5 ms·

So I know many people use OpenVPN these days, but does anyone use L2TP/IPSec or IPSec? I asked because when recently searching this topic, despite the author m

by 616c 11y ago

So I know many people use OpenVPN these days, but does anyone use L2TP/IPSec or IPSec? I asked because when recently searching this topic, despite the author mentioning lots of dated materials, most of what I find is archaic. This post mentions ipsec-tools, but it has been clear that since the IPSec changes/patches went inline into the kernel for 2.6.x and beyond, these have slowly become more relevant over time, and that ipsec-tools and/or raccon to do L2TP and IPSec or pure IPSec is generally outdated and now only really suited to the BSDs because, as the articles mentions, it is more germane to that architecture. And the difference between FreeSWAN, LibreSWAN, and StrongSWAN was very confusing to me unitl I read this. http://serverfault.com/questions/173158/strongswan-vs-openswan/225374#225374 http://serverfault.com/questions/173158/strongswan-vs-opensw... I mean setting up VPN is no trivial pursuit, but the amount of effort to set any of these up to use native VPN clients for my mobile (Android devices) encouraged me to potentially consider StrongSWAN once I really review the documentation and learn as much as I can. What are others doing? Thanks for the cool article either way.

drzaiusapelord 11y ago
>but does anyone use L2TP/IPSec or IPSec IPSec is still the enterprise defacto standard. Its pretty much everywhere. Yeah, it a little different for the FOSS home hobbyist, but for companies with a budget, its a trivial addition to their infrastructure (Cisco, Sonicwall, etc). FOSS IPSec implementations seem to be pretty non-existant in practice from my own experience and I only see FOSS-only shops using OpenVPN, which is OpenSSL based (which, of course, suffered from heartbleed).
- noinsight 11y ago
  > I only see FOSS-only shops using OpenVPN, which is OpenSSL based (which, of course, suffered from heartbleed). Exactly. I'd love to see a simple, auditable and secure open source VPN software. (not OpenVPN)
  - 616c 11y ago
    This is why I ask. I did not want to post it again (I am sure I am not the first), but this is SoftEther thing masquerades as these different VPN protocols while being the same backend. http://softether.org/ http://softether.org/
  - riobard 11y ago
    Try SigmaVPN and ShadowVPN. Very simple and stateless VPN implementations based on libsodium.
digital-rubber 11y ago
Go with strongswan, read their test scenarios, this includes configuration and log output sample. And a clear diagram of what you will be achieving. http://strongswan.org/testresults.html http://strongswan.org/testresults.html
feld 11y ago
These days for VPNs it's hard to beat OpenVPN with TLS auth enabled and using keys, not passwords/passphrases.
- brunoqc 11y ago
  Why not passwords with LDAP and a psk?
  - feld 11y ago
    Password protected keys (edit:certificates), yes, but not regular user/password no matter if it's LDAP backed or anything else... (but I think you can do password and key, but I need to check docs) I'm in a meeting and drawing a blank on what the primary reason was for avoiding password-only... I'll update if I can remember the reason besides "passwords are easier to crack"
    - brunoqc 11y ago
      LDAP is nice to grant and revoke access and have passwords in sync with the computers at work. Maybe the certificates could be stored in LDAP.
      - snuxoll 11y ago
        Almost any decent enterprise identity management solution (read: Active Directory, FreeIPA) includes user certificate management in some fashion; or if you want a separate CA for VPN access it's not hard to write a couple scripts to generate user certificates and revoke them as needed.
dhess 11y ago
I use IPsec in addition to OpenVPN, primarily because that's all iOS used to support. Since iOS 5 or 6 (I think; maybe even as late as version 7?), Apple has allowed third-party VPN apps, so with an "official" OpenVPN client now available in the iOS App Store, it's not as important as it was. However, I've left it running as a fallback solution to OpenVPN (some hotel firewalls, for example, permit IPsec but actively block UDP-based OpenVPN). I use ipsec-tools, as circa 2012 when I was originally setting this up, it was the only free software IPsec solution I could get to work with iOS clients, but based on this vulnerability I've now disabled it and will try StrongSWAN again.
- brunoqc 11y ago
  You can also use OpenVPN on port 443 as a last resort (only as a last resort since TCP over TCP is a bad idea[1]) 1- https://news.ycombinator.com/item?id=2409090 https://news.ycombinator.com/item?id=2409090
  - dhess 11y ago
    Yes, I do that as well, but I think that IPsec is a better backup solution.
    - 616c 11y ago
      In addition, tunneling TCP in TCP to hide OpenVPN behind a HTTP proxy, lest it look out of place and be easily fingerprinted as OpenVPN on packet analysis is why I wanted to avoid it this time around. https://www.bestvpn.com/blog/5919/how-to-hide-openvpn-traffic-an-introduction/ https://www.bestvpn.com/blog/5919/how-to-hide-openvpn-traffi... Plus, I wanted to better secure my home network AND make it accessible remotely (in a dorm-like accomodation with enterprise-grade NAT with Cisco gear), I thought an IPSec tunnel would be optimal as well.
fencepost 11y ago
There are a lot of places using IPSec VPNs for point-to-point connections, in part because there's an awful lot of equipment out there that supports them. Heck, Cisco's "Small Business" RV router series (RV042/RV082/RV016/RV042G and possibly others) are still being sold after several hardware revisions (still kind of long in the tooth), and they support all of two VPN types: IPSec and PPTP.
- 616c 11y ago
  Oh, I am aware. I work in a such an org with the Cisco IPSec system. I have mutliple that I use/evaluate for work purposes, but when I asked this I am more interested in the open systems not tied to a dedicated appliance, or at least can do both (I see "OpenVPN appliances" advertised on the OpenVPN page these days).
ryan-c 11y ago
I run transport mode IPSec on my LAN at home under Linux with racoon to encrypt NFS with certificate based auth. It was a huge pain in the ass.
- 616c 11y ago
  You got a write-up on that? It sounds like a daunting task, so funny blog post with profanity about Linux config (used to write them, no one would read them) are something I really enjoy. So definitely write about that. There is so much bullshit and misinformation I have read this week alone on VPN config in *nix environments, it's astounding. My shakiness was only confirmed by this article.
  - deleted 11y ago
    [deleted]
  - ryan-c 11y ago
    I'm planning on going through some of my old projects and writing blog posts about them over the next couple of months, and I will add that one to the list. It was indeed, a massive pain in the ass.
api 11y ago
IPSEC is a usability nightmare, mostly on account of the implementations.
- 616c 11y ago
  Well, I was under the impression that projects like Streisand exist because OpenVPN is no cake-walk either. https://github.com/jlund/streisand https://github.com/jlund/streisand EDIT: Forgot the link, like a proper idiot.
  - redwards510 11y ago
    I'm really glad you posted that link, because I think Streisand is an important project. I wasn't under the impression that Streisand existed because OpenVPN was hard. Rather, it tries to support everything possible, and helps you set up some of the more esoteric solutions out there in case that is all your users can support. OpenVPN is just along for the ride.
billyhoffman 11y ago
We use L2TP/IPSec to VPN into our AWS VPC. Amazon's VPN solutions aren't great, and propping up a VPN endpoint on a micro instance and an elastic IP is fairly easy. Also makes it easier to SSH/RDP/MySQL to instances in your private subnet from trusted developer machines at our office. L2TP/IPSec is built in to modern versions of OS X and Windows (though for Windows you have to tweak hidden settings to work with NAT properly)
- john_oshea 11y ago
  If you have time to link to somewhere listing those hidden settings, that would be really helpful.
  - billyhoffman 11y ago
    https://support.microsoft.com/en-us/kb/926179 https://support.microsoft.com/en-us/kb/926179 The article mentions Vista and Window Server 2008, but it applies to Windows 7 and Windows 8 as well. There are some Stack Overflow threads as well. For the VPN setup, I largely followed these instructions: http://www.stormacq.com/build-a-private-vpn-server-on-amazons-ec2/ http://www.stormacq.com/build-a-private-vpn-server-on-amazon... There are a few typos in the scripts cited in the article especially around saving the iptables rules. OS X's native VPN client worked out of the box

