OpenVPN vs. IPSec - Pros and Cons, what to use?

Question

interestingly I have not found any good searchresults when searching for "OpenVPN vs IPSec": I need to setup a private LAN over an untrusted network. And as far as I know, both approaces seem to be valid. But I do not know which one is better.

I would be very thankfull If you can list the pro's and con's of both approaches and maybe your suggestions and experiences what to use.

Update (Regarding the comment/question): In my concrete case the goal is to have any number of Servers (with static IPs) be connected transparently with each other. But a small portion of "dynamic clients like road warriors" (with dynamic IPs) should also be able to connect. The main goal is however having a "transparent secure network" run top of untrusted network. I am quite a newbie so I do not know how to correctly interprete "1:1 Point to Point Connections" => The solution should support Broadcasts and all that stuff so it is a fully functional network...

Thank you very much!! Jens

Answer 1

One key advantage of OpenVPN over IPsec is that some firewalls don't let ipsec traffic through but do let OpenVPN's UDP packets or TCP streams travel without hindrance.

For ipsec to function your firefall either needs to be aware of (or needs to ignore and route without knowing what it is) packets of the IP protocol types ESP and AH as well as the more ubiquitous trio (TCP, UDP and ICMP.

Of course you might find some corporate environments the other way around: allowing ipsec through but not OpenVPN, unless you do something crazy like tunneling it via HTTP, so it depends on your intended environments.

Answer 2

I have all of the scenarios setup in my environment. (openvpn site-site, road warriors; cisco ipsec site-site, remote users)

By far the openvpn is faster. The openvpn software is less overhead on the remote users. The openvpn is/can be setup on port 80 with tcp so that it passes at places that have limited free internet. The openvpn is more stable.

Openvpn in my environment does not force policy to the end user. Openvpn key distribution is a little harder to do securely. Openvpn key passwords are up to the end users (they can have blank passwords). Openvpn is not approved by certain auditors (the ones that only read bad trade rags). Openvpn takes a little bit of brains to setup (unlike cisco).

This is my experience with openvpn: I know that most of my negatives can be alleviated through either configuration changes or process changes. So take all my negatives with a bit of skepticism.

Answer 3

I use OpenVPN for a site-to-site VPN and it works great. I really love how customizable OpenVPN is for each situation. The only issue I've had is that OpenVPN isn't multithreaded, therefore you can only get as much bandwidth as 1 CPU can handle. The testing I've done, we've been able to push ~375 MBits/sec across the tunnel with no problems, which is more than enough for most people.

Answer 4

OpenVPN is

much easier to administer set-up and use in my opinion.. Its fully transparent VPN, which i love...

IPsec is more a "professional" approach with many more options regarding classical routing within vpns..

If you want just a point - to - point vpn (1-to-1), i would suggest using OpenVPN

Hope this Helps :D

Answer 5

OpenVPN can do Ethernet-layer tunnels, which IPsec cannot do. This is important for me because I want to tunnel IPv6 from anywhere that has only IPv4 access. Maybe there is a way to do this with IPsec, but I haven't seen it. Also, in a newer version of OpenVPN you will be able to make Internet-layer tunnels which can tunnel IPv6, but the version in Debian squeeze can't do that, so an Ethernet-layer tunnel works nicely.

So if you want to tunnel non-IPv4 traffic, OpenVPN wins over IPsec.

Answer 6

This might help you.

http://www.ivpn.net/pptp-vs-l2tp-vs-openvpn.php