Connecting to Microsoft VPN with Linux?

[Michael Mansour]

Hi,

I have a job to do for a site which currently has two
Debian Linux boxes connected via VPN (using ipsec) to
two of its state offices.

In one state (the other state from here), this
particular company is supported by a mob who don't
know anything about Linux, so they wish to convert the
company to Microsoft VPN and have asked me what is
required on my end to make Linux support their
Microsoft VPN solution their end.

The sites are connected via an ADSL link, which the
debian linux box in my state handles (for dialup and
connection establishment etc).

I don't mind converting the company in my state to FC1
or whatever, but I'm wondering:

* can Linux VPN support Microsoft VPN?

* are there any ADSL modem/routers which support
Microsoft's VPN?

Any ideas or comments are welcome.

Michael.


Find local movie times and trailers on Yahoo! Movies.
http://au.movies.yahoo.com

[David L Norris]

On Sun, 2004-05-02 at 19:43, Michael Mansour wrote:
>  * can Linux VPN support Microsoft VPN? 
I used to use PoPToP to provide VPN service to Windows NT4 and 2000:
  http://www.poptop.org/

Here is a Linux and BSD PPTP client (or, "HP Presents PPTP"):
  http://pptpclient.sourceforge.net/

>  * are there any ADSL modem/routers which support
>  Microsoft's VPN? 
All of the affordable VPN end-points (Linksys, Netgear, etc) I've seen
use IPSec.  Beware of the ones that do claim PPTP support because that
usually means they support pass-through (to _one_ internal machine). 
IPSec is the standard, afterall.  I'm not sure why anyone (except MS)
would want to support anything else.  Everything has good IPSec support
where only Microsoft supports PPTP.

Google finds some pointers on setting up a PPTP end-point with some
Cisco routers (search for "cisco pptp").  It's not clear if you can make
outbound connections to a Windows VPN server, though.

In the end, it may be less trouble to build your own vpn
router/firewall.  At least then you know its capabilities.  Maybe setup
your existing Debian IPSec machine to use HP's pptp-client?

-- 
 David Norris
  http://www.webaugur.com/dave/
  ICQ - 412039

[Nigel Wade]

Michael Mansour wrote:
>  Hi,
>  
>  I have a job to do for a site which currently has two
>  Debian Linux boxes connected via VPN (using ipsec) to
>  two of its state offices.
>  
>  In one state (the other state from here), this
>  particular company is supported by a mob who don't
>  know anything about Linux, so they wish to convert the
>  company to Microsoft VPN and have asked me what is
>  required on my end to make Linux support their
>  Microsoft VPN solution their end.
>  
>  The sites are connected via an ADSL link, which the
>  debian linux box in my state handles (for dialup and
>  connection establishment etc).
>  
>  I don't mind converting the company in my state to FC1
>  or whatever, but I'm wondering:
>  
>  * can Linux VPN support Microsoft VPN? 
I never got it to work, but I didn't really try that hard.

>  
>  * are there any ADSL modem/routers which support
>  Microsoft's VPN? 
My Vigor 2600 does it perfectly well. I've a permanent VPN from home to work.

>  
>  Any ideas or comments are welcome. 
Ask the Windows people at the other site what is required to make Windows 
connect to your Linux VPN (just for a laugh).

With Vigor boxes you can setup a VPN from Vigor to Vigor without requiring 
either Windows or Linux to be involved.


-- 
Nigel Wade, System Administrator, Space Plasma Physics Group,
             University of Leicester, Leicester, LE1 7RH, UK
E-mail :    nmw(a)ion.le.ac.uk
Phone :     [phone], Fax : [phone]

[Christoph Wickert]

Am Mo, den 03.05.2004 schrieb Michael Mansour um 02:43: 
>  Hi, 
[snipped] 
>  I don't mind converting the company in my state to FC1
>  or whatever, but I'm wondering:
>  
>  * can Linux VPN support Microsoft VPN? 
Yes. David already gave you the URLs.
But I recommend not to do! Please read my other posting 
"Re: Connecting to Microsoft VPN" from Tue, 04 May 2004 15:12:50.

