7

If considering Windows only environment, what's the advantage of introducing OpenVPN as the company VPN service, instead of Windows built-in protocols? Especially the new SSTP protocol already overcome the one of the weakness of PPTP, which may not go over firewall/NAT.

I'm wondering is there any reason not to use Windows integrated solution. The strength of the security can be an issue but I'm not sure how different they are (I know MS VPN was vulnerable but is it still?)

Thanks.

3
  • A couple of brief observations re: PPTP: Many NAT devices handle PPTP just fine. In 2000, making sure a NAT device could handle forwarding multiple GRE flows simultaneously and statefully was a problem, but that hasn't typically been a problem for the last few years. PPTP w/ 128-bit encryption has a very reasonable level of security. The encryption-related problems with PPTP stem from using 40-bit keys. Nobody should be using 40-bit keys for anything! Aug 20, 2010 at 10:25
  • As described below, PPTP passthrough doesn't work in hotels or companies, although major routers out there can handle it by default. Sometimes we got complaint from sales person that they cannot reach the office through the hotel. And yes, I agree 128-bit security is good enough. It's enough secure than try to social-hack to employees!
    – Jose
    Aug 20, 2010 at 13:08
  • 2
    In case somebody blunders into this, 5+ years later, PPTP is not a reasonable solution for anybody anymore (and hasn't been since 2012): cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2 Dec 21, 2015 at 16:10

6 Answers 6

12

The availability of clients for OpenVPN is more wide than that of SSTP (at least, right now). I can buy an IP phone with an embedded OpenVPN client, for example. AFAIK, Microsoft didn't back-port the SSTP client to Windows XP (which, initially, they said they would), so that cuts off a large client-base. In contrast, though, SSTP doesn't require the installation of third-party software on supported client operating systems.

There are no per-client license fees with OpenVPN as there are with Microsoft's offering. (I won't offer my opinion on which specific usages need a Windows CAL and which doesn't... In some documentation Microsoft claims that a DHCP client needs a CAL, so I tend to give them a wide berth. If my janitor dusts around my Windows Server machine I probably need a CAL for them. The right place to find out about licensing is the software "manufacturer" anyway...)

The functionality built-in to the OpenVPN client to receive "pushed" routes is more flexible than Microsoft's VPN client (unless you use the CMAK, and that hasn't been reliable for me in practice).

5
  • 2
    +1 for the Janitorial CAL. Seriously though, because the licensing issue is oft ignored. Aug 20, 2010 at 12:07
  • I know the pushed route issue and I thought it's one of advantages of OpenVPN. Can CMAK solve this? isn't it reliable?
    – Jose
    Aug 20, 2010 at 13:04
  • Old answer Evan, but I just wanted to confirm your findings - DHCP does not fall in the CAL-free section of Windows (like IIS etc). We're using ISC DHCP in our guest network :(
    – pauska
    Jul 8, 2012 at 10:36
  • @pauska: Did you find that in writing anywhere, out of curiosity? Jul 9, 2012 at 19:05
  • Yes, deed deep somewhere in a CAL doc that I can't remember where I found. I even got a MS rep to confirm it. Unbelievable but true.
    – pauska
    Jul 9, 2012 at 20:12
11

The main Advantage of OpenVPN in a Win only environment is the use of UDP as underlying bearer since this avoids the 'TCP meltdown problem' see http://sites.inka.de/bigred/devel/tcp-tcp.html for more Info about TCP in TCP.

hth, cheerio Steve

1
5

Attention that unfortunatly SSTP (as of November 2011) will not work over a proxy server with authentication. This is documented, although not many realize it.

It is also possible for the network administrator for a non-authenticating proxy to detect SSTP headers and drop the connections. So the statement that it goes across any firewall, etc... is true with some reservations.

OpenVPN is capable to go over HTTPS on a proxy with authentication. It is much harder to block this traffic because it looks like normal "SSL", but it is not! It is possible with some package inspection on the first bytes of the contents to block those packets. OpenVPN in this mode looses the "UDP" performance gain, because OpenVPN would be working in TCP mode. So in this sense it is equal to SSTP.

