Subject: VPN/PPP tunnelling

From: Masih Tavassoli <[email-masked]>
Date: Thu, 09 Nov 2000 15:30:11 +0000

Hi all,

I was wondering if it is possible to connect two private networks over
the internet securely. And is it something that fwtk can do, perhaps
through ppp tunnelling?

Here is the scenario:

Private
network
Private network
______________
____________
|       __           |     ______
________       |
|       |A|          |----|ISP FW|--------internet---------|My
FWTK|-----|     B
|       ---
|                                                                    |
|_____________|
|_____________

Machine A can ssh to the firewall(My FWTK) and therefore get access to
Machine B, however the reverse is not true. Machine B does not know of
the ISP FW  and hence can not initiate a connection to machine A.

Question: Is there a way to create a VPN between machine A and B so I
can get access to machine A from machine B?

Any help/pointers into the right direction is highly appreciated.

Kind regards,
Masih
--
Masih Tavassoli                                   Tel: +44 (020) 7936
5884
Sellbuysector.com                           Fax: +44 (020) 7681 6600
88 Kingsway
London WC2B 6AA, UK

---

From: Michel Bardiaux <[email-masked]>
Date: Thu, 09 Nov 2000 17:05:12 +0100

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

 > the internet securely. And is it something that fwtk can do, perhaps
[snip]
 > Machine B,

Personnally I favor ssh *through* the FW, i.e. sshd runs on some
internal machine, not on the FW.

 > however the reverse is not true. Machine B does not know of
You can configure port forwarding on both ends of an SSH session, this
will let connections be made from A to B; this eg is how SSH supports X:
X apps running on B must access the server on A. It is not, however,
since, apart from X which is handled automagically by SSH, on B you
connect to localhost:some-non-privileged-port rather than to
A:some-well-known-port. For a true VPN, you need PPP tunneling, or
IP-over-IP, or IPSEC.

FWTK usually does nothing on tunneling connections; they are encrypted
end-to-end, so FWTK can't know content, so one usually uses simply
plug-gw (or ipchains rules)

Cheers.
-- 
Michel Bardiaux
Peaktime Belgium S.A.  Rue Margot, 37  B-1457 Nil St Vincent
Tel : +32 10 65.44.15  Fax : +32 10 65.44.10