Re: [gentoo-user] [OT] What is the best open-source VPN server for Linux?

[Grant Taylor <gtaylor@gentoo.tnetconsulting.net>]

On 04/06/2018 11:58 AM, Mick wrote:
> I think you mean IKEv2 + IPSec?

I don't remember IKE<anything> involved the last time I had to manually 
set up an IPSec connection between two Windows systems (or Windows and a 
Netgear router).  I think it was /completely/ manual and PSK.

> IKEv2 is used to exchange keys and IPSec is used to set up and encrypt the 
> tunnel itself.  The tunnel is operating at layer 2, so TCP/UDP/ICMP will 
> all be encrypted when sent through through the IPSec encrypted tunnel.

I remember doing a little bit with IKE 10+ years ago back when it was 
OpenSWAN / FreeSWAN.

> This is using L2TP for encapsulating the frames + IKEv1 for secure key 
> exchange + IPsec for encryption of the L2TP tunnel.

ACK

> Well said:

*chuckle*

> https://en.wikipedia.org/wiki/Point-to-Point_Tunneling_Protocol#Security
> 
> It is an obsolete method with poor security.  I would not use it under 
> any circumstances, unless security is of no importance.

Agreed.

> As I mentioned before, there is also IKEv2+IPSec, which allows the client 
> to roam between networks without dropping the connection.

Intriguing.  I've never considered IPSec with a road warrior, much less 
an established connection with a changing IP address.  I would have been 
much more likely to look at OpenVPN or Wireguard or OpenSSH.

> Finally, there is SSTP encrypting PPP frames within TLS.  I don't know 
> why one would use this instead of OpenVPN, except that it comes as part 
> of the MSWindows package, while OpenVPN has to be installed separately.

SSTP is a new one on me.

> +1
> 
> They are also easier to set up initially, because both MSWindows peers 
> will use the same combo of encryption suites, ciphers, etc.  Half of 
> the pain of getting MSWindows to work with a Linux VPN gateway is often 
> finding how to configure the cipher, hash and X509v3 extensions of a 
> TLS certificate in a way that MSWindows will not barf;  e.g. IIRC, last 
> time I looked at a Windows 7 IKEv2/IPSec VPN, the TLS certificates would 
> only accept AES128 keys and SHA1.  Anything more onerous would not be 
> accepted by the MSoft TLS key manager.

Agreed.



-- 
Grant. . . .
unix || die