P2P VPN

A

AnotherUser

Limp Gawd
Joined
Oct 7, 2011
Messages
137
I have a site with 2 PCs and another with 1 PC. Both should have static public IP addresses. I'm looking for a "cheap" but business point to point VPN solution to connect these two sites.

I know I could use PFSense etc but I would like this to run on something small (Thinking ASA5505 or other router in terms of size) and supported. I don't really want to piece together two PCs, nics etc to get this running.

There won't be a lot of data being passed so I don't want to spend much. Maybe Hamachi would be a better solution? I have not used that in YEARS, any input?
 
AnotherUser said:
I have a site with 2 PCs and another with 1 PC. Both should have static public IP addresses. I'm looking for a "cheap" but business point to point VPN solution to connect these two sites.

I know I could use PFSense etc but I would like this to run on something small (Thinking ASA5505 or other router in terms of size) and supported. I don't really want to piece together two PCs, nics etc to get this running.

There won't be a lot of data being passed so I don't want to spend much. Maybe Hamachi would be a better solution? I have not used that in YEARS, any input?
Click to expand...

Zyxel USG 50.

It's a BSD implementation and is rock solid. I know of a couple that only get restarted for yearly firmware updates. The object oriented environment takes some getting use to.
Always talk to their support on the phone, never e-mail them. They are cheap enough that you can purchase a spare if you want/need. Most of the Zyxel stuf is not worth talking about but the USG series is something worth your time.
 
I was trying to stay away from the ASA due to cost. Reviewing the Zyxel and Cisco RV's, thanks.
 
The Cisco will work for this implementation, but don't be swayed by the Cisco name the RV series is really rebadged Linksys and some of the functions are very buggy.

Personally I found working with the RV series very irritating. Which is why I replaced our RV082 with a Zyxel USG 100. Which is a huge step up in most every way.


Cisco knows the RV series has issues which is why they now have the ISA550 and ISA570.


In my mind you should be looking at the Zyxel USG 50 and Cisco ISA550 are about equal performance wise.

The Zyxel USG 100 and ISA570 are a step up.

The ASA5505 is a step up from the support end and has different features. If all you are using it for is VPN connectivity.... Its the support and replacement policy you are paying for.

The Zyxel USG 50 is the least expensive option I would use in a business environment.
 
Mackintire said:
The Cisco will work for this implementation, but don't be swayed by the Cisco name the RV series is really rebadged Linksys and some of the functions are very buggy.

Personally I found working with the RV series very irritating. Which is why I replaced our RV082 with a Zyxel USG 100. Which is a huge step up in most every way.


Cisco knows the RV series has issues which is why they now have the ISA550 and ISA570.
Click to expand...

I agree, I replaced the RV series from a lot of business, and it is like night and day.
 
The RV Series was great... 6 years ago. Way behind for modern equipment. Stick with the USG50's, bulletproof and a boatload of config guides available.
 
Nate7311 said:
The RV Series was great... 6 years ago. Way behind for modern equipment. Stick with the USG50's, bulletproof and a boatload of config guides available.
Click to expand...

You are refering to the RV042 and RV082, but there is newer models like the RV120,RV220,...
 
Metraon said:
You are refering to the RV042 and RV082, but there is newer models like the RV120,RV220,...
Click to expand...

It doesn't matter, the firmware code was merged for all four models when they brought out hardware v2.

Now they all equally suck.
 
Given that this is supposedly a "cheap" solution I guess there are dynamic ip (ends) involved, IPSec doesn't really play nice with that but the proprietary solutions handles that fine? Otherwise Mikrotik uses OpenVPN which works good with dynamic IPs.

//Danne
 
I've recently learned that one site (main) has a static IP while the secondary does not. I believe a static can be had for no cost if needed.
 
Any input on the USG 20 vs 50? We're literately looking at 2 PCs at main (HARD to imagine many more (5max?) in the future) and 1 at the satellite.
 
USG 50 can do more VPN tunnels (50=10, 20=2) and has some other additional features like Anti Virus / IDP and AppPatrol. Since you only connecting a few PC's id say go with the USG 20.

