Topic: Network over two sites (VPN)

[Anonymous]

I've been checking out the contribs and HOWTOs, but am still a little confused over what SME (6.0.1) can do out of the box.

I want to join two sites together using VPN over broadband, so they look like one big network. I also would like an SME server on one site to act as mail and file server for the combined sites.

The first option is to use a pair of Vigor routers to join it all together, and stick the SME on the network in server-only mode.

The second option - and this is where I am unsure - is to use a pair of SMEs, one at each end in server-and-gateway mode. The server at one end will be the mail server, and the other end just used to provide proxy, DNS routeing etc.

What do I need to do get get this working? Do any RPMs need installing, or is everything already on the standard box? Do I need to create my own templates to manually set up the routeing, or can it all be done through the server manager screens?

The HOWTOs describe various things that can be done, such as 'install OpenVPN' - but they do not explain why I would want to do that, or whether it is necessary and under what circumstances. There are also some HOWTOs that describe templates used to do some VPN stuff, but they are for earlier versions of SME.

Anyone got this working, without specialised VPN routers?

Thanks,

-- Jason

[stiperstones]

try this link

http://no.longer.valid/phpwiki/index.php/Virtual%20Private%20Networks?action=BackLinks

[Anonymous]

Thanks, but I did find those links.

- HOWTO add IPSec (do I need to add IPsec?)
- HOWTO install OpenVPN (do I need to install OpenVPN? What does it do that SME does not already do?)
- HOWTO tunnel client PCs (I want to tunnel a whole network, not just client PCs)
- VPN Using PPTP (looks the most promising, but it a few things aren't clear: does this HOWTO fill some void that SME does not provide 'out of the box'? It is written for SME5.5 - does it still apply to 6.0? Does this method have any security implications - SSL is not mentioned at all?

I appreciate the link, but I think I probably need some further explanation, or advice from someone who has successfuly joined two sites into a single network, before embarking on this.

Thanks,

-- Jason

[Anonymous]

Okay - digging deeper, the "HOWTO install IPSec" looks like the contribution to create a VPN by tunnelling between two SME servers.

I think as a general note, the HOWTOs probably need a WHY section quite prominant, to explain what the HOWTO achieves in a higher-level. Some contribs do this very well, but those that don't could easily get overlooked, which is a bit of a shame considering the effort that the authors have put in to create these instructions.

That's just my initial observation, coming at this from the POV of someone trying to achieve some objective. Please don't read it as a whinge - I only hope it is treated as feedback to help improve this excellent knowledge base (and one that is growing and improving by the day, I might add)

-- Jason

[Anonymous]

I think I'm going to buy a pair of Vigor routers. Seems a much easier way to link two sites than to hack around with this SME stuff. The time I've spent researching this issue, I could paid for the routers several times over by getting on with some other jobs...

-- Jason

[italo]

Have you looked at freeswan?

http://mirror.contribs.org/smeserver/contribs/dmay/mitel/contrib/freeswan/sme55/freeswan-howto.html

I found that howto that says works with 5.6, so theoretically should work with 6.0, but not necessarily. Then there is also some info in French, if you read it. Do a search for freeswan, I think it does exactly what your are looking for

Italo

[Anonymous]

Have you looked at freeswan?

http://mirror.contribs.org/smeserver/contribs/dmay/mitel/contrib/freeswan/sme55/freeswan-howto.html

I took a look at that. I think it needs some code compiled against the correct kernel, and that would need a bit of a development server to do properly (and a lot more knowledge). There is a site that offers pre-compiled RPMs for this, and it looks very good, but they have not created an RPM for 6.0 yet (they have refused to do so until 6.0 came out of beta, and that has only recently happened).

I guess timing is always the issue - I need this now, and several days of messing around with RPMs and discussion lists have not found me a solution, so a dedicated hardware approach is going to be the easiest/cheapest/most timely solution.

Just for completeness, I think this is the place to watch: http://lordsfam.net/downloads/production/freeswan/

-- Jason

[italo]

Hi Jason,

just to make sure...have you followed this thread
http://forums.contribs.org/index.php?topic=19393.msg80403#msg80403
and this
http://forums.contribs.org/index.php?topic=19393.msg80403#msg80403
Some were able to install it on 6

Italo

[Anonymous]

just to make sure...have you followed this thread
http://forums.contribs.org/index.php?topic=19393.msg80403#msg80403

Now that is a very interesting thread I have no idea why I didn't come across it doing a search (perhaps search doesn't look at the title?)

I will give that one a few hours tonight, and try it out - thanks.

-- Jason

[Anonymous]

Did I mention timing? The freeswan.ca site appears to be down during the last few hours I have to try this thing out. Whether this is permanent or transient, I have no idea - but there you go, must be some kind of conspiracy to keep me away from VPNs

-- Jason

[Peter]

For your information the chap that was developing Freeswan has discontinued the project this could be why you are unable to go to his URL!

Peter

[Anonymous]

For your information the chap that was developing Freeswan has discontinued the project this could be why you are unable to go to his URL!

Peter

I think the official site (freeswan.org) is still working but the unofficial support site (freeswan.ca) - the one with the interesting RPMs on - just gives me DNS errors. It worked a few days ago, I'm sure.

-- Jason

[smeghead]

... http://www.freeswan.ca is up as of now

[Anonymous]

... http://www.freeswan.ca is up as of now

Not from my ISP (in the UK), unfortunately. I think they must be having DNS problems somewhere - the DNS search takes ages, then gives up with "No DNS records".

-- Jason

[italo]

Jason,

I can get through...if you tell me exactly what you want I can get it for you and then send it your email address.

Italo
ilpuco_at_zerouno.info