Broadband Tech > Virtual Private Networking > what's the best way of doing this in your opinion?

what's the best way of doing this in your opinion?

Zen VPN - US···.pbk.zip 1,038 bytes

@hurdles
The Windows VPN client is about the most pain-free client for Windows, that I can tell anyways.
Point it to the VPN headend address and go.

You may also want to try this thread for a solution from a Windows perspective.

For your Cisco-specific options, it's going to depend on what you're using, or planning to use.
I'm personally more experienced in the big stuff like this and while they're not impossible to configure,
the equipment is most definately NOT free. Also you may have to consider user and licencing
limitations, which is going to be a potential issue with about any other commerical provider
of similar types of gear.

You could look into DIY stuff. Some names of products I can think of are Untangle, OpenVPN,
Astaro, or some other *nix router distro.

Regards

reply to hurdles
One low-cost (and easy) option is to get a router that is supported by DD-WRT and install DD-WRT on it. The standard DD-WRT build includes a PPTP server that is extremely straightforward to configure, and all versions of MS Windows since 95 have a PPTP client that is even easier to set up and use.

reply to hurdles
In general I agree w/ Hellfire's idea about the MS PPTP VPN, but there is one caveat when it comes to bypassing state censorship.

Remember, the MS VPN requires the external port 1723 (you can’t just remap it, at least I've never been able to make it work w/ anything but 1723), and given the determination of some states, it's a simple matter to block all access to port 1723. In fact, sometimes ISPs (not even for censorship reasons) block it. Or they might be using older equipment that doesn't support GRE.

So I'm always a bit cautious about depending solely on PPTP. Just too many things can go wrong. If you do use it, it's a good idea to have a backup solution.

What I recommend is to use something based on SSL (port 443), which almost no one is going to block it, if only because a tremendous amount of legitimate traffic depends on it (banking, online shopping, etc., even the government itself). What I do is keep LogMeIn Hamachi installed on all my computers. Now I have a completely secure VPN from which I can do ANYTHING, including file (SMB) and printer sharing, http, telnet, rdp, vnc, etc.). I can even add a proxy server like Privoxy and make that available (so remote users would simply configure their apps to use that proxy).

In fact, it might even be easier to simply make a remote desktop available (e.g., VNC over Hamachi, or LogMeIn), perhaps creating several virtual desktops on a spare server using VirtualBox.

Anyway, there are a lot ways to skin this cat, and some better than others. Whether any given solution is simple enough for your needs, you’ll need to decide. But with that simplicity often comes the simplicity to thwart your efforts by the censors. You have to think a little outside the box to make sure you don’t leave yourself w/ one solution/option that falls apart because you failed to anticipate how it could be defeated. Always have at least one backup solution!

reply to broccoli
thanks a lot for the helpful comments..
I have a Cisco DPC2325. turns out it doesn't support dd-wrt. going to pick up a router that does tomorrow and continue the battle.
will keep you posted. thanks again

reply to hurdles
This document may or may not be of interest...

»en.flossmanuals.net/_booki/bypas···ship.pdf
--
"When all else fails read the instructions..."
MS-MVP Windows Expert - Consumer

ok so I picked an Asus RT-N16 today..hooked it up, upgraded the firmware to dd-wrt and followed the instructions online to configure the PPTP..used mainly the one here:
»geekyprojects.com/vpn/remote-acc···-dd-wrt/

adding the dynamic dns to ddns of dd-wrt went fine. then setup the vpn under services just like how it says in the guide above.
Then created a vpn connection on a computer outside my LAN but no luck connecting to it! ps. theoritically speaking should you be able to vpn from a computer within your LAN as well?

then I read somewhere that port 1723 should also be forwarded to the router's ip. so did that as well, but still no luck !

any thoughts?

Thanks

reply to broccoli

If you are renting your DPC2325, try getting Rogers to replace it with a plain cable modem, which should also save you a buck or two a month.

My father has Shaw and uses a Moto SB5101 (supplied by Shaw, I think), to which I connect a DD-WRT modded router mainly for its VPN endpoint capabilities.

Sir you're a rock star !! replaced the modem and it works like a charm
funny thing is everytime i talked to tech support, they were trying to convince me that the problem should be else where. "Since the the router functionality of the modem is turned off, there's essentially no difference between that and a regular modem" (which also makes sense)..

anyway thanks a mil! if you also live in TO, I'd love to buy you a beer sometime

reply to broccoli
just another q re authentication..I understand if this thread is not appropriate for it, so if that's the case, lemme know and I'll create a new thread for it.

I was wondering I can enter multiple user/passes in the "CHAP-Secrets" field? I tried, but it only works for the first user/pass.
followed the following convention:
user * pass *
user2 * pass *

also tried:
user * pass * user2 * pass *

and can multiple users connect at the same time anyway?

please advise

thanks

ah that was just a typo..multiple users works fine now too..just one thing though..can't access it from overseas (and I'm not even talking back home where the vpn ports might be blocked sometimes). My friends in the states and France can't even ping the machine! though I access it no problem from a variety of places in TO. have tried 4 different places already plus using tethering from my cell..

and I was also wondering if there's a better way of handling a large number of users other than the "CHAP-Secrets" field? maybe input in a an xml file or something and tell the router to get them from there?