Best of the Newsgroups: vpn windows browsing

If this isn't exactly what you wanted, please try our Search (there's a LOT of techy and non-techy stuff here about Linux, Unix, Mac OS X and just computers in general!):

From: Jeff Liebermann <jeffl@comix.santa-cruz.ca.us>
Subject: Re: Telnet printing
Date: Sat, 31 Jan 2004 11:06:41 -0800
Message-ID: <qutn10t68bvj9kaanu62c4o1gpc0ovidqr@4ax.com> 
References: <LNWdnfBPhsoFm4XdRVn-sA@thebiz.net> <0001HW.BC4145A300B05929F0284600@usenet.plus.net> 

On Sat, 31 Jan 2004 11:44:35 +0000, Simon Hobson
<simonsnews@thehobsons.codotuk> wrote:

>Of all the replies, I'd suggest that these days VPN is so easy to implement 
>that I would consider that first - then you have full control over the IPs 
>used and apart from the VPN tunneling itself you don't need to mess about 
>modifying server or client - effectively you can treat the client as being 
>directly connected to your network. As well as encrypting everything from 
>prying eyes.
>Simon

Agreed.  However, there are a few things one should know before
blundering onward.  Since a VPN router is essentially transparent to
all forms of traffic, I was getting clobbered by excessive broadcast
traffic propagated through the routers.  However, if I turn off
broadcast propagation, the infamous Windoze browsing doesn't work.
Same with using a single central DHCP server which is a very bad idea
over a VPN.  I had to hack some custom filter rules to make it all
work as my clueless customers absolutely insisted that they needed
Windoze browsing.  My suggestion is to live without Windoze browsing
and just use:
  \\NETBIOS_machine_name
from the "Run" box to access remote machines.

Incidentally, the most common mistake I've seen is using the same
Class-C IP block in more than one location.  It's a natural to setup
the routers using the default LAN side IP block (usually
192.168.0.xxx) on every VPN router.  Bad idea.  That actually will
work with some routers (i.e. Sonicwall), but causes all kinds of
routing and address management problems.  It's also really easy to end
up with duplicate IP's.  Each office should have it's own Class-C IP
block as in:
  192.168.0.xxx   main office
  192.168.1.xxx   remote office 1
  192.168.2.xxx   remote office 2
and so on.  

Also, most of the small routers will only handle 256 IP's.  If you
have a large office, with either more than one Class-C, or a Class-B
netmask, the cheap VPN routers won't work.


-- 
Jeff Liebermann  150 Felker St #D  Santa Cruz CA 95060
(831)421-6491 pgr  (831)336-2558 home
http://www.LearnByDestroying.com   AE6KS
jeffl@comix.santa-cruz.ca.us   jeffl@cruzio.com

Take Control of Your Domain Names

Jump to Comments

Many of the products and books I review are things I purchased for my own use. Some were given to me specifically for the purpose of reviewing them. I resell or can earn commissions from the sale of some of these items. Links within these pages may be affiliate links that pay me for referring you to them. That's mostly insignificant amounts of money; whenever it is not I have made my relationship plain. I also may own stock in companies mentioned here. If you have any question, please do feel free to contact me.

Specific links that take you to pages that allow you to purchase the item I reviewed are very likely to pay me a commission. Many of the books I review were given to me by the publishers specifically for the purpose of writing a review. These gifts and referral fees do not affect my opinions; I often give bad reviews anyway.

We use Google third-party advertising companies to serve ads when you visit our website. These companies may use information (not including your name, address, email address, or telephone number) about your visits to this and other websites in order to provide advertisements about goods and services of interest to you. If you would like more information about this practice and to know your choices about not having this information used by these companies, click here.