Subject: VPN Query

From: "David Furlong" <[email-masked]>
Date: Mon, 26 Jun 2000 17:56:07 +0100

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

I am new to firewall administration, and currently I run fwtk on 
solaris 2.6

I have been asked to implement a VPN on the network, for a travelling 
salesman to access a client database (which needs to be accessed by 
users in the office)

I have looked into doing this for another firewall before, and you 
could just purchase add-on's, but I am wondering what is the best way 
to implement this kind of VPN,

Regards

Dave.

_____________________________________

Get your free E-mail at http://www.ireland.com

---

From: Steve Sandau <[email-masked]>
Date: Mon, 26 Jun 2000 15:45:38 -0400

I don't know that it's the *best* way, but I have just recently
installed PoPToP for linux on the same machine that use for fwtk. I
decided on that rather than passing the PPTP *through* the firewall to
an internal machine. It seemed safer to me to have only one box
accessible from the internet. I have a DMZ with a web server, but the
prospect of filtering through the firewall twice discouraged me from
thinking about putting the VPN box on the DMZ segment too seriously.

I have not yet tested the final configuration of ipchains that is needed
in order to allow the PPTP software to be accessed from the Inernet, but
I do have PoPToP installed, compiled, and working (tunneling IPX even!).
The firewall was previously doing NO forwarding, (forwarding was turned
off in the kernel) just proxying simple stuff.

You might write me directly if you'd like the details that may not be
list-appropriate.

-- 
Steve Sandau
IS Technician, TMA, Bath, Maine
[email-masked]

---

From: Michel Bardiaux <[email-masked]>
Date: Tue, 27 Jun 2000 10:23:54 +0200

> salesman to access a client database (which needs to be accessed by

I assume the database is on your internal net? 

 > to implement this kind of VPN,

Do you really need a full VPN? If secured access from outside to a *specific*
inside port is enough, SSH would be a solution. However, *any* tunnelling through
the FW is a security risk, to be balanced against the security risk of putting
the DB in question in the DMZ rather than the internal net. So, the questions
are: how secure is the salesman's laptop? (In other words, how difficult would
it be to steal the SSH private key?) And, how sensitive is the DB? 

Greetings.
-- 
Michel Bardiaux
Peaktime Belgium S.A.  Rue Margot, 37  B-1457 Nil St Vincent
Tel : +32 10 65.44.15  Fax : +32 10 65.44.10
Standard disclaimers.

---

From: Matthew Barnson <[email-masked]>
Date: Wed, 28 Jun 2000 00:29:53 -0600

We have two setups that run in parallel at our work: Ravlin VPN software and
hardware operating in parallel with our firewall, and a dedicated "ssh
tunneling" host set up *behind* the firewall, with a plug-gw rule shunting
outside SSH traffic into this dedicated, extremely locked-down host.  That
way you avoid adding users to the firewall per se.  However, there is some
weirdness with identd we still haven't worked out...

-- 

Matthew P. Barnson 	     [email-masked]	
Mgr,Systems Administration   Excite Business Applications

-
If some day we are defeated, well, war has its fortunes, good and bad.
		-- Commander Kor, "Errand of Mercy", stardate 3201.7