This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Most secure solution with astaro?

I´m using the latest version of astaro (not beta) and i need a little help for choosing a good solution.
I would like to let some people in on my internal network (intranet webserver for example).
Some users are behind NAT. Can I use Astaro to do some kind of authentication using preshared keys or something else? That doesn´t work if users are behind NAT i read somewhere so that option will not work i guess. Is their another way? Just PPTP isn´t enough here, my boss wants more security [:)] .
I can´t use astaro for some of the home users either so that option will not work either.

Any good ideas will be apreciated.

This thread was automatically locked due to age.

0 Ken Bantoft over 22 years ago in reply to psychorugger

The betas support NAT-T now... as does SSH Sentinel. As for user verification, X.509 certificates are an option.
Cancel
Vote Up 0 Vote Down

Cancel
0 psychorugger over 22 years ago

You could always trying going through the hassle of setting up an IPSec VPN client. It's more secure than PPTP, but a little slower.
Cancel
Vote Up 0 Vote Down

Cancel
0 Daniel_Svensson over 22 years ago in reply to Ken Bantoft

But IPSec isn´t working behind NAT or? Or have I got it all wrong...

NAT-T, it´s a improvement of NAT i guess, but what´s the difference?

Thanks

[size="1"][ 27 January 2003, 02:18: Message edited by: Daniel_Svensson ][/size]
Cancel
Vote Up 0 Vote Down

Cancel
0 Marcel_01 over 22 years ago in reply to Daniel_Svensson

NAT-T is an ipsec implementation to get it working through NATted connections...
Cancel
Vote Up 0 Vote Down

Cancel
0 Daniel_Svensson over 22 years ago in reply to Marcel_01

Ok, that sounds good but i still got some "problems", some of the clients are sitting behind other kinds of firewalls that probably doesn´t using NAT-T. I only have one choice then, and thats PPTP I guess?
Cancel
Vote Up 0 Vote Down

Cancel
0 Fausto Oliveira over 22 years ago in reply to Daniel_Svensson

Assuming you are talking about industrial sized firewall's like Cisco IOS Firewall, Cisco PIX or Checkpoint they support Transparent Nat but in the PIX case it is a bit tricky to configure it, you'll need 6.22 to suport it, in the IOS firewall case you can specify a access-list to allow a network range to become "non-nated" ( sorry for the bad english) in the CheckPoint case you can use Checkpoint VPN capabilities. Ok that covers the remote side user's. Now for you firewall Astaro I think that you can define a NAT rule to preserve the source port or otherwise use UDP encapsulation but I can't get to work i'll stay tunned to see if anyone has a new idea. I know I haven't helped much but I'm suffering with you.
Cancel
Vote Up 0 Vote Down

Cancel
0 Daniel_Svensson over 22 years ago in reply to Fausto Oliveira

Ok, thanks for your ideas anyway, all inputs are intresting. But here comes another problem [:)]rewall.
Cancel
Vote Up 0 Vote Down

Cancel