WLan ->(Intranet) ->Internet Howto?
Hello there, I have read the last days the Inet about security stuff (VPN-Howto, VPN-Masq-Howto) and got more and more confused. I want share my inet-dialup-connection with my neighbour across the street. He has a Win98SE-PC with a WLan-network-card and here will stay a standard access point. Because Win98, there are some difficults to establish a WPA-Connection. If I test with another client, the Wlan-speed with WPA enabled is awfull slow (as expected from this cheap AP here) But thats not the way we're want to go. We want a solution to keep the kiddys and normal crackers out. (I think a real Hacker doesnt give up if he sees a VPN). So I want to secure this connection with a VPN-connection. But where to start? There are no win98-clients for IPsec out there, but there is an L2TP-client. There are Firewall / Masquerade problems with VPN.... For the right way to split up the secure zones I will set the router like this: !--------------------! clients---Intranet-----!eth1 ROUTER eth0!---DSL/ISP---> via Cat5 Hub ! with FW, ! ! VPN-server ! client-----WLAN-AP-----!eth2 ! with Wlan !--------------------! +VPN-client Is this overkilled (additional Network-Card) or easier to configure? Im afraid, there are much concerns to care about, if I plug the WLAN-AP direct to the Intranet-Hub. What Server/client would you suggest to use for VPN (keep in mind the client-soft have to run on Win98SE)? Have I care about firewall concerns at eth2? As is see, there should only one piece of software listen on this network interface: the VPN-server. Because I decrypt the traffic on my router, have I worry about masqueradeing the traffic to/ from the public Inet? How could I prevent the VPN-Users from any services in the Intranet exept for the forwaring to the public Inet? Could you point me either to a howto or a software path ("Take client XXyyzz from MicroLinux, take server freegoose from SuseSoft and glue them together" or some raw main points to look for? thanks in advantage Andy
Hi, just an idea, afaik putty (a windows ssh client) can also tunnel ip-connections. This would allwo you to make a simple ssh-tunnel for your wireless clients, without the need of any other vpn-software: windows / linux / os/2 / mac with an ssh-client <--(ssh)--> ssh-server <--> internet The <--(ssh)--> part of the route to the internet is the (wwh-encrypted) wireless connection. As you need an account to log in via ssh on the ssh-server to tunnel, only valid users can get internet access. Of course, you have to disable routing from the ssh-server's wireless interface, as the only valid connection is incoming connection to ssh-port 22. This is not as comfortable as a well-configured vpn solution, but it is completely transparent (access by user account on ssh-server), rather secure (one would have to break into your ssh-server) and works with all client systems coming with some sort of ssh-clients, which means it is a generic setup which should still be useable after the next update to windows-whatever and its great newest vpn-protocol ;-) Of course you will have to set up tunnelling by some sort of script, cause you need tunnels for all needed protocols (dns, http, ftp, ...). CU + good luck (I am sure the more ambitious howtos for vpn will follow ;-) Lars.
On Sun, 23 Jan 2005, Andreas made the net somewhat safer by saying: [..]
So I want to secure this connection with a VPN-connection. But where to start? There are no win98-clients for IPsec out there, but there is an L2TP-client. There are Firewall / Masquerade problems with VPN....
Try OpenVPN. It's easy to setup, and works on a single UDP or TCP port thru a firewall/router. There are servers and clients for both win32 and unices and you can set it up with either static certs or challenge-response cert.
For the right way to split up the secure zones I will set the router like this:
!--------------------! clients---Intranet-----!eth1 ROUTER eth0!---DSL/ISP---> via Cat5 Hub ! with FW, ! ! VPN-server ! client-----WLAN-AP-----!eth2 ! with Wlan !--------------------! +VPN-client
Is this overkilled (additional Network-Card) or easier to configure? Im afraid, there are much concerns to care about, if I plug the WLAN-AP direct to the Intranet-Hub.
Using a firewall on the bastion-host like this is much preferable. Theo -- Theo v. Werkhoven Registered Linux user# 99872 http://counter.li.org ICBM 52 13 26N , 4 29 47E. + ICQ: 277217131 SUSE 9.2 + Jabber: muadib@jabber.xs4all.nl Kernel 2.6.8 + MSN: twe-msn@ferrets4me.xs4all.nl See headers for PGP/GPG info. +
participants (3)
-
Andreas Paulick -
Lars O.Grobe -
Theo v. Werkhoven