Broadband router + VPN

[MysticLlama]

I'm not really sure how to find the info I'm looking for, so I thought I'd ask here.

I have a VPN set up at the office, standard Windows 2000 Server PPTP VPN, Active Directory integrated.

What I would like to do is set up a router on a DSL/Cable line down at one of our stores in CA, but have the router do the VPN work. So basically, the username/password for the VPN would be set up on the router instead of the boxes, so that we basically have it set up to be a hard line to here, like a point to point T1 or frame-relay would be.

They seem to all say that they work with PPTP, but after reading a little it seems to be more of a pass-through mechanism rather than a feature/capability.

Anyone have any thoughts on this?

Also, if I could do this the applications on the other side would be more manageable and secure, so I'm willing to spend a little more to do it. I don't want to get into a $1000 router or anything, but we don't have to keep it below $150 or anything like that either.

 

[tritium4ever]

I suggest you take a look at the ZyXEL ZyWALL 1 router. It has built-in a hardware VPN connection just as you want (it's not PPTP passthrough, it's an actual hardware VPN solution). It supports a single VPN connection, extensive filtering logs and rules, and the firewall far surpasses most home router firewalls. I've had the pleasure of using the ZyWALL 1 and I can easily recommend it. It may be a bit harder to find than your typical Linksys routers, but it's an excellent value at about $200 USD in most online stores.

There's a review of the ZyWALL 1 here:

ZyXEL ZyWALL 1 router review

 

[JustinLerner]

I think the Linksys VPN Router documentation (pp 48) is nominal and they don't really explain their VPN Router very well. The Linksys VPN Router should be about as good as the ZyWall and actually cost less, but you can see that there are many extra and benficial features that the ZyWall has that the Linksys VPN Router doesn't, however, the Linksys can support 70 tunnels while the ZyWall 1 can only support 1 tunnel. I looked at the ZyXel manual (pp 324) and it is more detailed and has better explanations.


Some notes on the Linksys VPN Router:
It appears from the Linksys documentation that a Tunnel is always established and encryption always occurs when these features are enabled on their VPN router (DES, 3DES or none as well as SHA1 or MD5 authentication or no authentication (and this occurs in hardware like the ZyWall and not software, since this VPN Router it can be totaly independent of any IP hosts on either side of the VPN Routers).

When an encrypted tunnel exists between two Linkysy VPN Routers that are properly setup for intersite traffic, the passthrough option would seem to me to be allowing a VPN tunnel from server to client through the existing VPN Router to VPN Router (gateway to gateway) tunnel. This may actually be a bonus of allowing an second tunnel to be encapsulated and sent over a VPN Router's existing tunnel.
This could be a significant extra security feature since a 2000/.NET VPN server/server or server/client tunnels can be established which encapsulate any of the existing networking protocols (which are installable in 2000/XP, like NetBEUI, IPX, Appletalk).

In other words, your LAN could have Appletalk, IPX and NetBEU or even IP installed as protocols, then you could establish a VPN with the 2000 server and client (or server to server) as either PPTP or L2TP which would encapsulate any or all of the four protocols in indivudual tunnels over IP as either PPTP or IPSec (L2TP), and then the VPN ROUTERS would encapsulate this tunnel between them over IP. This is typically what the 'Enable PPTP passthrough" or "Enable IPSec passthrough" should mean.

-------

Typically, "pass-through" is used by networking to be synonymous to "transparent encapsulation" over the protocol between nodes. So to use PPTP pass-through means to encapsulate a PPTP in a over IP (between VPN Routers) while IPSec pass-through on the VPN Router means IPSec over IP and could mean one tunnel inside another for extra protection.

Apparently, ZyXel is erroneously using "pass-through" to mean "software" in regards to standard broadband routers which are not VPN enabled as oppsed to "active hardware encapsulation and breakdown".

---------

Some additional comparisons:

Linksys VPN Router ~ $150
70 Tunnels

ZyWall 1 ~ $170
1 Tunnel
URL Filtering, Java, Active-X, cookie, proxy blocking
DoS countermeasures, attack logs
DNS proxy, dyanmic DNS

ZyWall 10 ~ $270
10 Tunnels
+ IP alias [local naming or what?]
internet time, history, more management and other features