Containing costs in VPNs

As inexpensive as centrally managed firewall-VPN devices are, the cost to build a large-scale, site-to-site VPN can be high. Sometimes the problem is the vendor mix, because vendor-supplied firewall management tools can't handle multiple vendors. Other times, it's a question of a company being stuck with perfectly good branch-office firewalls that don't do VPN very well.

The best open source alternative is OpenVPN, an SSL-based VPN tool that easily and quickly links broadband-connected remote sites to a central data center. As a technology, OpenVPN has advantages, even over some commercial VPN products based on the more efficient and better-behaved IPSec protocols. Because most broadband ISPs use network address translation (NAT), businesses using low-cost connections without statically assigned IP addresses have found that the complex IPSec protocols don't always work reliably through NAT devices. Encapsulating traffic inside a single TCP connection is a good way to get around the problem, and SSL-based VPNs such as OpenVPN have always done this.

From the point of view of cost, OpenVPN is even more attractive. If there's a remote server running Windows, almost any flavor of Unix, or Mac OS X, the server can be used as a VPN gateway to connect the remote site securely using OpenVPN. Because the software works with the servers already deployed at remote sites, it can be retrofitted easily into existing networks without requiring new hardware.

OpenVPN isn't the answer to all ills. High-speed connections work better over IPSec, and the idea of running VPN traffic through a server won't go over well in many environments. In addition, OpenVPN is not suitable for large, meshed VPNs because it lacks a large-scale management system.

Like many open source tools, the OpenVPN management interface is a command line. Because of the popularity of the product and the well-documented API in OpenVPN, a number of open source, GUI-based tools are available to help in configuration and system monitoring.

In hub-and-spoke VPN configurations of small branch offices - broadband connections coming into a central data center - OpenVPN works well and has high availability and scalability features that wouldn't normally be expected in open source products.

Great open source options in four security areas

Mail security gateway

• SpamAssassin
• DSPAM
• Bogofilter
• MailWasher Server
• Maia Mailguard
• Clam AntiVirus

Intrusion detection

• Snort
• IDS Policy Manager

Vulnerability scanning

• ACID BASE

Site-to-site SSL VPN

• Nessus
• OpenVPN

Snyder, a Network World Test Alliance member, is a senior partner at Opus One. He can be reached at Joel.Snyder@opus1.com.