Should I use openVPN or something Else?

Question

I'm in charge of setting up a "walled network" set of servers for a group of employees, but I have no clue where to start. Posted below are the initial requirements, my line of thoughts, and my questions.

Requirements:
1. Any software needs to be Open Source.
2. The users aren't tech savvy and they will be connecting via their own computers we can assume they have admin access to those computers so they can install/run software if needed.
3. They can connect to this walled network from anywhere on the net.
4. we wont be providing a tunnel that handles everything just traffic to/from the servers.
5. This connection should be secure. (SSH maybe? Just an Idea)
6. The employees use Windows, Linux, and MacOSX.
7. Each user needs a UserName/Password
8. A log of the time each user spent logged in needs to be somewhere.

My line of Thought:
I initially wanted to use openVPN but as far as I understand it pipes EVERYTHING through the VPN network and has problems connecting to all 3 PC platforms, which wont work per the requirement posted above.

Questions:
1. Is my understanding of vpn specifically openVPN correct?
2. Are there any web based solutions so the employees don't have to install a vpn client on their computers. Maybe I could have a web login that adds the users IP to a firewall white list and then remove it after some time of inactivity (Just an Idea)?
3. Am I completely missing something or a way this can be done better?
4. Any ideas, thoughts, resources, websites links, etc would be helpful.

TL;DR I need a way to authenticate users for an arbitrary set of servers on different PC platforms.

Thank you for your time.

Edit: Thanks for the help everyone, but I think I just need to take the leap, try to set up a debian box with the necessary software and then ask questions regarding problems when I run into them. I'm over thinking everything and thats taking up a large amount of time. so my plan of action is as follows

1. Setup a Debian server.
2. Install the required server software the company needs.
3. Install openVPN
4. ...

I'm still confused with setting up the usernames/password accounts and logging time and users, but I'll solve that problem when I get to it.

Do you notice any problems or pitfalls with my current plan of action?

Answer 1

ad

1. no, it is not. OpenVPN does not require you to have all traffic tunneled through the VPN interface. You specifically can select routes which would be created to be handled by the VPN. Also, OpenVPN is available for a variety of platforms, including Windows, Linux and OS X.
2. There are numerous SSL VPN solutions which are browser-based. Check out if they might do what you need done.
3. & 4. - no idea, you have left out any specifics which would be needed to asses this in a meaningful way.

As OpenVPN is quite versatile, it very likely would suit your needs. But it also is a rather complex package with a ton of configuration options, so be prepared for some work when setting it up - the "do what I mean to do" button is not implemented yet.

Answer 2

As so many different Users and Platforms are connected to this network I would also assume that you secure your Network from "behind" the VPN Server as well. Basically just crate specific Rules for the tun/tap interface that OpenVPN uses to assure only valid traffic is made, depending on the services you have to provide.

As syneticon-dj already pointed out OpenVPN DOESN'T require you to send all traffic through the tunnel Interface. In fact you could choose on the client side or on the server side to set or push routes to the client, or as you mentioned set the OpenVPN Interface as default gateway (Client side routing with Windows)

#Network Route
route 192.168.1.0 255.255.255.0
#Single host route trough a given server (1.2.3.4 over 10.20.30.40)
route 1.2.3.4 255.255.255.255 10.20.30.40

On Mac OS the client of my choice is Tunnelblick On Windows and Linux its OpenVPN itself.

The best an most secure way to authenticate People would be to generate Certificates for each user. So you can easily revoke Them on your server side, and the connection could be sealed up tight (depending on your key size) ;)

To enable logging on the server, just add the following lines to your server config

status /var/log/openvpn/server.status
log-append /var/log/openvpn/server.log
verb 3

(the folder needs to exist, with the correct permissions)

The First file is for quick usage purpose, to check which user is logged on. And the second one provides you with an detailed log of every connection.

PS: Logrotate config, als OpenVPN would never rotate the log itself... ;)

/var/log/openvpn/*.log {
    daily
    copytruncate
    missingok
    rotate 7
    delaycompress
    notifempty
}