Internetworkers: http://www.ibiblio.org/internetworkers/

[Tanner Lovelace <clubjuggler AT gmail.com>]

On Wed, 20 Oct 2004 14:38:57 -0400, Tony Spencer <tony AT tonyspencer.com> wrote:
> Has anyone here used the open source vpn solution OpenVPN
> (http://openvpn.sourceforge.net/)?  Did you find it suitable?
> 
> I never could get my Mac at home to see past the VPN server so I'm thinking
> of ditching the Microsoft VPN and setting this up.

I've played around with it a bit.  It's quite easy to setup, and there
are currently no *known* security holes with it, but it SSL based
VPNs in general are the new kid on the block, so don't expect it
to be 100% secure just in case.  It also works better through NAT
which can screw up IPSEC in some modes.

A good paper on it seems to be here:
http://www.sans.org/rr/papers/20/1459.pdf

A comparison between several user level vpn protocols can be found here:
http://www.cs.auckland.ac.nz/~pgut001/pubs/linux_vpn.txt

I would highly recommend, however, not using static keys and instead
using TLS because if your key is compromised using static keys, all
past and future traffic is immediately compromised.  If you use TLS,
however, session keys are generated on the fly so if your certificate
is compromised, they still have to crack (or find) each session key.

Cheers,
Tanner