by 616c 11y ago

drzaiusapelord 11y ago

>but does anyone use L2TP/IPSec or IPSec IPSec is still the enterprise defacto standard. Its pretty much everywhere. Yeah, it a little different for the FOSS home hobbyist, but for companies with a budget, its a trivial addition to their infrastructure (Cisco, Sonicwall, etc). FOSS IPSec implementations seem to be pretty non-existant in practice from my own experience and I only see FOSS-only shops using OpenVPN, which is OpenSSL based (which, of course, suffered from heartbleed).

noinsight 11y ago
> I only see FOSS-only shops using OpenVPN, which is OpenSSL based (which, of course, suffered from heartbleed). Exactly. I'd love to see a simple, auditable and secure open source VPN software. (not OpenVPN)
- 616c 11y ago
  This is why I ask. I did not want to post it again (I am sure I am not the first), but this is SoftEther thing masquerades as these different VPN protocols while being the same backend. http://softether.org/ http://softether.org/
- riobard 11y ago
  Try SigmaVPN and ShadowVPN. Very simple and stateless VPN implementations based on libsodium.

digital-rubber 11y ago

Go with strongswan, read their test scenarios, this includes configuration and log output sample. And a clear diagram of what you will be achieving. http://strongswan.org/testresults.html http://strongswan.org/testresults.html

feld 11y ago

These days for VPNs it's hard to beat OpenVPN with TLS auth enabled and using keys, not passwords/passphrases.

brunoqc 11y ago
Why not passwords with LDAP and a psk?
- feld 11y ago
  Password protected keys (edit:certificates), yes, but not regular user/password no matter if it's LDAP backed or anything else... (but I think you can do password and key, but I need to check docs) I'm in a meeting and drawing a blank on what the primary reason was for avoiding password-only... I'll update if I can remember the reason besides "passwords are easier to crack"
  - brunoqc 11y ago
    LDAP is nice to grant and revoke access and have passwords in sync with the computers at work. Maybe the certificates could be stored in LDAP.
    - snuxoll 11y ago
      Almost any decent enterprise identity management solution (read: Active Directory, FreeIPA) includes user certificate management in some fashion; or if you want a separate CA for VPN access it's not hard to write a couple scripts to generate user certificates and revoke them as needed.

