tony.chamberlain at lemko.com wrote: > I am looking for the optimal VPN. Well it doens't have to be that elaborate. > Just the best VPN. We currently have some customers using PPTP, some using > openvpn, some using Cisco Any Connect and there are a few others. > > So my question is, if you have control of both ends (client and server) > what is the best VPN to use? There are not too many requirements, but a > big one is > > The VPN must return the same IP address to the same user each time > > That is there must be a specific IP address assigned to a user/password > combination. pptp does not really do this but I wrote sort of a backend > (or maybe frontend? ;-) ) to change the IP address assigned based on a > login and password. It is extra stuff I would prefer not to do though. > > > _______________________________________________ > CentOS mailing list > CentOS at centos.org > http://lists.centos.org/mailman/listinfo/centos > My sense is that openvpn is the easiest to configure, the most robust and fault tolerant, as far as keeping connections up and reestablishing failed connections. The downside of openvpn is incompatibility with most mobile devices, not relevant if you are able to install openvpn clients. You can configure fixed IP addresses using either the ccd files or the client-connect script. Based on other discussussions on the list my recollection is that IPSEC provides better performance if you need GigE or better data rates on your VPNs. My sense is that IPSEC may be more difficult to configure and less robust at keeping connections up, but this has probably improved in recent years. The main advantage to pptp that I see is compatibility with mobile devices. A disadvantage of PPTP, as far as I know it cannot easily be tunneled through something like a linux firewall because it uses non-standard protocol packets (not TCP/UDP). Both OPENVPN and IPSEC can easily be tunneled through most firewalls. Though I have not researched this extensively, just based on watching list of security updates that get released for Centos, Fedora etc, It seems that OPENVPN has had very few security issues. I have definely seen a few for strongswan and openswan (both are IPSEC implementations). Again this is just gut feeling, not the result of any investigation. I do note though that OPENVPN runs easily in a chroot environment, just by enabling options in the config file. I'm not sure if openswan or strongswan can do this. Nataraj