On Sun, May 14, 2017 at 3:52 AM, Mick <michaelkintz...@gmail.com> wrote: >> I had some problems setting up OpenVPN that were solved by using >> per-client public keys. That seems to be the best supported >> configuration (as well as the most secure). Windows-side using >> OpenVPN-GUI is very easy. >> >> OpenVPN tends to have poor bandwidth due to overhead, but that may be >> in large part due to my connection. > > OpenVPN is not the most efficient VPN implementation for connections to a > server because it is not multithreaded and also because unlike IKE/IPSec it > operates in userspace, not in kernelspace. If you have more than one client > connecting to the server at the same time you will need to set up multiple > instances with different ports or different protocols. With IKE/IPSec you > don't. MSWindows PCs come with IKEv2 natively so they can be configured to > use it without installing additional client applications. > > A VPN connection will expose each endpoint's LAN to the other and therefore > additional firewall configurations could be required. >
That is only in one setup. It is possible to assign an IP address to OpenVPN such that you will need any traffic to cross onto your LAN. >> >> OpenVPN also offers transparent compression which can be a big >> >> plus for your scenario. >> > >> > Not really, a lot of data is images, usually JPEG, some ZIP files, some >> > PDF. All that doesn't compress too well. >> > >> >> OpenVPN is not too difficult to setup, and the client is available for >> >> all major OSes. And it's not too complicated to use: Open VPN >> >> connection, then use your file transfer client as you're used to. Just >> >> one simple extra step. >> > >> > I'm finding it a horrible nightmare, see above. It is the most >> > difficult thing you could come up with. I haven't found any good >> > documentation that explains it, the different types of it, how it works, >> > what to use (apparently there are many different ways or something, some >> > of which require a static IP on both ends, and they even give you >> > different disadvantages in performance ...), how to protect the >> > participants and all the complicated stuff involved. So far, I've >> > managed to stay away from it, and I wouldn't know where to start. Of >> > course, there is some documentation, but it is all confusing and no >> > good. >> >> Feel free to start a thread on it. As above, I recommend >> one-key-per-client and running your own CA. > > For secure connections you will have to set up CA and TLS keys with any > option. Even ftps - unless the ftp server is already configured with its TLS > certificates. > No, certain OpenVPN modes allow encryption without a CA, but they are limited (e.g. single user, single password, etc).