>  * are there any ADSL modem/routers which support
>  Microsoft's VPN?
>  
>  Any ideas or comments are welcome. 
And now for the comments:
1. Don't use MS PPTP if you don't need to. It's VERY insecure, so I
would not dare using it for a commercial project.
2. Never change a winning team. PPTP was more easy to install on Debian
than on Fedora, because Fedora kernel is missing the module bsd_comp.o.
On Debian I was able to set up a pptp server within 5 minutes.
3. Use something else: IPsec (you will most likely need a commercial
client on the windoze end) or OpenVPN. OpenVPN is available for Win32,
too, it's save, stable, fast and works well with firewalls, for it only
uses udp.

Regards

Christoph

[Lamar Owen]

On Sunday 02 May 2004 20:43, Michael Mansour wrote:
>  In one state (the other state from here), this
>  particular company is supported by a mob who don't
>  know anything about Linux, so they wish to convert the
>  company to Microsoft VPN and have asked me what is
>  required on my end to make Linux support their
>  Microsoft VPN solution their end. 
>  * can Linux VPN support Microsoft VPN? 
Microsoft's current VPN is a hybrid three-layer beast.  It's PPP over L2TP 
over IPsec.  All of these are supportable under Linux.  The configuration is 
not easy.  There is a commercial Linux-based solution for a Linux VPN 
_server_ that works with Microsoft's VPN clients, including a nice 
Certification Authority and a Windows certificate installation Wizard that 
makes it very easy to connect Microsoft clients to the Linux VPN firewall.  
The product is SmoothWall's Corporate Server 3.0 + SmoothTunnel 3.1.  The VPN 
portion (SmoothTunnel) is licensed based on the number of configured tunnels.  
Each L2TP client gets a separate tunnel.  A reseller local to me is Joyner 
Network Solutions.  E-mail ben(a)caresweb.com for more information.

The Microsoft VPN, for the Road Warrior case (that is, a dynamically assigned 
IP address 'dialing' in to a fixed gateway) is very simple to configure on 
the client side (once you get your certificates in the right place) and is 
very easy in concept, being that it is Just Another Dialup Networking 
Connection.

Don't use PPTP as it has known security issues.

Win95/98/ME L2TP VPN DUN client software is available free from Microsoft.

I am using the SmoothTunnel product here and was extremely impressed by the 
polish of the web GUI tools for configuration.  To say it was simple is an 
extreme understatement: Generate CA; Generate Host Cert; Generate Client 
Cert; Create L2TP RoadWarrior Tunnel (the only hard part here is 'Client IP' 
which is the IP address _on_the_inside_ network for the tunnelled host to 
use); download certs (CA in PEM, Client in PKCS12) (simple web form based 
download); install certs using provided GUI Wizard; configure the DUN VPN 
properly (a couple of configuration points are not default).  The Win2k3 
setup of the same thing is of about the same complexity.

I tried doing this all by hand using l2tpd and hand-generating the CA, host, 
and user certs and hand importing everything into Windows.  While it DID 
work, it took a very long time to get right, and the SmoothTunnel stuff Just 
Works.  But all the pieces you need are available free: OpenSWAN for the 
IPsec, the stock PPP package, and L2TPD (see Nate Carlson's page at 
http://www.natecarlson.com/linux/ipsec-x509.php for more info, as well as 
Jacco's page at http://www.jacco2.dds.nl/networking/freeswan-l2tp.html).  But 
beware; configuration is not at all easy.  But Jacco's website in particular 
has everything you need to know.

Also available is the Astaro Security Linux and the Astaro IPsec Client at 
www.astaro.com.

>  * are there any ADSL modem/routers which support
>  Microsoft's VPN? 
IPsec needs to be put into 'NAT Traversal' mode for the typical 
VPN-passthrough solution to work.  The Windows side also needs the 818043 
update applied.  NAT-traversal just causes IPsec to tunnel over UDP port 500 
instead of using the default IP protocol 50.  Look for the keyword 'VPN 
passthrough' and you would want the 'many clients' type.
-- 
Lamar Owen
Director of Information Technology
Pisgah Astronomical Research Institute
1 PARI Drive
Rosman, NC  28772
[phone]
www.pari.edu