Considering a New VPN
-
There are both very secure, yes. The bigger issue that you will face is the effort in setup, they can both be insanely simple (e.g. totally transparent) for the end user. As could ZeroTier. But for you, they take effort.
-
ZeroTier is essentially no effort to deploy, think Hamachi or Pertino there, but because it is a full SDN not just a VPN, it's not going to do the hub and spoke you are used to and you'll have that networking complication to deal with.
-
Yeah, I need hub and spoke really. But that's not too difficult to setup on ZeroTier is it?
-
@Carnival-Boy said in Considering a New VPN:
Yeah, I need hub and spoke really. But that's not too difficult to setup on ZeroTier is it?
ZeroTier doesn't offer hub and spoke at all. It's pure SDN / mesh.
-
OpenVPN is very likely what you want to be using. IPSec tends to be better for site to site, OpenVPN for hub and spoke.
-
But both will do both, of course.
-
Would there be an argument for not using hub and spoke and using ZeroTier?
-
@Carnival-Boy said in Considering a New VPN:
Would there be an argument for not using hub and spoke and using ZeroTier?
Not likely. SDN involves totally revamping your entire network to be on ZT. It's an "all in" approach. It's great and can work wonders, but it's not trivial.
-
Thanks. Looks like OpenVPN on an EdgeRouter FTW then. Is it easy to set up?
-
Edgerouters are great. I have used them at clients places in the past, along with OpenVPN. You could also look at Untangle NG Firewall. I virtualized the firewall and the OpenVPN aspect of Untangle is very easy to setup. Of course you can use any firewall you want and just have a OpenVPN server. Turnkey Linux has a great OpenVPN appliance that you can download and run in any hypervisor. Also if you have a Raspberry Pi you can check out http://www.pivpn.io/
-
@scottalanmiller said in Considering a New VPN:
@Carnival-Boy said in Considering a New VPN:
Would there be an argument for not using hub and spoke and using ZeroTier?
Not likely. SDN involves totally revamping your entire network to be on ZT. It's an "all in" approach. It's great and can work wonders, but it's not trivial.
Quoted for truth!
-
Let's ask another question - instead of deploying a new VPN solution - what exactly are users accessing? and can it be changed in such a way to make VPNs not needed anymore?
-
@scottalanmiller said in Considering a New VPN:
@Carnival-Boy said in Considering a New VPN:
Yeah, I need hub and spoke really. But that's not too difficult to setup on ZeroTier is it?
ZeroTier doesn't offer hub and spoke at all. It's pure SDN / mesh.
This is not true, ZeroTier has gateway functionality.
https://www.zerotier.com/community/topic/5/bridging-ethernet-to-zerotier-virtual-networks-on-linux -
@JaredBusch said in Considering a New VPN:
@scottalanmiller said in Considering a New VPN:
@Carnival-Boy said in Considering a New VPN:
Yeah, I need hub and spoke really. But that's not too difficult to setup on ZeroTier is it?
ZeroTier doesn't offer hub and spoke at all. It's pure SDN / mesh.
This is not true, ZeroTier has gateway functionality.
https://www.zerotier.com/community/topic/5/bridging-ethernet-to-zerotier-virtual-networks-on-linuxI was leaving that out for simplicity as he's not going to build custom Linux systems for this.
-
@scottalanmiller said in Considering a New VPN:
@JaredBusch said in Considering a New VPN:
@scottalanmiller said in Considering a New VPN:
@Carnival-Boy said in Considering a New VPN:
Yeah, I need hub and spoke really. But that's not too difficult to setup on ZeroTier is it?
ZeroTier doesn't offer hub and spoke at all. It's pure SDN / mesh.
This is not true, ZeroTier has gateway functionality.
https://www.zerotier.com/community/topic/5/bridging-ethernet-to-zerotier-virtual-networks-on-linuxI was leaving that out for simplicity as he's not going to build custom Linux systems for this.
Why? Because a single VM setup as a gateway means that ZT now meets all needs also.
No different than replacing a router, etc.
-
@JaredBusch said in Considering a New VPN:
@scottalanmiller said in Considering a New VPN:
@JaredBusch said in Considering a New VPN:
@scottalanmiller said in Considering a New VPN:
@Carnival-Boy said in Considering a New VPN:
Yeah, I need hub and spoke really. But that's not too difficult to setup on ZeroTier is it?
ZeroTier doesn't offer hub and spoke at all. It's pure SDN / mesh.
This is not true, ZeroTier has gateway functionality.
https://www.zerotier.com/community/topic/5/bridging-ethernet-to-zerotier-virtual-networks-on-linuxI was leaving that out for simplicity as he's not going to build custom Linux systems for this.
Why? Because a single VM setup as a gateway means that ZT now meets all needs also.
No different than replacing a router, etc.
I've not used it, does it require you to change your IP range or can you keep what you have?
-
@Dashrender said in Considering a New VPN:
can it be changed in such a way to make VPNs not needed anymore?
Yes, it can. But not as easily as implementing a new VPN.
-
@JaredBusch said in Considering a New VPN:
@scottalanmiller said in Considering a New VPN:
@Carnival-Boy said in Considering a New VPN:
Yeah, I need hub and spoke really. But that's not too difficult to setup on ZeroTier is it?
ZeroTier doesn't offer hub and spoke at all. It's pure SDN / mesh.
This is not true, ZeroTier has gateway functionality.
https://www.zerotier.com/community/topic/5/bridging-ethernet-to-zerotier-virtual-networks-on-linuxThanks. I had a vague recollection that it could.
-
@scottalanmiller said in Considering a New VPN:
@JaredBusch said in Considering a New VPN:
@scottalanmiller said in Considering a New VPN:
@JaredBusch said in Considering a New VPN:
@scottalanmiller said in Considering a New VPN:
@Carnival-Boy said in Considering a New VPN:
Yeah, I need hub and spoke really. But that's not too difficult to setup on ZeroTier is it?
ZeroTier doesn't offer hub and spoke at all. It's pure SDN / mesh.
This is not true, ZeroTier has gateway functionality.
https://www.zerotier.com/community/topic/5/bridging-ethernet-to-zerotier-virtual-networks-on-linuxI was leaving that out for simplicity as he's not going to build custom Linux systems for this.
Why? Because a single VM setup as a gateway means that ZT now meets all needs also.
No different than replacing a router, etc.
I've not used it, does it require you to change your IP range or can you keep what you have?
The biggest recommendation is to make it inclusive of your LAN subnet so make life easier. I've not had the time to set it up on my lab yet.
I use ZT in a number of places, but not using the gateway anywhere yet.
-
@Carnival-Boy said in Considering a New VPN:
@Dashrender said in Considering a New VPN:
can it be changed in such a way to make VPNs not needed anymore?
Yes, it can. But not as easily as implementing a new VPN.
easy of implementation shouldn't be the goal - sustainability and future proofing should be, tempered by costs.
