Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Got some IP data-loggers (that measure temp., humidity, light-level) sitting inside bunch of warehouses / stores with each warehouse / store being a different customer from my standpoint. These data-loggers provide information over clear-channel HTTP (Basic-Authentication). Also, my server sends out commands (again over HTTP) to data-logger, to reboot, do firmware upgrade etc. The way I have it rigged up today is those are assigned IP-address in the private-192.168.X.X range, each with a unique TCP port#, and the ADSL-Router does port-mapping to make those visible to my server which polls those data-loggers (at each site) every 5 minutes, to download base64 encoded data. The data-loggers cannot be software upgraded (I've no control over them), yet, I would somehow secure the flow of information from the ADSL-router to my server. Today the number of such customers is small and manageable, but I would like to scale this out, thus looking for a solution that scales well, provides me with necessary security, and is cost-effective.

My expectations of 'security' here are:- - No eavsdropping / snooping - No man-in-the-middle - No tampering - No spoofing It is safe to assume that my main interest is in ensuring that the connectivity between my server and the ADSL-router is secure. Inside the warehouse, I am not worried as much.

On the ADSL router, I have the firewall up, with holes poked (obviously) for the specific ports corresponding to the data-loggers and the mapping created. Could VPN be an answer ? What are some of the alternatives, gotchas, pit-falls etc.

Appreciate explanation, pointers, suggestions etc.

TIA, ~i++

share|improve this question
add comment

3 Answers

Yeah, that's going to be touchy to do low cost. Basically your options are:

  1. Get the device to do SSL or otherwise be secure (some small embedded targets we have here can't do SSL but can do SRP + manunal encryption OK). Are you sure it's not something that can be "turned on" on the devices?

  2. Get the router to VPN tunnel - via whatever, ipsec or ssl or even pptp. I assume you've looked at what options it provides there, because all the next options involve "drop a box there so you can gateway."

  3. Drop your own bastion host - ideally some little cheap Linux device - and then ipsec (openswan) or ssl (openvpn) or pptp (pptpd) VPN from there. (Or something more ghetto like stunnel).

You mentioned AWS; I tried for a while to get OpenSwan working there and was thwarted; OpenSSL would probably be your best bet. Or pptp seems to work, I haven't done it. Amazon does supply a VPN product (VPC) but I'm not sure if it would fit your needs. There's a better commercial product, VPNCubed. Neither of these solve the "endpoint problem" though, unless your ASDL router can do vpn and is compatible.

Unless you are sampling room temperature at 10 Hz+ (which would be psychotic) I don't think you need to worry about the SSL overhead. Depends on the raw number of endpoints you have, but assuming it's only in the hundreds I wouldn't expect scaling problems (and if there are, ideally running on AWS, scaling is easy and hopefully an additional $72/month is a drop in the bucket for what you're charging these guys..)

Posting what router and what the collector devices are might help folks give you more specific help...

share|improve this answer
    
@ernest-mueller Thanks for your answer. I don't hv enough reputations for a vote-up, so plz consider this as a ^^vote up^^. Now coming to the questions. (1) Device modification isn't in my hand, else that wd have been my first choice for sure. (2) The current router doesn't seem to have any VPN capability (I double checked). These are Netgear, D-Link and UTStarcom ADSL routers. The dataloggers are Taiwanese OEM devices, directly imported. (3) Bastion host isn't an option, as I am already struggling with backup power/space etc. I guess changing router/fwall is the only option. –  icarus74 Feb 10 '11 at 4:30
add comment

If you have no control over the devices themselves, you'll need to rely on a secure transport, like a site-to-site IPSec tunnel.

The good news is that it's a common standard and interoperability between vendors is very good, so any decent firewall will have IPSec support.

The bad news is that you'll need to deploy IPSec capable firewalls to all these warehouses, which may/may not be under your control (you didn't specify whether the network equipment belongs to you or not).

share|improve this answer
    
thanks for the answer. Could you recommend any specific router ? I can't make the solution very expensive, but changing the ADSL router is a viable option, if there are ADSL routers capable of IPSec or other secure transport means. –  icarus74 Feb 9 '11 at 17:22
    
See serverfault.com/questions/24813/… for recommendations on ADSL+VPN –  Ernest Mueller Feb 9 '11 at 17:25
    
I really like pfSense + ALIX, and for your location (the "spoke" for your tunnels), I'd go with pfSense + Hamakua hardware. See www.netgate.com for more information. –  gravyface Feb 9 '11 at 18:59
    
thanks for the suggestion. Definitely looks like something doable, but rather than assembling together a router+fp from kit, wondering as to whether I could take a related approach by burning one of the openWRG / similar firware on the existing ADSL router. Currently, the ADSL routers are used for my dataloggers, and a simple RFID access-control unit which I am pretty familiar with. The routers are all out of Warranty anyway, and I provide support for those as well, so in a way, doable. My virtual vote up for you, don't have enough reps to do a real one. –  icarus74 Feb 10 '11 at 7:51
    
@ernest-mueller, excellent suggestion regarding ADSL+VPN. Looks like something very doable. Responded to @gravyface before reading the link you provided, but it reaffirmed my faith in the approach. –  icarus74 Feb 10 '11 at 7:53
add comment

I face a similar problem so I'll be watching the answers carefully too!

I take it the data-loggers are proprietary devices and not customisable servers? If the latter, have you considered sticking with your existing setup and encrypting the data you send, that might be a good first step without the additional complexity of the https / VPN etc to get started

Can your remote routers be configured to only accept requests from certain IP address ranges of your known central server(s?) That should give additional reassurance from "casual" hackers

One thing that is troubling me in my setup is that to scale, at some point you will need multiple VPN landing pads and the remote clients might need to be configured to talk to specific ones, unless some multihost/dns trickery (?beyond me) can be setup. However VPN does seem a reasonable solution if your remote routers are able to regularly deal with all the interruptions that seem to go on at remote sites.

The other thing you need to weight up is if this additional infrastructure (cost / time / support) is worth it compared to inherent value of the data to you or your businesses' clients.

Sorry I don't have a great deal more to add, as I say I am grappling with this too.

share|improve this answer
    
these are certainly proprietary devices. do not know VPN mechanics well, but I do foresee scaling such infrastructure to be a serious challenge. Not sure if this requires the 'SSL acceleration' boards etc. That would completely ruin my plan of eventually moving to AWS. As for the inherent value, well, this is rapidly gaining a pull vector. Not sure how happy the customers may be when I propose passing on the cost (which could be significant) of this value-add, so evaluating all options. –  icarus74 Feb 9 '11 at 14:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.