This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Most secure solution with astaro?

I´m using the latest version of astaro (not beta) and i need a little help for choosing a good solution.
I would like to let some people in on my internal network (intranet webserver for example).
Some users are behind NAT. Can I use Astaro to do some kind of authentication using preshared keys or something else? That doesn´t work if users are behind NAT i read somewhere so that option will not work i guess. Is their another way? Just PPTP isn´t enough here, my boss wants more security [:)] .
I can´t use astaro for some of the home users either so that option will not work either.

Any good ideas will be apreciated.

This thread was automatically locked due to age.

Parents

0 psychorugger over 22 years ago

You could always trying going through the hassle of setting up an IPSec VPN client. It's more secure than PPTP, but a little slower.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 psychorugger over 22 years ago

You could always trying going through the hassle of setting up an IPSec VPN client. It's more secure than PPTP, but a little slower.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Ken Bantoft over 22 years ago in reply to psychorugger

The betas support NAT-T now... as does SSH Sentinel. As for user verification, X.509 certificates are an option.
Cancel
Vote Up 0 Vote Down

Cancel
0 Daniel_Svensson over 22 years ago in reply to Ken Bantoft

But IPSec isn´t working behind NAT or? Or have I got it all wrong...

NAT-T, it´s a improvement of NAT i guess, but what´s the difference?

Thanks

[size="1"][ 27 January 2003, 02:18: Message edited by: Daniel_Svensson ][/size]
Cancel
Vote Up 0 Vote Down

Cancel
0 Marcel_01 over 22 years ago in reply to Daniel_Svensson

NAT-T is an ipsec implementation to get it working through NATted connections...
Cancel
Vote Up 0 Vote Down

Cancel
0 Daniel_Svensson over 22 years ago in reply to Marcel_01

Ok, that sounds good but i still got some "problems", some of the clients are sitting behind other kinds of firewalls that probably doesn´t using NAT-T. I only have one choice then, and thats PPTP I guess?
Cancel
Vote Up 0 Vote Down

Cancel
0 Fausto Oliveira over 22 years ago in reply to Daniel_Svensson

Assuming you are talking about industrial sized firewall's like Cisco IOS Firewall, Cisco PIX or Checkpoint they support Transparent Nat but in the PIX case it is a bit tricky to configure it, you'll need 6.22 to suport it, in the IOS firewall case you can specify a access-list to allow a network range to become "non-nated" ( sorry for the bad english) in the CheckPoint case you can use Checkpoint VPN capabilities. Ok that covers the remote side user's. Now for you firewall Astaro I think that you can define a NAT rule to preserve the source port or otherwise use UDP encapsulation but I can't get to work i'll stay tunned to see if anyone has a new idea. I know I haven't helped much but I'm suffering with you.
Cancel
Vote Up 0 Vote Down

Cancel
0 Daniel_Svensson over 22 years ago in reply to Fausto Oliveira

Ok, thanks for your ideas anyway, all inputs are intresting. But here comes another problem [:)]rewall.
Cancel
Vote Up 0 Vote Down

Cancel