Hi all, I'm working in an educational institute and I must improve actual services. First here is a diagram of my network : [url=http://www.hostingpics.net/viewer.php?id=806730TrainingRoomNetwork.png][img]http://img11.hostingpics.net/thumbs/mini_806730TrainingRoomNetwork.png[/img][/url] How it works actually : [list][*] Linux Server acts in a proxy manner (by Squid) to offer access to students (only for web content (i.e ports 80, 443)) after they've been authenticated (LDAP Authentication inside Squid).[/list] This solution is not totally reliable and secure, and the needs are not totally satisfied, so I have to set up a new service in accordance with theses restrictions : [list][*] All training rooms are isolated from others [*] Students inside a same training room can communicate together (only with their LAN IP) [*] Students have all privileges on workstation inside the training room but MUST be authenticated to access outside (office network or internet) [*] Students can connect to servers inside (intranet) and outside (internet) office network [*] Students must be authenticated on OpenVPN by our LDAP server [*] (Optional) Students may have their own IP offered by the VPN (always the same) [*] Services offered can differ between rooms (or better between students)[/list] So my questions are : [list][*] Is a VPN (and particularly OpenVPN) a good alternative to my Squid-based actual solution ? [*] Do you have any caveats or advices ?[/list] I hope I was clear enough, and remain at your disposal if you have some questions. Thanks by advance, Best Regards, Bruno PS: Sorry for my pretty poor English...

Does OpenVPN help in my case ?

bmacadre

Hi all,

I'm working in an educational institute and I must improve actual services.

First here is a diagram of my network :

How it works actually :

Linux Server acts in a proxy manner (by Squid) to offer access to students (only for web content (i.e ports 80, 443)) after they've been authenticated (LDAP Authentication inside Squid).

This solution is not totally reliable and secure, and the needs are not totally satisfied, so I have to set up a new service in accordance with theses restrictions :

All training rooms are isolated from others
Students inside a same training room can communicate together (only with their LAN IP)
Students have all privileges on workstation inside the training room but MUST be authenticated to access outside (office network or internet)
Students can connect to servers inside (intranet) and outside (internet) office network
Students must be authenticated on OpenVPN by our LDAP server
(Optional) Students may have their own IP offered by the VPN (always the same)
Services offered can differ between rooms (or better between students)

So my questions are :

Is a VPN (and particularly OpenVPN) a good alternative to my Squid-based actual solution ?
Do you have any caveats or advices ?

I hope I was clear enough, and remain at your disposal if you have some questions.

Thanks by advance,
Best Regards,
Bruno

PS: Sorry for my pretty poor English...

TinCanTech

Hi,

your English is very good 8-)

Personally, I cannot answer you question but I can offer this:

OpenVPN is a very versatile tool which has many options for such things as authentication.
In truth, however, you will most likely be the person who will know best how/where it can help ..

Take some time to read the HOWTO and the manual and take some to time to try it in your environment.

OpenVPN server is best suited to your Linux server and a lot of work has gone into making the client side
suitable for as many platforms as possible .. so that should help you in the long run.

If you run into problems please post them here (please read the forum rules)
For specific questions regarding your detailed usage I recommend you consult the user mailing list as well.

If you have never used openvpn before .. have no fear .. it is well documented and development is very active.

Even if you don't use it for your initial cause, you may start using it for something anyway !

Best regards

bmacadre

Hi,

Thanks for your reply, I'll try this during summer.

And, I'll come back say if it works or not.

Regards