Subject: VPN in fwtk

From: wen <[email-masked]>
Date: Fri, 7 Apr 2000 13:6:15 +0800

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

hello all:
    now does fwtk support VPN?    how to config?

thanks.

wen

---

From: Michel Bardiaux <[email-masked]>
Date: Fri, 07 Apr 2000 10:58:02 +0200

>     now does fwtk support VPN?    how to config?

Just my 2 cents:

We looked into that here (admittedly more than 2 years ago!) and came to
a few conclusions:

(1) PPTP : uses a special IP protocol number, so filtering rules
    have to be set up at kernel level; much harder than configuring
    plug-gw! Moreover, we could not find an Open Source implementation
    supporting encryption.
(2) SSH : we use SSH (version 1) to tunnel through our firewall, with
    the Open Source client for Linux, and the Datafellows F-Secure
    proprietary client for WindowsNT (the latter not working very
well...);
    plug-gw on the firewall, additional authentication via the ISDN
phone
    number in the ISDN router, and the Open Source server on our
internal
    server, which is an SGI running IRIX.
    Drawbacks: FTP does not work over SSH (admittedly we use a rather
old
    release of SSH, maybe this changed?), nor AFAIK any UDP protocols.
    Although it is theoretically possible to use PPP-over-SSH as a VPN,
    many say that is prone to 'cascade failure', i.e. TCP packets being
    re-transmitted on *both* the real and the virtual link, causing
*more*
    transmission failures, causing more retransmission, etc... We did
not
    try so I don't *know*.

-- 
Michel Bardiaux