Opensource SSL VPN for laptop to home network? [closed]

Question

Router/Firewall/Endpoint: Zywall USG20W
Method: SSL VPN (IPSEC VPN only if not other choice)
Laptop: Windows 7 x86 Auth Server: 2008 R2 AD

I have biz class internet and a bank of static IP's at my home office. I run the Zywall behind a comcast gateway and can do simple 1to1 NAT. Im trying to figure out the best software for my laptop to connect home with. Man in the middle attack is possible and I deal with sensitive information. Based on all that I picked the Zywall so I can use SSL VPN and figured finding software would be easy. I have looking into OpenVPN it looks like I can only run thru there servers. I want only my router to deal with the handshake and use preshared cert's. Other than that I could not find anything searching with google.

Is this possible with my configuration and I just got the wrong OpenVPN product or is there a better preferably opensource product that would fit my needs better? I thought it was odd that I did not find more products, is this something that is built into win7 now?

Answer 1

OpenVPN works fine direct between your machines, firewall issues aside (some NAT arrangements, which you might run into if using public wireless and so forth, cause problems when using it in UDP mode). I use it for VPNs for both home and office use.

From most Linux setups installation is fairly easy (aptitude install openvpn or yum install openvpn, and follow the howto - you'll find the easyrsa scripts somewhere under /usr/share/doc/ usually).

A Windows build with some GUI controls if you need them is here though that doesn't seem to have been updated in some time. I've never run that as a server myself but it works perfectly well as a client in my experience (on XP, 2003, and Vista at any rate, I've not used it on Windows 7 or 2008 as yet).

Edit: Looks like that GUI is included in the official Windows installers now (get them here). See here for a list of alternatives (that page lists the one I've mentioned as "client GUI" so you might need something else for controlling server processes).

Answer 2

Have you considered an SSL Tunnel? Just leave an SSH server running on one host in your home office. Place the SSH server on a non-standard port that is high up, such as 65522. Next, redirect your router to tunnel that port your SSH server. Lastly, set up some tunnels on PUTTY for the ports/services that you need to access remotely. You will connect to a local port on your host PC for the service in question which will then be tunneled across the SSH connection to another host on the opposite side of your SSH server. You can configure your SSH server and client to use pre-defined certs.

No VPN software needed, just putty and the tunnel definitions.