pSeries Technical Conference L19 Brian Dolan-Goecke Atlanta, GeorgiaOctober 8-12, 2001 Linux VPN

pSeries Technical Conference Brian Dolan-Goecke

pSeries Technical Conference Contact WebSite: Phone: (612)

pSeries Technical Conference Linux VPN We will explain and build a basic Virtual Private Network (VPN) on Linux. We will begin this session looking at VPNs and how they work. Then investigate some of the solutions for building VPNs on Linux. Finally we will build a basic VPN across the Internet with Linux. A good understanding of TCP/IP and networking is preferred.

pSeries Technical Conference Session Objectives Issues to consider when building a VPN - How it works - What is needed - What technology to use Some Linux VPN options Build a basic VPN

pSeries Technical Conference VPN Definition Virtual Private Network A secure network connection across an insecure network.

pSeries Technical Conference VPN Definition Virtual Private Network (VPN) The use of encryption in the lower protocol layers to provide a secure connection through an otherwise insecure network, typically the Internet. VPNs are generally cheaper than real private networks using private lines but rely on having the same encryption system at both ends. The encryption may be performed by firewall software or possibly by routers. Link-level (layer 2 and 3) encryption provides extra protection by encrypting all of each datagram except the link-level information. This prevents a listener from obtaining information about network structure. While link-level encryption prevents traffic analysis (a form of attack), it must encrypt/decrypt on every hop and every path. Protocol-level encryption (layer 3 and 4) encryption encrypts protocol data but leaves protocol and link headers clear. While protocol-level encryption requires you to encrypt/decrypt data only once, and it encrypts/decrypts only those sessions that need it, headers are sent as clear text, allowing traffic analysis. Application (layer 5 up) encryption is based on a particular application and requires that the application be modified to incorporate encryption. Cisco. ( )

pSeries Technical Conference VPN Explanation

pSeries Technical Conference Connection Type Typical Internet Connection Traditional Remote Corporate Connection VPN Remote Cooperate Connection Detailed VPN Connection

pSeries Technical Conference Internet Connection

pSeries Technical Conference Traditional Connection

pSeries Technical Conference VPN Connection

pSeries Technical Conference VPN Connection Detail

pSeries Technical Conference How Does It Work ? 1) A host encrypts and encapsulates network packets in network packets. 2) Packets are transmitted to a remote host, via an insecure network. 3) The remote host will de-encapsulate and decrypt the network packets. 4) The original network packets are then forwarded to the local network.

pSeries Technical Conference How VPN Works

pSeries Technical Conference Why Have a VPN Secure access to corporate resources Fast access Less expensive infrastructure Easier access to corporate resources One connection for Internet and corporate

pSeries Technical Conference Why Not to have a VPN Higher cost of administration Can make your site more visible Need to be more security proactive Large possible security risk Requires more powerful systems

pSeries Technical Conference What is Needed ? Host Computers Network Connections VPN Software

pSeries Technical Conference Linux VPN Options

pSeries Technical Conference Available Linux VPNs Low Cost (Free) Solutions GRE CIPE IPIP PPTP SSH port forwarding IPSec

pSeries Technical Conference Available Linux VPNs Non-Free Solutions AltVista Tunnel CheckPoint FireWall-1 IPSec Many More...

pSeries Technical Conference VPN We Will Investigate GRE CIPE IPSec PPTP

pSeries Technical Conference Linux GRE Developed by: Cisco Available from: Part of standard Linux Kernel tarball Resources: RFC 2401 (and more...)

pSeries Technical Conference Linux GRE Advantages Free Comes with Linux Kernel tarball Works with cisco routers Tried and tested Can work through Masq/NAT Works with IPv6

pSeries Technical Conference Linux GRE Disadvantages No encryption

pSeries Technical Conference Linux CIPE Developed by: Olaf Titzl Available at: Resources:

pSeries Technical Conference Linux CIPE Advantages Built for VPN Can use blowfish or PKE encryption Works through/with SOCKS, NAT, Dynamic IP Free

pSeries Technical Conference Linux CIPE Disadvantages Uses udp (for good reason) Seems slow now and then Only works for IPv4

pSeries Technical Conference Linux IPSec Developed by: FreeS/WAN (Linux Version) Available at: Resources:

pSeries Technical Conference IPSec Advantages Should work across platform/vendors/devices Will work with IPv6

pSeries Technical Conference IPSec Disadvantages Difficult to implement Has problems with NAT/Masq Problems with authentication

pSeries Technical Conference Linux PPTP Developed by: Matthew Ramsay, Kevin Thayer, David Luyer, Patrick LoPresti, Philip Van Baren, Peter Galbavy and more Available at: Resources:

pSeries Technical Conference Linux PPTP Advantages Compatible with Microsoft Can be server or client

pSeries Technical Conference Linux PPTP Disadvantages Compatible with Microsoft Has some security holes

pSeries Technical Conference Build Linux VPN!

pSeries Technical Conference VPNs to Create GRE CIPE

pSeries Technical Conference Need Software IP and Network Address IPChains config Routing

pSeries Technical Conference Tools We Will Use ifconfig route ipchains

pSeries Technical Conference VPN Basics Define devices Create devices Connect devices Adjust routing/ipchains

pSeries Technical Conference GRE Steps Determine IP addresses & network Load module Configure GRE tunnel Setup routing Modify IPChains

pSeries Technical Conference CIPE Steps Determine IP addresses & network Download software Compile software Configure software Load module Start ciped daemon Set up routing Modify IPChains

pSeries Technical Conference CIPE Notes Can handle up to 99 devices Auto-creates devices Use "device ciped0" option in config file

pSeries Technical Conference CIPE Config File #/etc/cipe/options # Surprise, this file allows comments (but only on a line by themselves) debug=yes # This is probably the minimal set of options that has to be set # Without a "device" line, the device is picked dynamically device ciped # the peer's IP address ptpaddr # our CIPE device's IP address ipaddr # my UDP address. Note: if you set port 0 here, the system will pick # one and tell it to you via the ip-up script. Same holds for IP #me bigred.inka.de:6789 me :2048 #...and the UDP address we connect to. Of course no wildcards here. #peer blackforest.inka.de:6543 peer :2048 # The static key. Keep this file secret! # The key is 128 bits in hexadecimal notation. key 3333fd20adf9c0ccf9eff2393bbb3e41

pSeries Technical Conference Other Issue DNS Broadcast or Not Authentication

pSeries Technical Conference Resources Linux Docs Linux Route2 HowTo - Linux Masquerade HowTo - Linux VPN HowTo - Linux Network Administrators Guide (NAG) Virtual Private Network Consortium -- FreeS/WAN IPSec --

pSeries Technical Conference Books IPSec: The New Security Standard for the Internet, Intranets, and Virtual Private Networks By Naganand Doraswamy & Dan Harkins Prentice Hall, Virtual Private Networks, 2nd Edition By Charlie Scott, Paul Wolfe & Mike Erwin 2nd Edition December

pSeries Technical Conference Version Info Brian Dolan-Goecke Linux VPN Presentation Version /10/2001