Comment by 616c | Hacker News Reader

Comment by 616c | Hacker News Reader

Parent Full thread

So I know many people use OpenVPN these days, but does anyone use L2TP/IPSec or IPSec? I asked because when recently searching this topic, despite the author mentioning lots of dated materials, most of what I find is archaic. This post mentions ipsec-tools, but it has been clear that since the IPSec changes/patches went inline into the kernel for 2.6.x and beyond, these have slowly become more relevant over time, and that ipsec-tools and/or raccon to do L2TP and IPSec or pure IPSec is generally outdated and now only really suited to the BSDs because, as the articles mentions, it is more germane to that architecture.

And the difference between FreeSWAN, LibreSWAN, and StrongSWAN was very confusing to me unitl I read this.

http://serverfault.com/questions/173158/strongswan-vs-opensw...

I mean setting up VPN is no trivial pursuit, but the amount of effort to set any of these up to use native VPN clients for my mobile (Android devices) encouraged me to potentially consider StrongSWAN once I really review the documentation and learn as much as I can.

What are others doing?

Thanks for the cool article either way.

I use IPsec in addition to OpenVPN, primarily because that's all iOS used to support. Since iOS 5 or 6 (I think; maybe even as late as version 7?), Apple has allowed third-party VPN apps, so with an "official" OpenVPN client now available in the iOS App Store, it's not as important as it was. However, I've left it running as a fallback solution to OpenVPN (some hotel firewalls, for example, permit IPsec but actively block UDP-based OpenVPN).

I use ipsec-tools, as circa 2012 when I was originally setting this up, it was the only free software IPsec solution I could get to work with iOS clients, but based on this vulnerability I've now disabled it and will try StrongSWAN again.

You can also use OpenVPN on port 443 as a last resort (only as a last resort since TCP over TCP is a bad idea[1])

1- https://news.ycombinator.com/item?id=2409090

Yes, I do that as well, but I think that IPsec is a better backup solution.

In addition, tunneling TCP in TCP to hide OpenVPN behind a HTTP proxy, lest it look out of place and be easily fingerprinted as OpenVPN on packet analysis is why I wanted to avoid it this time around.

https://www.bestvpn.com/blog/5919/how-to-hide-openvpn-traffi...

Plus, I wanted to better secure my home network AND make it accessible remotely (in a dorm-like accomodation with enterprise-grade NAT with Cisco gear), I thought an IPSec tunnel would be optimal as well.

IPSEC is a usability nightmare, mostly on account of the implementations.

Well, I was under the impression that projects like Streisand exist because OpenVPN is no cake-walk either.

https://github.com/jlund/streisand

EDIT: Forgot the link, like a proper idiot.

I'm really glad you posted that link, because I think Streisand is an important project. I wasn't under the impression that Streisand existed because OpenVPN was hard. Rather, it tries to support everything possible, and helps you set up some of the more esoteric solutions out there in case that is all your users can support. OpenVPN is just along for the ride.

We use L2TP/IPSec to VPN into our AWS VPC. Amazon's VPN solutions aren't great, and propping up a VPN endpoint on a micro instance and an elastic IP is fairly easy. Also makes it easier to SSH/RDP/MySQL to instances in your private subnet from trusted developer machines at our office. L2TP/IPSec is built in to modern versions of OS X and Windows (though for Windows you have to tweak hidden settings to work with NAT properly)

If you have time to link to somewhere listing those hidden settings, that would be really helpful.

https://support.microsoft.com/en-us/kb/926179

The article mentions Vista and Window Server 2008, but it applies to Windows 7 and Windows 8 as well. There are some Stack Overflow threads as well.

For the VPN setup, I largely followed these instructions:

http://www.stormacq.com/build-a-private-vpn-server-on-amazon...

There are a few typos in the scripts cited in the article especially around saving the iptables rules.

OS X's native VPN client worked out of the box

>but does anyone use L2TP/IPSec or IPSec

IPSec is still the enterprise defacto standard. Its pretty much everywhere.

Yeah, it a little different for the FOSS home hobbyist, but for companies with a budget, its a trivial addition to their infrastructure (Cisco, Sonicwall, etc). FOSS IPSec implementations seem to be pretty non-existant in practice from my own experience and I only see FOSS-only shops using OpenVPN, which is OpenSSL based (which, of course, suffered from heartbleed).

> I only see FOSS-only shops using OpenVPN, which is OpenSSL based (which, of course, suffered from heartbleed).

Exactly. I'd love to see a simple, auditable and secure open source VPN software. (not OpenVPN)

Try SigmaVPN and ShadowVPN. Very simple and stateless VPN implementations based on libsodium.

This is why I ask. I did not want to post it again (I am sure I am not the first), but this is SoftEther thing masquerades as these different VPN protocols while being the same backend.

http://softether.org/

There are a lot of places using IPSec VPNs for point-to-point connections, in part because there's an awful lot of equipment out there that supports them.

Heck, Cisco's "Small Business" RV router series (RV042/RV082/RV016/RV042G and possibly others) are still being sold after several hardware revisions (still kind of long in the tooth), and they support all of two VPN types: IPSec and PPTP.

Oh, I am aware. I work in a such an org with the Cisco IPSec system. I have mutliple that I use/evaluate for work purposes, but when I asked this I am more interested in the open systems not tied to a dedicated appliance, or at least can do both (I see "OpenVPN appliances" advertised on the OpenVPN page these days).

I run transport mode IPSec on my LAN at home under Linux with racoon to encrypt NFS with certificate based auth. It was a huge pain in the ass.

You got a write-up on that? It sounds like a daunting task, so funny blog post with profanity about Linux config (used to write them, no one would read them) are something I really enjoy.

So definitely write about that. There is so much bullshit and misinformation I have read this week alone on VPN config in *nix environments, it's astounding. My shakiness was only confirmed by this article.

I'm planning on going through some of my old projects and writing blog posts about them over the next couple of months, and I will add that one to the list. It was indeed, a massive pain in the ass.

These days for VPNs it's hard to beat OpenVPN with TLS auth enabled and using keys, not passwords/passphrases.

Why not passwords with LDAP and a psk?

Password protected keys (edit:certificates), yes, but not regular user/password no matter if it's LDAP backed or anything else... (but I think you can do password and key, but I need to check docs)

I'm in a meeting and drawing a blank on what the primary reason was for avoiding password-only... I'll update if I can remember the reason besides "passwords are easier to crack"

LDAP is nice to grant and revoke access and have passwords in sync with the computers at work.

Maybe the certificates could be stored in LDAP.

Almost any decent enterprise identity management solution (read: Active Directory, FreeIPA) includes user certificate management in some fashion; or if you want a separate CA for VPN access it's not hard to write a couple scripts to generate user certificates and revoke them as needed.

Reply on news.ycombinator.com