From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 7A70E1382C5 for ; Wed, 4 Apr 2018 22:02:34 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 08B0DE0AC1; Wed, 4 Apr 2018 22:02:26 +0000 (UTC) Received: from tncsrv06.tnetconsulting.net (tncsrv06.tnetconsulting.net [IPv6:2600:3c00::f03c:91ff:fe26:8849]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 89773E0A8D for ; Wed, 4 Apr 2018 22:02:24 +0000 (UTC) Received: from REDACTED ([IPv6:2620:0:102a:11:fe50:e322:5780:92c6]) (authenticated bits=0) by tncsrv06.tnetconsulting.net (8.15.2/8.15.2/Debian-3) with ESMTPSA id w34M2L2s027138 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO) for ; Wed, 4 Apr 2018 17:02:22 -0500 ARC-Filter: OpenARC Filter v0.1.0 tncsrv06.tnetconsulting.net w34M2L2s027138 Authentication-Results: tncsrv06.tnetconsulting.net; arc=none header.d=tnetconsulting.net ARC-Seal: i=1; a=rsa-sha256; d=tnetconsulting.net; s=2015; t=1522879342; cv=none; b=LU5mY/iRBQ4bP8CBqpCG2MOiHST+2KoB+r0yODgU16NXrRMjZ654Ifb97gqok/+604bqm7MsGlAOAAnbJq7aLcV3SjGtsIK8yGjtPQqAuQHd3ef7MHwF8ctvCRsGZVgqx82Ao4jNrhBstqv5BUhvVVsg64Zv6N7mU4rFsb3uGGM= ARC-Message-Signature: i=1; a=rsa-sha256; d=tnetconsulting.net; s=2015; t=1522879342; c=relaxed/simple; bh=tW9ve2DdiArM0QgJTkaoYgpoELrpEV6D/clJciTIK+E=; h=Subject:To:From:Message-ID:Date:User-Agent:MIME-Version: Content-Type:Content-Language:Content-Transfer-Encoding; b=YFRVQAgGyWQnY+l1aR4vaZXTp8tVFtmYFOg+AtEWiPJblJQAQm+dKmm4fjhx0Uv1xGrB+WGjqkVYdWSuXpEE3xrfwOgrWbNMtAQ5PtkW9WnS8FBRpXr8mJ8Qb/ujrtqPIrnkjLlD+JlGUweZ7XQ0a5cgx2WjmvxkT0IUXkiwXu0= ARC-Authentication-Results: i=1; tncsrv06.tnetconsulting.net; none Subject: Re: [gentoo-user] [OT] What is the best open-source VPN server for Linux? To: gentoo-user@lists.gentoo.org References: From: Grant Taylor Organization: TNet Consulting Message-ID: Date: Wed, 4 Apr 2018 16:02:20 -0600 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.6.0 Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@lists.gentoo.org Reply-to: gentoo-user@lists.gentoo.org MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-Archives-Salt: b4d0092d-1c9d-4ff1-b7f3-f424b8e27e8b X-Archives-Hash: 97385fdb249ee87849dc98217be05012 On 04/04/2018 02:18 PM, gevisz wrote: > A friend of mine asked me to recommend him an open-source VPN-server > for Linux but unfortunately I never used one. That's a loaded ask. > After some googling, I have found OpenVPN but do not know if it is the > best choice that suits his purposes, namely to access local network that > does not have its own fixed IP from the outside. Okay.... > To be more precise: the local network to be accessed to from the outside > is part of another local network. The latter (outer) network has its > own fixed IP but the former (inner) network gets its IP via DHCP. So, > it is impossible to connect to a computer in the inner network from the > outside directly. Is this toplolgy accurate? (Client)---(Internet)---(OR)---(IR)---(Host) I'm guessing that your friend (client) wants to access something (host) on the inner network. But to do so requires passing through the Internet through Outer Router (with a static IP on the outside (left)) and through the Inner Router (which has a dynamic IP on the outside (left) obtained via DHCP)). Is that correct? What sort of control does your friend have on the OR & IR? Is NAT in use on either OR or IR? What sort of > The computer in local network to be connected runs Windows. The said > friend of mine have tried to run some VPN server from Windows but it > somehow hangs the "inner" computer when his "outer" computer has problems > connecting to the Internet. Are you saying that the Host in the diagram above is running Windows? Or are you referring to a different system? > So, now his idea is > 1) to run a virtual machine in the "inner" (Windows) computer, > 2) to install into this virtual machine very lightweight Linux server > only to run in it a VPN-server that should help him to connect from the > outside to the "inner" host (Windows) computer, which has its fixed IP > within the inner local network. The VM may or may not be needed. Assuming that NAT is in play on OR and IR (worst case), then just about /any/ form of VPN initiating from the outside will be fraught with uphill battles. It is likely possible that your friend can reconfigure both OR and IR to forward a port from the Internet to Host. But that will likely mean that IR will need to have a static IP on it's outside interface. - I'm guessing this can't be done or that it would have already been done. I think that your friend's best bet is to have the IR initiate an outbound VPN to something on the Internet that the Client can then initate connections to. (I'm happily using a $5/month Linode VPS to do this.) There may be ways to make this work without having the Host initiate outbound connections, but I'm not sure what they would be. As for which VPN, a number of people like OpenVPN. I personally prefer OpenSSH's ability to do a routed (L3) (or bridged L2) VPN. (I've got SSH exposed already, so it's one less port to expose.) I see a number of people bragging about WireGuard. Of course there are the old PPTP / L2TP / IPSec, though I would avoid them for this install. I'm sure there are a number of other VPN technologies that I'm not thinking of. I'm using OpenSSH's VPN feature between an inside client machine to an external Linode VPS that functions as a midway rondevu point. -- Grant. . . . unix || die