New to VPN
-
I use OpenVPN all the time, and it works well. I will let others tell you how good (or not) IPsec is, as I have no experience of it.
Normally it is recommended to do tunnel (tun) mode, where the packets are routed across the encrypted OpenVPN link. For that, the network addresses at each end, and of the tunnel, all have to be different.
You can also make a bridged link (tap mode). That makes the 2 ends look like 1 big broadcast domain/subnet. For that you still have to have every device IP address unique (e.g. you can't have a server at each site on 192.168.0.1/24). The downside of tap mode is that loads of broadcast traffic goes across the VPN.
If you want to have "Road Warrior" style VPN connection as well as site-to-site then you are advised not to use 192.168.0.0/24 or similar network, because the Road Warriors are quite likely to be at a cafe, home… that already uses that subnet and have routing trouble when trying to connect VPN to you.
Get the pain over early, change both sites to different private IP subnets and then making VPN links is easy. e.g. 10.123.1.0/24 10.123.2.0/24... -
Sir,
Thank you for the reply.
Is openvpn only good for site to site? What if I have a provision for a multiple site? What should I use?
-
You can make many OpenVPN links between many sites - no problem doing multi-site.
-
"Is openvpn only good for site to site? "
No openvpn works great for road warrior/client type access as well. You have to have a client on the client device - but their are clients for pretty much everyone os I can think of. And they even have a client now for ios and android devices.
-
Dear All,
In my set-up, there will be a multiple server but only 1 pc will b accessing it. Example Site-A will access Site-B and Site-C. Base on the reply on this forum this possible. My question is How should I configure the client? Is there a a multiple instance of the client? Or just one instance of client you just configure the client?
-
Dear All,
What do you my 'Road Warrior'?
-
Dear all,
Sorry wrong grammer.
What do you mean by 'Road Warrior'?
Thank you.
-
'Road Warrior' is individual people with laptop that are anywhere on the internet and want to connect in individually from their laptop to the office network VPN server. (Working from home, while traveling…)
Tell us what offices and users you want to connect and we can suggest better what solution is good. Because almost everything is possible, and there are afew different ways to do it. -
Sir,
We have a head office and 3 branch office. I want to access the 3 branch office's cctv using the ip address by head office or to view the cctv in browser by head office. I want it to access as if I was just using a LAN connection. With this I'm thinking to use a VPN. Not only the cctv, we want also to access also our biometric in order to get the data from it from the head office.
Kindly advise for the recommended solution for this.
Thank you in advance.
-
That is a site to site connection.. So from your head office create site to site to your 3 branch offices. Make sure you do not use the same address space in each location.
Ie if you use say 192.168.0.0/24 in HO, and 192.168.0.0/24 in BO1 your going to have problems.
So
HO 192.168.0.0/24
BO1 192.168.1.0/24
BO2 192.168.2.0/24
BO3 192.168.3.0/24And your good - or whatever networks you want to use that do not overlap.
So this can be setup so HO can access anything in each branch office, you could also allow for BO to access other BO networks if you want, etc. Connecting 2 different networks via a vpn is called a site to site connection.
-
Thank you for the response and guides you gave to me.
What VPN should I use? OpenVPN or IPSec?
What is the difference of the two?
-
Openvpn is easier to setup if you ask me.. And only uses 1 port over jut plain tcp, while ipsec uses other protocols that may or may not be open between your network connections.
-
Please guide me how to set-up it using the openvpn
-
https://doc.pfsense.org/index.php/OpenVPN_Site-to-Site_%28Shared_Key,_2.0%29
-
If I do point to point. Can I access from HO to Branch01 and vice versa?
-
Yes, site-to-site, peer-to-peer, point-to-point - they all mean the same.
-
Where should I put the server? Where should the openvpn client install?
To give you an idea. I have a 3 branches that has a cctv camera. and will access by headoffice. In this scenario how the vpn should be set-up? Should I set-up the vpn of the branch as a server and the headoffice as a client? If the head office is the clien of the 3 branches, should I open 3 openvpn client on the head office pc? Can be the headoffice also access the branch offices? Should I also install the openvpn client on the branch offices in order to access the headoffice?
-
so why do the branch offices not have pfsense? If they did then your all set.. What routers are at those locations?
-
I'm planning to have a pfsense of the branch. Please give me advise what should I needs in order to have a VPN.
Thank you in advance
-
Here is what I suggest
https://portal.pfsense.org/
Sign up for some actual hours and they can walk you right through. You have been given way more than enough info in this thread to move forward.
Or actually hire someone in IT that knows what a VPN is.. Why are you taking on this task when you clearly are in over your head.
