I am looking for a free/cheep vpn server for the LAN in our community.

Our setup is a bit more complex than most, I would say. All traffic to the outside wall passes through our firewall (made by Juniper), so we have one leg facing outwards. We have another leg for our web servers (dmz) and several internal legs for different parts of our network eg one for homes, one for offices and one for a factory. I am interested in forming a vpn with the offices section.

WWW <---> FIREWALL |<---> DMZ [ fixed ip]
...................|<---> Homes [ dhcp ]
...................|<---> Offices [ fixed ip ]
...................|<---> Factories [ fixed ip ]

(sorry about the dots, but I couldnt format it any other way)
I also have at my command an array of external IP addresses and can use one of these to connect directly through the fire wall (with/without a password) to any machine on the LAN.

As the administrator, I envisage being able to log into the LAN from anywhere outside the LAN via an IP address or URL like vpn.mycompany.com, receive an ip in the range of the offices and then, to all intents & purposes be part of the network.

I have other workers, who I would like to be able to connect up and only have limited services eg being able to connect up to their account on the domain server or map a certain directory on a certain computer.

I prefer installing the vpn 'server' using Linux (preferably Slackware), but most of my clients are windows machines.

I have looked briefly at openVPN, but cant find a tutorial that I can follow easily - mainly the assume you know what you are doing & understand the terminology. Also, I haven't found any that explains the physical setup needed, for instance, where do I place the server in the above diagram? What hardware do I need? What ports do I need open in the firewall? I dont envisage heavy traffic & only a few clients connected at the same time.

If anyone can help me or just point me in the right direction, I would be most grateful.

SysMan

Did you read this?
http://openvpn.net/index.php/open-so...ion/howto.html
Your vpn server should be reachable from all clients on UDP port 1194 (or anther port that you configure). This port must be opened in your firewall. If this can be done, it should be working. I have a server running with a public reachable port 1194. All clients (behind DSL connections with NAT) can connect to the VPN in a 10.8.0.0/16 net.

Regards "sorry about the dots" you could use CODE tags. The easiest way to do that is to go into Advanced Mode and use the # button.

Presumably your Juniper firewall is also a NATting router in which case you will have to portforward UDP 1194 on it to the OpenVPN server.

AFAIK the page linked by eehmke is the best OpenVPN HOWTO. If you work through it systematically instead of trying to take it all in at once it is very good.

The scenario you describe requires bridged rather than routed mode (this is what makes client computers "to all intents & purposes be part of the network"). There's a security catch in that though. Client computers normally have a security key arrangement that works with the server to allow passwordless connection. That means that anybody in possession of a client computer can make a connection to your LAN. If the client computer is a portable device which could be stolen ... Adding passwords is possible but not trivial.

Regards the "other workers", if you use bridged mode then they are "to all intents & purposes be part of the network". You could set up two instances of OpenVPN, using different UDP ports, one routed and one bridged but the routed service users could only access the OpenVPN server itself.

The OpenVPN server should be on the Offices LAN.

OpenVPN hardware requirements are trivial.

EDIT: if this information makes you harden the systems on your LAN then that may be no bad thing!

Ummm, there's no denying it: VPN configuration and especially debugging is quite difficult, if only "due to the essential nature of the beast."

You quite frankly may need to open your search beyond simply this web site in order to find truly qualified recommends about a network topology of this complex a nature. Because, what you want is not simply "a passage from the outside to the inside," but a limited passage to a portion of what is "inside," with the various components of the internal system also using VPN technology. And, you want the whole thing to be manageable, which probably means that some connection to internal security/infrastructure controls (e.g. LDAP, Kerberos) will be required.

Hi, SysMan. I know you mentioned OpenVPN in your title. However, your message asks for an easy VPN solution and suggest you're having problems. The responses also appear to suggest complexity. You might consider PPTP VPN of which I wrote a script that will get it up and running in seconds.

Take a look at: http://faq.apollo3.com/ljames/ubuntu/vpn/ for a quick and easy resolution.

So it has worked in every tested environment without problems.

-- L. James

--
L. D. James
ljames@apollo3.com
www.apollo3.com/~ljames