VPN Server not as a gateway.

Hi

Is there any way to put a linux box with openswan or freeswan on a
network and having it behave as a vpn server without having it as a
gateway. Most vpn servers I have seen act as a gateway, have 2
interfaces and sit between the outside line and the internal network.
What I want is a vpn server I can just attach to the lan switch with
one ethernet jack. Basically I want it to be more of a mail server
install than a gateway/ firewall install. I already have a hardware
firewall between the wan and the lan, but the vpn on it is rubbish and
refusses to work correctly with any other vpn clients. So If I can
place a box onto the lan which will then replace the vpn server on the
firewall, without it being a point of failure for the entire network,
that would be ideal. If the vpn server dies , you loose vpn , rather
than if the vpn gateway fails you loose the network.

thanks

Matt

toxicated101 wrote:
> Hi
>
> Is there any way to put a linux box with openswan or freeswan on a
> network and having it behave as a vpn server without having it as a
> gateway. Most vpn servers I have seen act as a gateway, have 2
> interfaces and sit between the outside line and the internal network.
> What I want is a vpn server I can just attach to the lan switch with
> one ethernet jack. Basically I want it to be more of a mail server
> install than a gateway/ firewall install. I already have a hardware
> firewall between the wan and the lan, but the vpn on it is rubbish and
> refusses to work correctly with any other vpn clients. So If I can
> place a box onto the lan which will then replace the vpn server on the
> firewall, without it being a point of failure for the entire network,
> that would be ideal. If the vpn server dies , you loose vpn , rather
> than if the vpn gateway fails you loose the network.
>
Isn't that just a case of port-forwarding the VPN port through the
firewall box to the machine inside? That's what I've got set up here, a
pptp server on a machine that is patched through the firewall machine.

--
Dave
mail da (E-Mail Removed) (without the space)
http://www.llondel.org
So many gadgets, so little time

Hi Dave

Possibly, the only problem I see is that you would have to put some
static links onto the firewall to tell it to send any traffic
designated to a internal ip subnet (on the remote side) to the vpn
machine. I just wanted to ask , I haven't seen it done and didn't want
to waste my day if its not possible.

Thanks

Matt

Dave {Reply Address In.sig} wrote:
> toxicated101 wrote:
> > Hi
> >
> > Is there any way to put a linux box with openswan or freeswan on a
> > network and having it behave as a vpn server without having it as a
> > gateway. Most vpn servers I have seen act as a gateway, have 2
> > interfaces and sit between the outside line and the internal network.
> > What I want is a vpn server I can just attach to the lan switch with
> > one ethernet jack. Basically I want it to be more of a mail server
> > install than a gateway/ firewall install. I already have a hardware
> > firewall between the wan and the lan, but the vpn on it is rubbish and
> > refusses to work correctly with any other vpn clients. So If I can
> > place a box onto the lan which will then replace the vpn server on the
> > firewall, without it being a point of failure for the entire network,
> > that would be ideal. If the vpn server dies , you loose vpn , rather
> > than if the vpn gateway fails you loose the network.
> >
> Isn't that just a case of port-forwarding the VPN port through the
> firewall box to the machine inside? That's what I've got set up here, a
> pptp server on a machine that is patched through the firewall machine.
>
> --
> Dave
> mail da (E-Mail Removed) (without the space)
> http://www.llondel.org
> So many gadgets, so little time

toxicated101 <(E-Mail Removed)> wrote:
> Hi
>
> Is there any way to put a linux box with openswan or freeswan on a
> network and having it behave as a vpn server without having it as a
> gateway. Most vpn servers I have seen act as a gateway, have 2
> interfaces and sit between the outside line and the internal network.
> What I want is a vpn server I can just attach to the lan switch with
> one ethernet jack. Basically I want it to be more of a mail server

Search around for what's called a "one armed" vpn configuration.

--
Frank Sweetser fs at wpi.edu | For every problem, there is a solution that
WPI Network Engineer | is simple, elegant, and wrong. - HL Mencken
GPG fingerprint = 6174 1257 129E 0D21 D8D4 E8A3 8E39 29E3 E2E8 8CEC