VPN

Introduction

In linux we support openvpn and on windows we support RRAS/VPN OpenVPN is a free and open source virtual private network (VPN) program for creating point-to-point or server-to-multiclient encrypted tunnels between host computers. It is capable of establishing direct links between computers across network address translators (NATs) and firewalls. It was written by James Yonan and is published under the GNU General Public License (GPL).

Encryption

OpenVPN uses the OpenSSL library to provide encryption of both the data and control channels. It lets OpenSSL do all the encryption and authentication work, allowing OpenVPN to use all the ciphers available in the OpenSSL package. It can also use the HMAC packet authentication feature to add an additional layer of security to the connection (referred to as an “HMAC Firewall” by the creator). It can also use hardware acceleration to get better encryption performance.

Authentication

OpenVPN has several ways to authenticate peers to one another. OpenVPN offers pre-shared secret key, certificate-based, and username/password-based authentication. Preshared secret key is the easiest, with certificate based being the most robust and feature-rich. The username/password is a new feature (version 2.0) that can be used with or without a client certificate (the server still needs a certificate). The source tarball includes a sample Perl script to verify the username/password with PAM and a C auth-pam plugin.

Networking

OpenVPN can run over UDP (preferred, and default) or TCP. It multiplexes all communications over a single TCP/UDP port. It has the ability to work through most proxy servers (including HTTP) and is good at working through NAT and getting out through firewalls. The server configuration has the ability to “push” certain network configuration options to the clients. These include IP addresses, routing commands, and a few connection options. OpenVPN offers two types of interfaces for networking via the Universal TUN/TAP driver. It can create either a layer-3 based IP tunnel (TUN), or a layer-2 based Ethernet TAP that can carry any type of Ethernet traffic. OpenVPN can optionally use the LZO compression library to compress the data stream. Port 1194 is the official IANA assigned port number for OpenVPN. Newer versions of the program now default to that port. A feature in the 2.0 version allows for one process to manage several simultaneous tunnels, as opposed to the original “one tunnel per process” restriction on the 1.x series.

OpenVPN’s use of common network protocols (TCP and UDP) makes it a desirable alternative to IPsec in situations where an ISP may block specific VPN protocols in order to force users to subscribe to a higher-priced, “business grade,” service tier.

Security

OpenVPN offers several internal security features. It runs in userspace, instead of requiring IP stack (and therefore kernel) operation. OpenVPN has the ability to drop root privileges, use mlockall to prevent swapping sensitive data to disk, and enter a chroot jail after initialization.

OpenVPN offers support of smart cards via PKCS#11 based cryptographic tokens.

Source WIKIIn windows we offer Routing and Remote AccessRouting and Remote Access is a network service in Microsoft Windows Server 2008, Windows Server 2003, and Windows 2000 Server that provides the following services:

* Dial-up remote access server
* Virtual private network (VPN) remote access server
* Internet Protocol (IP) router for connecting subnets of a private network
* Network address translator (NAT) for connecting a private network to the Internet
* Dial-up and VPN site-to-site demand-dial router