4 ms·

I was thinking of switching to L2TP instead. Would there be any downsides? I tried out this script once and it worked well: https://github.com/hwdsl2/setup-ip

I was thinking of switching to L2TP instead. Would there be any downsides? I tried out this script once and it worked well: https://github.com/hwdsl2/setup-ipsec-vpn https://github.com/hwdsl2/setup-ipsec-vpn

JustSomeNobody 9y ago
I would be interested to hear this as well. I favor L2TP/IPsec as it's built into iOS and MacOS and it was easy to configure my edgerouter-x to be a server for use on the go.
UnoriginalGuy 9y ago
L2TP doesn't traverse NATs and other network firewalls very well. Which isn't relevant if you yourself control all of the hardware between endpoints (e.g. point2point) but if you plan on using it on public networks (e.g. Starbucks WiFi) then expect to run into it being blocked sometimes. OpenVPN was designed for the "Starbucks WiFi" scenario, it can traverse a NAT, and uses standard TLS. It therefore appears like any other HTTPS traffic and will be very infrequently blocked. There's nothing inherently wrong with L2TP/IPSec; it is secure and fast. Just nicer to blend in with other TLS traffic for reliability reasons. For a specific example, GoGo Internet (in-flight WiFi), doesn't allow L2TP/IPsec unless you use UDP encapsulation. OpenVPN works out of the box.
- MichaelGG 9y ago
  Where does this idea that OpenVPN is TLS come from? No, it does not appear like HTTPS nor does it use TLS for the traffic. OpenVPN has its completely own encapsulation protocol, and it stuffs a few TLS packets inside that to do key exchange, nothing more. (And it's key exchange is odd as they re-implement TLS PRF ... on top of TLS.) t. Recently implemented an OpenVPN client.
  - okasaki 9y ago
    The man page says it supports TLS
    - MichaelGG 9y ago
      It supports TLS as an optional key-exchange payload, nothing more. It does not act in any way like "SSL VPNs" that just open a TLS connection and then tunnel data inside.

JustSomeNobody 9y ago

I would be interested to hear this as well. I favor L2TP/IPsec as it's built into iOS and MacOS and it was easy to configure my edgerouter-x to be a server for use on the go.

UnoriginalGuy 9y ago

L2TP doesn't traverse NATs and other network firewalls very well. Which isn't relevant if you yourself control all of the hardware between endpoints (e.g. point2point) but if you plan on using it on public networks (e.g. Starbucks WiFi) then expect to run into it being blocked sometimes. OpenVPN was designed for the "Starbucks WiFi" scenario, it can traverse a NAT, and uses standard TLS. It therefore appears like any other HTTPS traffic and will be very infrequently blocked. There's nothing inherently wrong with L2TP/IPSec; it is secure and fast. Just nicer to blend in with other TLS traffic for reliability reasons. For a specific example, GoGo Internet (in-flight WiFi), doesn't allow L2TP/IPsec unless you use UDP encapsulation. OpenVPN works out of the box.

MichaelGG 9y ago
Where does this idea that OpenVPN is TLS come from? No, it does not appear like HTTPS nor does it use TLS for the traffic. OpenVPN has its completely own encapsulation protocol, and it stuffs a few TLS packets inside that to do key exchange, nothing more. (And it's key exchange is odd as they re-implement TLS PRF ... on top of TLS.) t. Recently implemented an OpenVPN client.
- okasaki 9y ago
  The man page says it supports TLS
  - MichaelGG 9y ago
    It supports TLS as an optional key-exchange payload, nothing more. It does not act in any way like "SSL VPNs" that just open a TLS connection and then tunnel data inside.