Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to find a good software solution to implement VPN so a new branch office can use without security problems applications in our main office.

I need it to be very reliable and almost transparent for the end user

Any hints?

We have both linux and windows desktop/server on both ends.

share|improve this question
Do you mean "free OR affordable" ? – mfinni Apr 1 '11 at 12:56
I'm sorry for being not really accurate. The word "free" has the most beautiful sound ever :) – Pitto Apr 1 '11 at 13:28
ps I need it a really stable solution – Pitto Apr 1 '11 at 13:29
How much throughput do you need between offices? Lower end solutions are only going to get you a couple of Mb/s. – 3dinfluence Apr 1 '11 at 15:30
Well the internet connection is certainly a bottle neck. But encryption is pretty cpu intensive so on low powered hardware it's something to be mindful of. For instance pfSense on an ALIX based system, 800MHz AMD Geode CPU will max out at around 6-8Mb/s of IPSEC throughput depending on the encryption cipher being used. To go faster you either need more raw cpu power or dedicated crypto hardware. There is a encryption accelerator available for the ALIX boxes for instance that can quadruple the throughput. – 3dinfluence Apr 1 '11 at 17:49
up vote 3 down vote accepted

Maybe your edge router supports a VPN? check the docs. If not, without changing your edge router, one possibility is to buy a couple of inexpensive routers, install a VPN build of ddwrt or openwrt. Then use OpenVPN or IPSEC. I prefer OpenVPN as it's easier to set up.

You can install the routers behind other firewalls. You'll need to ensure the firewall allows the VPN traffic. And, on the server end or the router that runs the OpenVPN server you'll need to ensure that the firewall at that end has a hole poked in it from the source ip of your other branch office so that it can link up.

Then at both ends, put a static route to the foreign network to point to the new VPN router.

I have done this a couple of years ago and it worked great. You do have to watch that the private IP ranges of both networks are different though.

Also, it'd be helpful to add a DNS server to the branch office network to reach the servers at the head office by their private IP. If you happen to have a local domain controller then that should be easy. Don't even think about putting the domain controller for the branch office on the other side of the VPN. Your users will hate you if you do that. Seen that done before... yuck!

If you need higher performance, considering using Mikrotik routers with RouterOS. They are also very innexpensive and may be a bit quicker. Although there are some quite fast asus routers that work really well under OpenWRT.

It's hard to know what's best really because you haven't said anything about the existing equipment.

share|improve this answer
Site-to-site VPN is the best option, and the only one that's transparent to end-users. They don't do anything, you're configuring the infrastructure. – mfinni Apr 1 '11 at 13:39
I've used Zeroshell on both ends (openvpn): super easy setup and great functionality! :) – Pitto Jun 1 '11 at 16:33

This is a rather broad question but I'd suggest replacing the edge routers at each site with something running IPCop ( ), pfSense ( ) or some other free gateway/firewall distribution.

This way you can build and manage the VPNs on the gateways and the inter-office connectivity will be transparent to the users.

share|improve this answer

You don't mention what OS are on the clients / available on gateways / running on routers - this would have been helpful.

Previously I'd tried with IPSEC - but even without NAT, it proved difficult to get products from different vendors to speak to each other - admittedly that was a long time ago.

I've used openvpn - which is simple and works well - and also ppp over stunnel

share|improve this answer

With tunnelling you can access applications at your local system from a remote system.

For more details regarding tunnelling, check this link.

Note: You can forward any PORTS with tunnelling. In the above link, the port which is forwarding is 22. If you forward the port 80 [http], you can access your local web application from remote machine.

Example: Suppose you want to use a web application at your main office from new branch office.

Assuming the web application is running at the port 80.

Forward the port 80 of Main office system

ssh root@a_remote_server -R 80:XX.XX.XX.XX:8080

Then login to server a_remote_server from a system at your new branch office.

ssh root@a_remote_server

Then type

localhost:8080 in a browser of machine in new branch office.

share|improve this answer
What about windows standard client/Server application working on tcp/ip? – Pitto Apr 1 '11 at 13:30

protected by Sven Apr 30 at 19:02

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.