IT Employment

Ask something
Discussion Locked

VPN with Dynamic IP Addresses

0 helpful
30 replies

by maxwell edison

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I'm in the process of setting up a VPN. I'm running it through a Linksys BEFVP41 router on the office side, and the remote users will have SSH Sentinel IPSec client on their remote computers. (At least that's what I'm planning, but I'm certainly open to changing the strategy.) The remote users, by the way, have a variety of ISPs, a variety of Internet connection methods (satellite, modem, broadband, etc.), and a variety of operating systems. It's my intention to simply map a networked drive on the remote client (through a VPN tunnel via the Internet) to a server in the office.

The issue I'm having is this: at both the office side and the remote side, the assigned IP addresses are dynamic, not static. On the office side, the WAN IP address is automatically renewed by the ISP every 5-7 days, although it oftentimes (but not always) renews itself to have the same number. And on the remote client side, the IP address is subject to change - and probably will change - perhaps several times a day, depending on how often the remote Internet connection is open/closed. It's not that difficult (for me) to determine and change the settings accordingly, but for the "common remote user", it's jumping through more hoops than we care to require. The way it is now, the remote user would have to:

1. Determine the office WAN IP address.
2. Determine their own IP address
3. Change SSH Sentinel configuration settings accordingly.
4. Add a new route to the routing table.
5. Change the mapped drives accordingly.

(continued...)

30 replies

by maxwell edison

Not only is this a real PITA, but it's just not a very good system - not to mention the remote users don't understand a bit of it. I want the remote connections to be as seamless and as easy as possible - and I don't want to spend any more money. I'm just starting to look at a service called DNS2GO, which is a free service that will keep track of an IP address assigned to a particular domain name, but it falls short (I think) in changing configuration settings - such as mapped drives - on the remote client.

I'm looking at other options (such as using the W2K Server VPN, which may have issues of its own), but at this point I'll just see where this summary takes the discussion. Perhaps this discussion will answer some questions, reveal some unasked questions, and if we're lucky, get some bipartisan and multi-national answers.

by oz_media

Max I don't know if I'm missing your objective or not.
Lack of money would be a pitfall here I think, I don't feel confident about free software enough to use it in a secure environment.
Can you not use couple of STATIC IP's on your Router with Port Address Translation to work around the IP renewal issues?
I understand you are quite security concious so I'm sure you looked at and downed the idea, maybe you can enlighten me as to why thyis wouldn't work for you.

OM

by lordinfidel

Linux is free.... and with FreeS/Wan and IPtables installed, it rivals and can beat commercial products.

In fact, alot of commercial products are based on FreeS/Wan and the linux/unix firewalling standards.

I use both commercial based (not thesymantec or raptor crap either, i'm talking checkpoint and beefy cisco concentrators, the stuff that costs more money then my annual salary)
And Linux based vpn and firewall systems.

The main difference is thru put and dedicated hardware devicesthat run a embedded OS.

But for a small subnet/single IP, there is no reason in the world why free (linux and FreeS/Wan would not be secure)

I'm not blasting you, so don't take it the wrong way. I'm just stating what every security professional out there worth his weight in bits knows.

Also, PAT would be pointless for a 1 to 1 routable IP translation. Plus his current dsl router would not support that configuration.

If he had a static IP, then none of this would be an issue.

by cactus pete

Since you'll be using IPSec, I'd comment that some ISPs do not support that sort of traffic over their lines... I think I hit that wall with AOL about two years ago. I don't know if that's changed [I'm at a different company now], but since you have such disparate clients, this sort of thing may be an issue for you.

I realize you may not want to get too specific, but what is the purpose of the VPN, anyway? [and you do appear to be doing this on the less expensive side, right?]

Are you mostly just looking for a 'no cost' [client perception] solution to get your clients access to documentation on your servers?

by maxwell edison

This is just a simple remote access VPN for employees (owners) who want to work at home or when they're on the road from a laptop. These remote users will have a mapped drive to a couple of file servers. Most clients will be broadband (living in thecity) or satellite (living outside the city) or a couple who are still on modems. None, that I know of, use AOL. I too have heard of some ISPs not supporting IPSec, but ours is not one of them, nor are the clients I've configured thus far.

I've got this finished and working except for the issue of the dynamic IP at the office end, but there may be a work-around for that. (And besides, the "dynamic" IP address has remained unchanged so far, even though it's been renewed a few times.)

Thanks, dpetrak (whoever you are), for the thoughts.

by rabbit_runner

Hey Max,
Just for your information, I have successfully used DNS2GO with my home URL and servers. Initially the service was free (requesting donations) but lately they are charging a $10 / year fee.
As far as the service, it works beautifully and seamlessly. Anytime I connect, the URL is used with no problem. When the dynamic IP address changes, the DNS2GO sends a 'heartbeat' to their servers and the DNS IP address is changed. It is done within 30-60 seconds. If there is a disconnect, one would need to only re-connect.
About the client, I currently use Microsoft 2000 VPN. If your clients VPN software will use the URL, it should connect with no difficulty. Regardless of where I may travel the remote IP address (static or dynamic)is not used to connect to my home server.
Best of luck.

Michael R.

by areets

Well, what would you know? I have a brother called Michael Reets. He still lives in Guyana.

Thanks bro!

Andrew Reets

by maxwell edison

Thanks for the comments on DNS2GO. It may or may not work for me and my circumstances, but your comments gave me more reason to look into it.

by lordinfidel

As long as you are using pvt IP's. You should not have an issue mapping the drives via pvt IP. Since the pvt IP on the server side (i'll call it the right side) does not change.

