openvpn-users — OpenVPN users list

Re: [Openvpn-users] Interaction with Windows VPN Server/Client

[bishop <bi...@pl...>]

Theepan wrote:
> Hello,
> 
> Can OpenVPN for Linux connect to a Windows NT/2000 VPN Server, and vice
> versa - can a Windows VPN Client connect to OpenVPN?

OpenVPN uses the Linux TunTap driver, version 1.1 for kernel 2.2 and 
version 1.4 delivered with kernel 2.4 .

The TUN interface has not been delivered for Windows.  There is an effort, 
and the vtun-users or vtun-devel list tracks the progress.  Go search.

The TUN device is a sub-project or co-project of the VTun project, which is 
why it uses the same lists.

> If so, can anyone mention any VPN clients (or servers), that is compatible
> with OpenVPN?

As above may imply, no.

> Thanks in advance,
> 
> 
> --
> Theepan
> 
> 
> _______________________________________________
> Openvpn-users mailing list
> Ope...@li...
> https://lists.sourceforge.net/lists/listinfo/openvpn-users


-- 
	Excellent... rime ice, a summit ridge, small trees blanketed in
	snow and ice like legions of twisted killer mutant deranged snow
	goons.			-- Erick DeOliveira 20020208
  	 
		   Describing his first Winter Ascent

Re: [Openvpn-users] Features that should be in OpenVPN or VTun

[Guus S. <gu...@sl...>]

On Sun, Mar 31, 2002 at 06:09:54AM -0500, bishop wrote:

>  - public-key encryption based on KEY records in DNS
>=20
> Hit the DNS, get the key, now you don't have to store it any place, and y=
ou=20
> can discover it.  If you can think of an easier way to discover a KEY, th=
en=20
> I'm all ears.

Really, that is not very secure. Somebody could take over the DNS
server, or spoof one, and change both IP and KEY to one of his own
servers and vpn daemons. The only way to make sure you get the right KEY
is to have the DNS replies signed. You can do that with DNSSEC for
instance. But, in order to verify the reply you get you'd need yet another
public key.

There is just no way to make sure the other end is who he is if you
don't have a public or shared private key IN ADVANCE.

>  - Dynamic on-demand default tunnels using discovered Keys
>=20
> Send all data out via the TUN, except data that's already encapsulated.  =
If=20
> a tunnel cannot be established, then send it in the clear.  Otherwise, se=
t=20
> up tunnel and shoot data.

Hmz... very hard to do, because in addition to accessing the TUN device,
which is relatively easy, you must send the "clear" packets out via the
real interfaces, which means using operating system dependent hooks.
Furthermore, there are serious security implications even when just
sending the first few packets in the clear. Why bother to encrypt the
rest at all then?

--=20
Met vriendelijke groet / with kind regards,
  Guus Sliepen <gu...@sl...>

[Openvpn-users] Interaction with Windows VPN Server/Client

[Theepan <to...@li...>]

Hello,

Can OpenVPN for Linux connect to a Windows NT/2000 VPN Server, and vice
versa - can a Windows VPN Client connect to OpenVPN?

If so, can anyone mention any VPN clients (or servers), that is compatible
with OpenVPN?

Thanks in advance,


--
Theepan

[Openvpn-users] Features that should be in OpenVPN or VTun

[bishop <bi...@pl...>]

  - public-key encryption based on KEY records in DNS

Hit the DNS, get the key, now you don't have to store it any place, and you 
can discover it.  If you can think of an easier way to discover a KEY, then 
I'm all ears.

  - on-demand connections.

Keep the IFaces up all the time.  Route data to it, and connect the actual 
TUNs with the high-water mark is reached.

  - Dynamic on-demand default tunnels using discovered Keys

Send all data out via the TUN, except data that's already encapsulated.  If 
a tunnel cannot be established, then send it in the clear.  Otherwise, set 
up tunnel and shoot data.

-- 
	Excellent... rime ice, a summit ridge, small trees blanketed in
	snow and ice like legions of twisted killer mutant deranged snow
	goons.			-- Erick DeOliveira 20020208
  	 
		   Describing his first Winter Ascent