Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Most firewalls/VPN appliances today allow you to select one of the various tunneling technologies available. The most popular are IPSEC and PPTP, although I've heard good things about OpenVPN. Is there any benefit to OpenVPN over the other two? Am I better off using IPSEC or PPTP?

Most importantly which is the most secure or are they 'good enough'?

share|improve this question
add comment

closed as primarily opinion-based by HopelessN00b Genius of network, dawud, Ward, Rex, Falcon Momot Feb 24 at 0:46

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

4 Answers

up vote 8 down vote accepted

Frankly any VPN which doesn't require a custom client is a good one. As it's a SOHO environment I assume that you don't have a requirement to authenticate against some back end user/password system like AD or LDAP.

PPTP has been in Windows for a long time as it's a Microsoft technology, but pretty much every OS now supports it. In the past it's had flaws, but has matured well. PPTP does not require an X509 certificate (although if you're using EAP it does)

IPSEC is a more open standard and is commonly used to protect server to server communications because it works on layer 3 and so is transparent to applications. Authentication is either via a preshared key or via certificates.

There's no real answer here. They're all much of a muchness these days. If you want multiple users connecting and want to audit then PPTP provides usernames and passwords, IPSEC doesn't - you can only change the preshared key to stop people authenticating and that affects everyone. Certificates aren't really doable for SOHO environments in my opinion.

share|improve this answer
    
Hasn't there been security flaws recently in using PPTP for VPN? I've been looking at VPN recently and been discouraged from using PPTP (which we used to use). –  kafka Nov 29 '12 at 11:33
add comment

I speak from experience in saying OpenVPN is much easier to set up and deploy than IPSec and its cousins. It's also much more flexible than Hamachi.

OpenVPN is definitely secure. It uses SSL to negotiate the connection and Blowfish (or AES if you prefer) to secure the connection. The algorithms have been in the public domain for many years and been subject to severe cryptanalysis. The PPTP flavor of IPSec is not really secure anymore. Hamachi has good security.

Your OpenVPN implementation is completely under your control. You can't say the same about Hamachi, which goes through LogMeIn's servers. You can't be sure of what Hamachi or the IPSec clients are really doing, because they are closed-source and proprietary systems. You also don't get the degree of configurability with those that you get with OpenVPN.

Don't misunderstand my opinion of Hamachi. It's a great product. I just don't think it's necessarily the best for the purpose.

share|improve this answer
add comment

OpenVPN requires its own driver, but it's a full featured VPN solution.

share|improve this answer
add comment

Well, depending on your existing infrastructure, I would have two recommendations:

PPTP built-in to Windows if you have a server that everyone would connect to. Most routers and other things tolerate it pretty well these days. Even DD-WRT supports it in both client and server modes... And out of the box support for windows clients is always a bonus.

Hamachi - a free p2p style VPN that generally "just works". I don't have a ton of experience using it, but having helped several people who do for SOHO type environments, it seems to fit the bill perfectly.

share|improve this answer
    
+1 for Hamachi. I'd heard about it a long time ago, and recently started using it. It was a no brainer to set up, and does everything I need it to. –  Milner May 7 '09 at 18:38
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.