For OpenVPN, on the server side, you need to have two public IPs if you also have a web server on port 443, this for the commercial edition. For the comunity edition it is possible to share the 443 port on the same IP, because the server detects non-OpenVPN protocol a redirects the traffic to a alternative web server (443). This only works in the Linux version of OpenVPN server.

On SSTP, it is possible to share the same IP/port 443, for both SSTP traffic and normal web server protected pages.

On SSTP there can be a SSL offloading device on the network before reaching the RRAS server. On OpenVPN, because the traffic is not really "true" SSL, i.e the openVPN protocol encapsulates a SSL payload, this is not feasible.

On OpenVPN community, you need to handle the KPI infrastructure, certificates, etc, which can be a harder learning curve some times... (on the community edition). On the commercial edition this task is made easier.

On OpenVPN commercial, the authentication can be integrated with LDAP (for instance on a AD). On community this is not possible (not completely sure, but almost!). The idea e more around client certificates; although possible to use simpler certificates schemes.

O SSTP, this is included obvious.

OpenVPN work on UDP mode with is very good, but then PPTP also works on UDP for the data channel (GRE protocol). Because the question is the comparison between SSTP and OpenVPN, lets just assume we are comparing TCP traffic.

So you see... there is not a better or worse... In my case I fought hard to choose one due to my functional requirments... and still not fully happy with the one I had to choose (SSTP), but fairly satisfied. I say this because if the network (hotel) blocks PPTP then SSTP can be used... this is handled automatically by the VPN client.

OpenVPN client has a similar fallback mechanism.

SSTP is already support by Linux, but the project seems to be in the initial stages.

2
  • Thanks for the great comment, Luis! Looks I agree that there is no silver bullet in VPN yet...
    – Jose
    Nov 28, 2011 at 4:02
  • community edition with ldap-auth-plugin works very well, thank you!
    – Olivier S
    Mar 16, 2013 at 15:46
2

PPTP is considered cryptographically broken and should not be used. It's not just a matter of key length, but of serious flaws in authentication and in Microsoft Point-to-Point Encryption (MMPE).

My own preference, from the standpoints of robust architecture, wide support, high security, reliable network traversal, and solid performance, is OpenVPN.

1
  • Consider Bruce Schneier's cryptographic analysis of PPTP after Microsoft addressed many of the encryption faults in 1999: link Schneier felt that Microsoft had addressed the worst weaknesses, but he wasn't happy that it still used passwords for authentication as weak passwords e.g. "ILoveMrSnuggles" were very vulnerable to attack. Unfortunately, while this may now seem like PPTP was OK, despite the gossip, this then turned up: Microsoft Security Advisory (2743314) link
    – GNTC
    Dec 30, 2013 at 15:18
1

The only advantages I see on SSTP are not technical: obvious better integration on Windows, and possibly easier to configure (also because of being less powerful).

Advantages of OpenVPN:

  • can tunnel over UDP

This is soo important in any bandwidth restricted environment, where a TCP tunnel gets stuck very quickly.

  • can tunnel over one single port in UDP (apart from TCP)

Some say, https TCP port 443 goes in any environment (hotel, etc.), which is a reasonable assumption, but it’s not UDP. – I find that DNS UDP port 53 also goes in many environments, and you can configure OpenVPN there!

  • available for far more Windows platforms (and others, of course), both as client and server
  • can tunnel networks

I’m leaving the “Windows-only” here... but if you want to connect a team in a hotel room, it can get tricky... One option is to arrive with a little router (running OpenVPN) and let the computers/phones connect there. You can also do this with a computers running Linux or a rooted Android smartphone, ...

I did this with a router running OpenWRT or Freetz, an “aftermarket firmware”.

  • can be configured to survive network changes

With the “float” option, I made my smartphone survive switches between WiFi covered areas and 3G mobile network, without losing connections! (A long-standing bug makes this work only in peer mode.)

I finish here.

-1

Another advantage of OpenVPN is that you can run it over port 443 (HTTPS). This becomes important when your clients sit in a hotel room, as many hotels block traffic on ports other than 25,80, 110 and 443, and then your normal VPN connections don't work any longer. The same is also true for a lot of big companies.

1
  • 2
    MS SSTP uses 443, so this is not advantage of OpenVPN...
    – Jose
    Aug 20, 2010 at 13:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .