VPN

[ahuxham]

Anyone got any useful guides for setting VPN up, or understanding it a bit more.

 

Trying to setup VPN access on our Vigor 3300 router, but haven't the foggiest how it all works and what to use.

 

It supports PPTP L2TP and IPSEC.

[RabbieBurns]

Ive only ever used OpenVPN.

 

Its a doddle to set up IMO.

[tom_newton]

What sort of VPN?

Site-to-Site (use IPSEC)

Point-to-site (use L2TP)

 

Do *not* use PPTP. Ever. It sucks.

 

I'm not familiar with the vigor routers, but I can probably help with general questions like "What do i need to put in setting X"

[ahuxham]

What sort of VPN?

Site-to-Site (use IPSEC)

Point-to-site (use L2TP)

 

Do *not* use PPTP. Ever. It sucks.

 

I'm not familiar with the vigor routers, but I can probably help with general questions like "What do i need to put in setting X"

 

L2TP at your estimate (PC-to-SITE or MobileDevice-to-SITE)

 

Draytek actually have a Vigor 3300 demo site, where you can mess around with its exact configuration panel on the interweb.

 

DrayTek V3300 Advanced Router :: Administration

 

Which is always nice and dandy right? (Bit slow, its hosted in Taiwan)

[tom_newton]

DrayTek V3300 Advanced Router :: Administration

 

OK... would likely stick w/ chap as default, but then when it works, try MSCHAPv2

Stick with local users.

If you are ever going to have many (5+) users, ditch the draytek

 

Cant quite see where to set up usernames though?

 

Once you're done, you will need to get a windows box outside the draytek, and then create a new connection in network connections, of type VPN. It will auto-negotiate lt2p/pptp, but best set it manually. Looks like the draytek is PSK rather than certificate based, so should be no need for any of that.

[ahuxham]

DrayTek V3300 Advanced Router :: Administration

 

OK... would likely stick w/ chap as default, but then when it works, try MSCHAPv2

Stick with local users.

If you are ever going to have many (5+) users, ditch the draytek

 

Cant quite see where to set up usernames though?

 

Once you're done, you will need to get a windows box outside the draytek, and then create a new connection in network connections, of type VPN. It will auto-negotiate lt2p/pptp, but best set it manually. Looks like the draytek is PSK rather than certificate based, so should be no need for any of that.

 

 

Thanks for that Tom. Clear guidance! Just what I needed. It's unlikely to be more than 3 of us, with max 3 online at the same time, however I doubt it, the upload/download of that line is pants as its not leased.

[saundersmatt]

I set up a Vigor 3300V earlier this year using the guides available at Support Center -- Application Notes.

 

If you're stuck with anything give me a shout, i've got it working nicely with various xp and vista clients.

 

Matt

[tom_newton]

L2TP is ok... not the worst for bandwidth wasting, you will find you can do remarkably well with a couple of users on a DSL line. Can easily get 5 or 6 VoIP conversations, for example.

 

Just watch which protocols you use.

 

L2TP has 2 options - "gateway mode" where the remote gateway is used, and ALL traffic goes down the tunnel, or "split" where only traffic destined for the private net is tunneled. The latter is less secure (you're effectively making the l2tp client part of the perimeter) but means extraneous activity doesn't swipe bandwidth. If your clients are in the hands of trustworthy, intelligent users not running as admin, the split mode may be the best option. It is a client-side parameter - i believe remote gw is the default.