A.P. Lawrence

Best of the Newsgroups: vpn windows browsing

If this isn't exactly what you wanted, please try our Search (there's a LOT of techy and non-techy stuff here about Linux, Unix, Mac OS X and just computers in general!):

From: Jeff Liebermann <jeffl@comix.santa-cruz.ca.us>
Subject: Re: Telnet printing
Date: Sat, 31 Jan 2004 11:06:41 -0800 Message-ID: <qutn10t68bvj9kaanu62c4o1gpc0ovidqr@4ax.com> References: <LNWdnfBPhsoFm4XdRVn-sA@thebiz.net> <0001HW.BC4145A300B05929F0284600@usenet.plus.net>

On Sat, 31 Jan 2004 11:44:35 +0000, Simon Hobson
<simonsnews@thehobsons.codotuk> wrote:

>Of all the replies, I'd suggest that these days VPN is so easy to implement 
>that I would consider that first - then you have full control over the IPs 
>used and apart from the VPN tunneling itself you don't need to mess about 
>modifying server or client - effectively you can treat the client as being 
>directly connected to your network. As well as encrypting everything from 
>prying eyes.
>Simon

Agreed.  However, there are a few things one should know before
blundering onward.  Since a VPN router is essentially transparent to
all forms of traffic, I was getting clobbered by excessive broadcast
traffic propagated through the routers.  However, if I turn off
broadcast propagation, the infamous Windoze browsing doesn't work.
Same with using a single central DHCP server which is a very bad idea
over a VPN.  I had to hack some custom filter rules to make it all
work as my clueless customers absolutely insisted that they needed
Windoze browsing.  My suggestion is to live without Windoze browsing
and just use:
  \\NETBIOS_machine_name
from the "Run" box to access remote machines.

Incidentally, the most common mistake I've seen is using the same
Class-C IP block in more than one location.  It's a natural to setup
the routers using the default LAN side IP block (usually
192.168.0.xxx) on every VPN router.  Bad idea.  That actually will
work with some routers (i.e. Sonicwall), but causes all kinds of
routing and address management problems.  It's also really easy to end
up with duplicate IP's.  Each office should have it's own Class-C IP
block as in:
  192.168.0.xxx   main office
  192.168.1.xxx   remote office 1
  192.168.2.xxx   remote office 2
and so on.  

Also, most of the small routers will only handle 256 IP's.  If you
have a large office, with either more than one Class-C, or a Class-B
netmask, the cheap VPN routers won't work.

Need eyes on the ground at your customer's site?
Installation and light training Boston and New England
Reliable and experienced, punctual and professional.

-- 
Jeff Liebermann  150 Felker St #D  Santa Cruz CA 95060
(831)421-6491 pgr  (831)336-2558 home
http://www.LearnByDestroying.com   AE6KS
jeffl@comix.santa-cruz.ca.us   jeffl@cruzio.com

Enter your email address for automatic notification of new posts here
(be sure to whitelist 'feedburner.com' if you use spam filtering)

Lone-Tar Backup and Disaster Recovery
for Linux and Unix

/Bofcusm/2436.html copyright 1997-2004 (various authors) All Rights Reserved

Have you tried Searching this site?

Unix/Linux/Mac OS X support by phone, email or on-site: Support Rates

This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more. We appreciate comments and article submissions.

Publishing your articles here