dhess 11y ago

I use IPsec in addition to OpenVPN, primarily because that's all iOS used to support. Since iOS 5 or 6 (I think; maybe even as late as version 7?), Apple has allowed third-party VPN apps, so with an "official" OpenVPN client now available in the iOS App Store, it's not as important as it was. However, I've left it running as a fallback solution to OpenVPN (some hotel firewalls, for example, permit IPsec but actively block UDP-based OpenVPN). I use ipsec-tools, as circa 2012 when I was originally setting this up, it was the only free software IPsec solution I could get to work with iOS clients, but based on this vulnerability I've now disabled it and will try StrongSWAN again.

brunoqc 11y ago
You can also use OpenVPN on port 443 as a last resort (only as a last resort since TCP over TCP is a bad idea[1]) 1- https://news.ycombinator.com/item?id=2409090 https://news.ycombinator.com/item?id=2409090
- dhess 11y ago
  Yes, I do that as well, but I think that IPsec is a better backup solution.
  - 616c 11y ago
    In addition, tunneling TCP in TCP to hide OpenVPN behind a HTTP proxy, lest it look out of place and be easily fingerprinted as OpenVPN on packet analysis is why I wanted to avoid it this time around. https://www.bestvpn.com/blog/5919/how-to-hide-openvpn-traffic-an-introduction/ https://www.bestvpn.com/blog/5919/how-to-hide-openvpn-traffi... Plus, I wanted to better secure my home network AND make it accessible remotely (in a dorm-like accomodation with enterprise-grade NAT with Cisco gear), I thought an IPSec tunnel would be optimal as well.

fencepost 11y ago

There are a lot of places using IPSec VPNs for point-to-point connections, in part because there's an awful lot of equipment out there that supports them. Heck, Cisco's "Small Business" RV router series (RV042/RV082/RV016/RV042G and possibly others) are still being sold after several hardware revisions (still kind of long in the tooth), and they support all of two VPN types: IPSec and PPTP.

616c 11y ago
Oh, I am aware. I work in a such an org with the Cisco IPSec system. I have mutliple that I use/evaluate for work purposes, but when I asked this I am more interested in the open systems not tied to a dedicated appliance, or at least can do both (I see "OpenVPN appliances" advertised on the OpenVPN page these days).

ryan-c 11y ago

I run transport mode IPSec on my LAN at home under Linux with racoon to encrypt NFS with certificate based auth. It was a huge pain in the ass.

616c 11y ago
You got a write-up on that? It sounds like a daunting task, so funny blog post with profanity about Linux config (used to write them, no one would read them) are something I really enjoy. So definitely write about that. There is so much bullshit and misinformation I have read this week alone on VPN config in *nix environments, it's astounding. My shakiness was only confirmed by this article.
- deleted 11y ago
  [deleted]
- ryan-c 11y ago
  I'm planning on going through some of my old projects and writing blog posts about them over the next couple of months, and I will add that one to the list. It was indeed, a massive pain in the ass.

api 11y ago

IPSEC is a usability nightmare, mostly on account of the implementations.

616c 11y ago
Well, I was under the impression that projects like Streisand exist because OpenVPN is no cake-walk either. https://github.com/jlund/streisand https://github.com/jlund/streisand EDIT: Forgot the link, like a proper idiot.
- redwards510 11y ago
  I'm really glad you posted that link, because I think Streisand is an important project. I wasn't under the impression that Streisand existed because OpenVPN was hard. Rather, it tries to support everything possible, and helps you set up some of the more esoteric solutions out there in case that is all your users can support. OpenVPN is just along for the ride.

billyhoffman 11y ago

We use L2TP/IPSec to VPN into our AWS VPC. Amazon's VPN solutions aren't great, and propping up a VPN endpoint on a micro instance and an elastic IP is fairly easy. Also makes it easier to SSH/RDP/MySQL to instances in your private subnet from trusted developer machines at our office. L2TP/IPSec is built in to modern versions of OS X and Windows (though for Windows you have to tweak hidden settings to work with NAT properly)

john_oshea 11y ago
If you have time to link to somewhere listing those hidden settings, that would be really helpful.
- billyhoffman 11y ago
  https://support.microsoft.com/en-us/kb/926179 https://support.microsoft.com/en-us/kb/926179 The article mentions Vista and Window Server 2008, but it applies to Windows 7 and Windows 8 as well. There are some Stack Overflow threads as well. For the VPN setup, I largely followed these instructions: http://www.stormacq.com/build-a-private-vpn-server-on-amazons-ec2/ http://www.stormacq.com/build-a-private-vpn-server-on-amazon... There are a few typos in the scripts cited in the article especially around saving the iptables rules. OS X's native VPN client worked out of the box