USG20 has a plastic enclosure and a tiny fan - the USG 50 has a metal encolsure and no fan.

On a side note: I wouldn't buy Zyxel at all - but that's my personal opinion.
 
TheMTZ said:
USG 50 can do more VPN tunnels (50=10, 20=2) and has some other additional features like Anti Virus / IDP and AppPatrol. Since you only connecting a few PC's id say go with the USG 20.

USG20 has a plastic enclosure and a tiny fan - the USG 50 has a metal encolsure and no fan.

On a side note: I wouldn't buy Zyxel at all - but that's my personal opinion.
Click to expand...

Any suggestions around that price range? That USG 20 is around $160/ea which is nice.
 
I'd go for the USG 50. Metal case and no fan.

A more important issue is throughput. The USG 20 will be significantly slower at moving data through the VPN.

Check out the data sheets for more details.
 
Mackintire said:
I'd go for the USG 50. Metal case and no fan.

A more important issue is throughput. The USG 20 will be significantly slower at moving data through the VPN.

Check out the data sheets for more details.
Click to expand...

The internet connection is 5/1 and 3/1 right now so it's not a huge deal. Again, I don't see that increasing to problematic speeds for the 20 but I'll continue to research.
 
We had hundreds of USG 20 on lines ranging from 1 to 16 MBit and never had issues with VPN speed due to the processor. However we ran only 3DES/SHA1. If you run AES256 there might be a issue with fast lines i guess.
 
Nate7311 said:
OP, what kind of growth potential do you see, either PC's, users or sites?
Click to expand...

I understand I shouldn't use these words but I'd say almost zero growth. If I had to assume growth I'd say a MAX of 1 more PC per location over the next 5 years. Site growth I'd say maybe 1 additional with 1 user/pc.
 
That sounds about right.

I've measured the USG 100 topping out around 35Mbps using AES-256

The USG 50 has less memory but the same processor should top out around 20Mbps using AES-256 encryption

I would assume that the USG 20 would top out around 10Mbps using AES-256 given less memory and a slower processor.
 
Last edited:
the new edgemax router lite from ubiquity look good for this type of thing (and the right price at 100 bucks), but probably not quite mature enough yet.
 
dave99 said:
the new edgemax router lite from ubiquity look good for this type of thing (and the right price at 100 bucks), but probably not quite mature enough yet.
Click to expand...

Although it's a small business I just don't think I'd want to try that quite yet.
 
You have a few cheap good options.

1. If you have 2 extra computers, can be low end, you can set them both up with Untangle. It's an amazing firewall and supports site-to-site VPN using OpenVPN or IPSec. You can also setup remote access VPN. You MAY need to purchase the standard package to use the VPN.

2. Get 2 cheap routers that you can flash with Custom firmware, Tomato or DD-WRT. Tomato is much cleaner interface and does pretty much everything you need. DD-WRT has a boat load more features. Both can flash an additional firmware to enable OpenVPN support. Check the respective site for supported routers.

3. Configure OpenVPN on the workstations.

4. In your case, Hamachi will work well.
 
Woah, woah, woah. Did you seriously put Untangle, VPN and cheap all in the same post? :D
 
Nate7311 said:
Woah, woah, woah. Did you seriously put Untangle, VPN and cheap all in the same post? :D
Click to expand...

Untangle is free
The OpenVPN app is included free
All it needs is any computer with 2 NIC cards so you can infact get it up and running cheap :)
 
I thought that the OpenVPN site-to-site connection required purchasing licensing...

Edit: just reread their site. You'd be good with OpenVPN. My comment was really aimed at the IPSEC side of things. :)
 
The only reason you'd NEED IPSec is if you're connecting the Untangle to a different device that only supports IPSec or if you need to specify which interface the IPSec should be tunneled over. I had a client that has cable and T1, they wanted internet over cable and VPN over the T1. OpenVPN defaults to the external interface.

If you need any help with Untangle, Tomato/DD-WRT or Hamachi feel free to bug me.
 
You must log in or register to reply here.
Back
Top