Film-Tech Forum ARCHIVE: Benefit of router with VPN endpoint feature.

This is topic Benefit of router with VPN endpoint feature. in forum Ground Level at Film-Tech Forum ARCHIVE.

To visit this topic, use this URL:
https://ft-forum.com/ft/cgi-bin/ubb/ultimatebb.cgi?ubb=get_topic;f=5;t=001054

Posted by Brad Allen (Member # 470) on 02-17-2004, 03:36 PM:

I'm just getting cable modem service to my theatre, I want to use VPN with RTS ticketing software, so I can see what's happening from home.
What is the benefit/advantage to having a router that claims to include VPN end point, over a standard router without this feature?
Linksys has two models that have this feature.

If I have a router with VPN endpoint, do I have to have one at both ends? IE:theatre and @ home?

Does anyone have a specific router that you recommend for a theatre situation? I would like to be able to VPN to RTS, as well as remote access to the computers in general.
Please educate me. Thank you.

Posted by Scott Norwood (Member # 30) on 02-17-2004, 03:47 PM:

If you're talking about home router/NAT box devices, their "VPN endpoint" feature probably only works as a client for an IPSEC VPN. You'll likely need something more sophisticated on the server end.

For your purpose, I'd probably get the low-end Cisco PIX (~$500, limited to 32 machines behind it, which shouldn't be an issue for you). This would be installed at the theatre. On the home end, you could either get another PIX or run the software client (works on a bunch of platforms, including Win32, Linux, Solaris, etc.).

There are no doubt cheaper ways of doing this, and the PIXes aren't my favorite products, but they do Just Work once configured properly. You'll probably want to have a knowledgeable friend (or a smart high-school kid) do the actual configuration. I can send you some sample configurations that will do what you want.

Make sure that the terms-of-service of the ISP on both ends allow you to do this. Some ISPs disallow the use of "residential" circuits for VPN or "server" (however they want to define it) use, and would rather sell you a more-expensive "business" circuit.

If you just want "remote access" to the theatre computers, then you probably don't need this and can get by with something like VNC, hopefully tunneled over SSH (cost: $0, though performance leaves a bit to be desired over slow links).

Edits:

VNC: http://www.realvnc.org/ (free remote-control software for various platforms)
SSH: http://www.openssh.org/ (free implementation of secure shell for various platforms...supposedly the server can run on Win32 using Cygwin...might be painful)
Cisco PIX 501 (about $500-600 with 50-user license)

[ 02-17-2004, 05:18 PM: Message edited by: Scott Norwood ]

Posted by Jack Ondracek (Member # 1466) on 02-17-2004, 05:05 PM:

Scott has a good point, Brad.
I'm using VNC for the purpose you mention, and it works fine.
PC Anywhere will do the same thing, though.. as Scott said, these programs work best when you have a decent cable or DSL connection at BOTH ends.

Posted by Jason Burroughs (Member # 68) on 02-18-2004, 09:27 AM:

There really isn't an advantage to having a VPN Endpoint router, unless you plan on doing a Site-to-Site VPN, such as a theater to a home office, where both LANs will be virtually connected.

You can use a software client to connect to the VPN endpoints, but in my experience they are not very efficient, easy to use, and light on the resources.

If you're just wanting to be able to access 1 comptuer from home, such as a manager's station, it would proably be easier to use VNC, PCanywhere or something like that, and forward the proper ports on your router to that computer.

If you are needing to be able to access the entire network remotely your best option will be the Cisco PIX 500 series
In addition you can connect remotely to the Cisco PIX routers using the Cisco VPN client, with is acutally pretty decent.

Posted by Brad Allen (Member # 470) on 02-19-2004, 11:46 AM:

Thanks all, lots to think about. VPN from home to theatre, is what I had in mind. I was just going to use VPN connections included in Windows.
I hadn't thought of the ISP restricting VPN. How do they do that? Close the typical port that is used for VPN?
Thanks again for the replies.