Re: Any help with VPN termination?

From: Aaron P. Martinez (ml_at_proficuous.com)
Date: 05/04/05

  • Next message: Ernie McCracken: "Re: FC3 shutdown error with vmware" 
    To: For users of Fedora Core releases <fedora-list@redhat.com>
Date: Wed, 04 May 2005 12:38:06 -0500

    On Wed, 2005-05-04 at 11:26 -0400, Nick Phillips wrote:
    > Hi all,
    >
    >
    >
    > I’m a relative newbie to VPN, and I’ve been asked to investigate
    > setting up a VPN for a small office of about 50 people. The network
    > architecture is an external firewall (which may be replaced with a
    > firewall / VPN appliance, probably Astaro at this point)

    firewall/anything not my favorite choice. The firewall imo, shouldn't
    be running any services that can be attacked, simply passing packets and
    optioally routing.

    if you have a spare 4 or 5 year old machine laying around, consider
    throwing linux or some BSD on it and running openvpn. it's a very
    secure ssl based vpn product and you only need one port opened up in
    your firewall, no gre so no custom kernel needed.

    > , a DMZ containing Linux-webservers (192.168.2.x), and an internal
    > Linux firewall protecting the LAN (192.168.1.x), composed of Windows
    > XP machines, and also the file/mail servers (which will be switched to
    > WIndows Server as per management’s request).
    >

    > Now my question – where is the best place for the VPN to terminate,
    > assuming that VPN users need access to the file servers inside the
    > LAN?

    I do the same thing and have my vpn machine on the DMZ on the off chance
    that it gets compromised, i don't want it on the private lan. You can
    then allow from your lan firewall (not sure why you need two, the
    outside firewall should be able to handle both the routing to the dmz
    and private lan and give you same security level w/one less machine to
    administer) to pass packets from the DMZ interface w/the ip address
    class you assign to your vpn users.

    For one more layer of security, at this point, you could allow traffic
    ONLY to some internal NT authenticator/ domain controller which they
    have to log in through and are provided network shares/resources this
    way.

    > With an external firewall / VPN appliance, as far as I understand it,
    > the VPN sessions would terminate inside the DMZ, with an IP of
    > 192.168.2.something. Providing those VPN users with access to the
    > fileservers inside the LAN would require punching a bunch of holes in
    > the internal firewall, right? This isn’t something that sounds too
    > appealing to me. But what other solutions are there? Is it preferable
    > to forward the VPN connection to be terminated on the inside firewall
    > instead, so sessions would terminate inside the LAN with a
    > 192.168.1.something IP?
    >

    you're running into the main dilemma that people run into when trying to
    allow outsiders, even your own outsiders, onto your lan. There
    currently, imo, no perfect solution. Remember too that when you're
    allowing access to your lan from outside, your lan is only as protected
    as the clients machines. Once their home machines have been
    compromised, it's open season on your lan.

    >
    >
    > Could anybody with VPN experience suggest the best way to solve this?
    > And forgive me if I’m screwy with some of the details of how VPN
    > works, I’m still learning up on PPTP / L2TP / IPsec etc etc....
    >
    >
    >
    > Regards,
    >
    >
    >
    > Nick Phillips
    >
    Aaron P. Martinez
    http://www.proficuous.com 

    -- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
  • Next message: Ernie McCracken: "Re: FC3 shutdown error with vmware"

    Relevant Pages

    • Re: general question on design options
      ... Behind that I have my ISA, ... How do you get the VPN connections that terminate on the Cisco to get past ... DMZ and not the LAN. ...
      (microsoft.public.isa)
    • Re: Access to network drives for home and roaming users
      ... All the VPN does is to add a security layer to the remote access, ... Do you want the data in a DMZ, or do you want them to come straight ... through the firewall to your LAN? ... have a windows 2003 R2 network with an internal and perimeter network, ...
      (microsoft.public.inetserver.iis.security)
    • Re: Webserver sicher machen mit IPSec
      ... >> die Firewall wie beschrieben konfigurieren kann.. ... Server und Clients gibts auch für Win, aber Du kannst eben nicht dex XP ... Client VPN nehmen.. ... die man anscheind aber nicht noch LAN und VPN ...
      (microsoft.public.de.inetserver.iis)
    • Re: [fw-wiz] VPN concentrators
      ... > Current best thinking is to terminate VPN tunnels inside an ... > through this or another firewall before entering the internal ... > thoughts on termination of vpn tunnels on the firewall itself? ... three NICs: Outside, Inside, and DMZ. ...
      (Firewall-Wizards)
    • Re: VPN through two firewalls.
      ... I'm trying to set up a VPN connection through two firewalls. ... through the firewall to the internet.. ... But you can't go from the DMZ ... onto the lan.. ...
      (comp.dcom.vpn)