I have 2 networks

HOSTED: (hosted server infrastructure (web-apps, databases, etc))

OFFICE: (office infrastructure (file & print, databases))

Each has an ubuntu (NAT+Proxy) based firewall at 10.0.[12].1. (10.04 LTS server).

Each firewall has a second interface to the Internet (Internet-routable static IP presented on a standard ethernet interface).

Server infrastructure on both HOSTED and OFFICE is VMware ESXi-based.

Networks are not heavily used - it's a 35-person company, so we're not needing a full, enterprise-class solution here.

Workstations are MacOSX, Windows, Linux, and Windows VPN clients, in particular, need to be idiot-proof.

I want do the following:

  1. Connect both these networks together over a VPN (routed rather than bridged, I guess(?)) such that all hosts in the HOSTED and OFFICE networks can readily communicate with hosts on the other network (N2N VPN) regardless of where the connection was initiated from.

  2. Provide generic VPN services to mobile users such that these users can access both the HOSTED and OFFICE network once their VPN clients have logged in. (CLIENT-VPN).

Question: Using free or cheap technologies, how should I best set this up? My thoughts so far have been:

  • OpenVPN VMWare images, one on each network - this looks affordable and looks impressive, but seems to be CLIENT-VPN centric, rather than N2N centric. Also, it looks as if the VPN software needs to run on my firewall hosts in order to do the N2N VPN. I'm not keen to replace my firewalls with these OpenVPN virtual machines.
  • Hand-roll only the N2N VPN (how?) on my existing firewall machines, and then deploy the OpenVPN VMware image on my OFFICE network behind my current firewall, and have this manage only the CLIENT VPN traffic (via port forwarding on the OFFICE firewall).
  • Use DD-WRT or similar?

I don't have a view on the relative benefits of PPTP, IPSec, SSL-VPN although I think the latter is probably best (gut-feel). I don't run WINS or anything other than IP on the networks, so I don't think bridging is needed. I will probably set up some kind of split-brain DNS infrastructure on the 2 networks to provide name services on the 10.x.x.x networks.

I'd welcome any suggestions on network architecture, VPN platform selection and solution design.


  • Disagree. SSL-VPN is application layer solution. IMO the closer to the wire, the better I would say IPSec – chiggsy Jun 5 '11 at 20:14

OpenVPN is definitely versatile enough for network-to-network as well as client-to-network VPN in one installation - we've done it at numerous occasions with good results. The beauty of using OpenVPN lies in the option of having it set up redundantly with dynamic routing protocols - something that is not done as easily with IPSEC solutions.

But OpenVPN clients might be not as foolproof as your users would require it to be - you'd need to do some user acceptancy tests beforehand.

Whether you use ESXi VMs or separate router devices with DD-WRT or OpenWRT is a question of your performance, management and availability requirements - technically, you would run Linux and OpenVPN in either case.

  • So, are you saying install the OpenVPN Ubuntu packages on each of my firewalls? Do I need to do this for N2N? – Brad May 22 '11 at 15:49
  • 1
    Umm, you want to have the VPN, right? So installing VPN software seems like a good move in the right direction, doesn't it? :-) Your firewall VMs are probably a good place to have the VPN endpoints - you already have filtering rules in place and will simply have to add more to take your VPN interfaces into account. – the-wabbit May 22 '11 at 17:53
  • Obviously, I want the VPN, the question is whether I install separate OpenVPN VMWare images on each side inside each network, or just install the OpenVPN software on the firewall endpoints. Its not an unreasonable question, is it? In any event, you seem to be suggesting that I not bother with separate VMWare instances but just do an apt-get install openvpn on each ubuntu firewall and be done with it. Are you suggesting this approach for both N2N and Client VPNs, or should I set up a VMware image for the CLIENT VPN and use the ubuntu firewalls for the N2N VPN? – Brad May 23 '11 at 14:17
  • From the manageability standpoint it is advisable to consolidate and have as few different machines to manage as possible. Manageability is surely tightly correlated with security, but of course with additional network-listening services (i.e. the OpenVPN daemon) you have a greater attack surface on your firewalls as well. So, from the security standpoint it is a question of risk balancing. You hardly would have any security gain by having the client VPNs separated out to different machines - just run different instances of OpenVPN on your firewalls (or elsewhere) and define packet filters. – the-wabbit May 23 '11 at 15:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.