The sticking point for you is the Right Side IP changing. Although it has not as of yet.

(fyi- earthlink, for $15 more per month, you can have a static IP. I know the Bells bleed business for static IP's. I typically use a 3rd tier carrier for business dsl, it's cheaper and just as reliable)

I would stay away from any MS product for VPN usage. While it may seem easy, the encryption level is not as strong as a Linux solution.

Which if you read my post at the bottom is my solution to you. And one that I have used often, not only for clients, but formy corporate position.

FreeS/Wan is one of the more robust and free vpn solutions out there. While they are pushing full oppurtunistic encryption, (which reqauires you to have a static ip and access to your reverse dns zones), there are other ways to have clients initiate the connection. And alot of commercial products are built upon FreeS/wan.

It is extemely secure and reliable, and integrates quite nicely into an existing linux based firewall. Again see my post.

by areets

Max, which ever way, you'll pass through a learning curve. I'll design this and look closer, just give me a few hours.

I have some material to review, maybe you would like to send me an e-mail.

A+

by maxwell edison

...I would.

Oz, on the router end, I'll look into that option in the router settings and see what I find.

The dynamic IP on the remote client end, as it turns out, may not be much of an issue - or no issue at all. A little more testing will tell.

AReets - spare me your BS. Please refrain from posting to this discussion. I don't want it to turn into one of your self-absorbed, nonsensical ramblings. You're like a little kid crying out for attention - but go find it elsewhere. (Get a clue, kid. Why do you think there are hardly any replies to your stupid discussion threads?)

Actually, I wish this discussion was like a question, and I could just close the thing.

What was that saying about hell and a handbag?

by areets

Well, you want to get back at me. Well, it is your choice. I offered a helping hand but you refused. That is all I can do for you.

My postings are above your capacity to understand what life is about. It is quality and you can only but read them.

Keep your sorry comments to yourself. Appreciate quality and you MIGHT learn something. When you can appreciate that ONE can possess such immense knowledge, then you may realize how uneducated and ill mannered you are with the ability to demonstrate to the MASS.

Do not attack or mock me, YOU DO NOT KNOW WHO I AM.

Andrew Reets

by ozmedias

Just post saying you have your answer and ignore any further comments.

I don't know who upset you this time but it is only a discussion thread, don't read it and don't post back to it if you've had enough.
I thought you were sincerely looking for opinions and support.

Have a nice day,
OM

by guruofdos

Didn't we have another weener playing this game before? Methinks it would be a VERY long time before certain persons on here even become worthy so much as to lick the boots of such as Maxwell, admin@l33tcentral, The Chas and other noble and erudite souls on here. Note that I don't count myself amongst their number - there is always something new to be learned every day.

I'm wondering if Mr R's knowledge of computing is as good as his command of the written English language? If so then, Maxwell, old chap, I'd say you've probably forgotten more than he'll ever know!

by areets

I really just wanted to help! It is all that I can do, now.

Whatever the solution is, you must pass through a learning curve, so as to face the reality of the configuration.

I just wanted to help; and share my knowledge.

Thank you!

Andrew Reets

by cactus pete

If your work around doesn't cut it, let me know. I'm interested enough to get more involved...

And if is DOES work, let meknow what you did. I haven't come across a configuration like yours, but I may some day...

[I had thought you were giving some paying clients access, and was going to suggest an extranet instead of VPN... But this is clearly not the case.]

by ozmedias

I 'm sure that I don't have the exact same su=ituation you do. But wit hmy Netware server, I run DHCP at th eserver and use PAT on the ADSL router. It is a little redundant though because I get NAT from Netware.
Worth a shot though.

Good luck

by rabbit_runner

You, Andrew, are a jerk. You may have learned things in IT, but your 'people' skills are badly lacking. Your social skills are at an all time low. My best advice to you, is to remain quiet until you do learn some better social graces.
BTW. My last name is not the same as yours.

Michael R.

by maxwell edison

...that this forum has been infiltrated with these "kids" or those with that "kid" mentality.

I must admit, that I'm losing my patients with several of these people who sabotage the good-will and professionalism that always has been prevalent around here. That's what led to my previous comment about wanting to close this thread - even though it could have been a good one.

I have no desire whatsoever to converse with the likes of "Andrew Reets" and/or others who spew such nonsense as he has; I don't want his opinion; I don't want to consider anything he has to say.

There has been too much crap polluting this forum lately, and the only thing it will accomplish is to drive away the ones who don't want anything to do with it.

by lordinfidel

I really didn't feel like reading thru all of the posts, so forgive me if I touch on stuff that is already said. (i'm in the middle of some large rearchitectures)

I know and understand that you have a dynamic IP on the server side. You could gowith the dynamic dns route, i'm pretty sure that ssh sentinel can connect to host name instead of by IP.

But the most effective method would to have a static IP on the server side. It makes things a hell of alot simpler. Especially with firewall rules. And the fact that most VPN's need to have a static IP defined in the rulebase.

The road warrior can have a dynamic IP.

If you have SSH Sentinel already, I strongly urge you to move to the linux option. Which is making a linux box, using it as your firewall and router. Install FreeS/Wan on it. (the SSH site has a white paper on how to do it)

If it is DSL service, RH8&9 have built in support for PPPoE connections. And they will auto reconnect.

Plus if you visit www.fwbuilder.org , They have a nifty gui based firewall policy builder. Obviously you need a linux box with X installed to run it.

Get this book: Bulding Linux VPNS by O'reilly.

If you need any further info, contact me off-line.

This discussion is closed to new replies.