: Brendan Miller [mailto:[email protected]]
Sent: Monday, January 10, 2005 2:44 PM
To: [email protected]
Subject: [NoCat] VPNs over NoCatAuth



There have been a few discussions of VPNs over NoCat, but not many in
awhile,
and none addressing this issue.

I've had a couple users who, when they use their VPN client to establish 
connection with the VPN server, their renewal window fails to refresh, and
their connection dies.  Looking at it architecturally, this makes perfect
sense.  The renewal URL to the gateway is a local address, which works as
long as the client uses a local DHCP address.  Once the VPN tunnel forms,
don't they get an IP address on the remote tunneled network, and all traffic
goes through the tunnel?  The request for a renewal refresh goes through
the tunnel and cannot be resolved, as it is only valid on the local network.
(The gateway is not accessible from the outside 'net.)

If I manually permit (using the fw_exception script) the IP and MAC of the 
VPN user, his VPN works perfectly, albeit he is not subjected to the splash
page and has no renewal window with which to contend.  We would like to keep
the splash page/renewal process intact--how can we handle the VPN tunnel
situation?

Brendan
_______________________________________________
NoCat mailing list
[email protected]
http://lists.nocat.net/mailman/listinfo/nocat