- WLUG - wlug.mailman3.com

Re: [Wlug] vpn behind firewall

by Michael Long

Thanks for all the help...It seems I may be locked out of my local lan while connected :( I now have a semi-minor issue to solve. When connected to the vpn I can use realplayer to listen to internet radio after configuring the necessary proxy server. I have not been able to configure xmms play the same links. Off to RTFM for this. Cheers, Mike > On Fri, Jan 03, 2003 at 07:54:12PM -0500, Michael Long wrote: > mlong> Now for my final issue. I have not been able to configure my cisco vpn > mlong> to allow me access to my local lan when connected the vpn is running. > mlong> This is proving to be most inconvenient because I do have a web server > mlong> running that is accessable to the outside world. Unfortunately the > mlong> webserver is unavailable when the vpn is activated. I am thinking that > mlong> if I add a second nic card to the box and configure it properly that I > mlong> should be able to have one card handle the webserver traffic and the > mlong> other card will handle the vpn traffic. Does this seems like a sane > mlong> configuration? If so can someone point me to documentation that will > mlong> explain how to accomplish this. > > Maybe, maybe not. Most VPN software intentionally blocks access to other > networks except thost reachable through the VPN for security reasons. > This is known as disabling "Split Tunneling". If you can re-enable > Split Tunneling, you would be able to access your local network without > going through the VPN. Unfortunately, it is usually a setting controlled > on the VPN server, and enforced by the binary-only VPN client. > > -- > Charles R. Anderson <cra(a)wpi.edu> / http://angus.ind.wpi.edu/~cra/ > PGP Key ID: 49BB5886 > Fingerprint: EBA3 A106 7C93 FA07 8E15 3AC2 C367 A0F9 49BB 5886 > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > > >

Jan. 4, 2003

Re: [Wlug] vpn behind firewall

by Charles R. Anderson

On Fri, Jan 03, 2003 at 07:54:12PM -0500, Michael Long wrote: mlong> Now for my final issue. I have not been able to configure my cisco vpn mlong> to allow me access to my local lan when connected the vpn is running. mlong> This is proving to be most inconvenient because I do have a web server mlong> running that is accessable to the outside world. Unfortunately the mlong> webserver is unavailable when the vpn is activated. I am thinking that mlong> if I add a second nic card to the box and configure it properly that I mlong> should be able to have one card handle the webserver traffic and the mlong> other card will handle the vpn traffic. Does this seems like a sane mlong> configuration? If so can someone point me to documentation that will mlong> explain how to accomplish this. Maybe, maybe not. Most VPN software intentionally blocks access to other networks except thost reachable through the VPN for security reasons. This is known as disabling "Split Tunneling". If you can re-enable Split Tunneling, you would be able to access your local network without going through the VPN. Unfortunately, it is usually a setting controlled on the VPN server, and enforced by the binary-only VPN client. -- Charles R. Anderson <cra(a)wpi.edu> / http://angus.ind.wpi.edu/~cra/ PGP Key ID: 49BB5886 Fingerprint: EBA3 A106 7C93 FA07 8E15 3AC2 C367 A0F9 49BB 5886

Jan. 4, 2003

Re: [Wlug] vpn behind firewall

by Michael Long

I have gotten both vpn's coexisting nicely with each other. I can now connect to my desktop at work via vnc. It looks like I can now remove my windows partition...YEA! Now for my final issue. I have not been able to configure my cisco vpn to allow me access to my local lan when connected the vpn is running. This is proving to be most inconvenient because I do have a web server running that is accessable to the outside world. Unfortunately the webserver is unavailable when the vpn is activated. I am thinking that if I add a second nic card to the box and configure it properly that I should be able to have one card handle the webserver traffic and the other card will handle the vpn traffic. Does this seems like a sane configuration? If so can someone point me to documentation that will explain how to accomplish this. Thanks again, Mike > Well, my editor ate that one... Let's try this again. > > On Tue, Dec 24, 2002 at 05:58:15PM -0500, Michael Long wrote: > mlong> it if anyone could give me some clues or at least some intelligent > mlong> questions to ask so that I might make this thing work. It is sometimes > mlong> necessary to "help" the help desk in order that they can help you. :) > > "VPN" can mean many things... but usually it means a PPTP or IPsec > encrypted tunnel. IPsec uses port 500/udp for ISAKMP key exchange, and > IP Protocol number 50/51 for ESP/AH encryption/authentication (i.e., not > TCP or UDP). > > IPsec wasn't designed to work with the hack that is NAT (Network Address > Translation, Internet Connection Sharing), so if you are sharing one > real IP address to multiple computers with a Linksys, you can run into > issues. Basically, vendors like Linksys have hacked around the IPsec > limitation to make it sort of work through the NAT. Make sure you have > turned on the "IPsec passthrough" features of your router (NOT IPsec/VPN > endpoint). You should also look for an upgrade to the Linksys firmware > to see if it addresses your issue... It is hit-or-miss often times with > these SOHO routers. Good luck. > > mlong> Part 2: I am planning to fire up a vpn connection to my employer on > mlong> Thursday for the first time. Are there any issues running 2 vpn > mlong> connections behind a firewall. > > The IPsec through NAT hack I mentioned above usually only works with ONE > IPsec session at a time, so if both VPN's use IPsec, you may be out of > luck unless you take turns using the VPN software. On the other hand, > some vendors have figured out a way to allow multiple IPsec sessions to > work through NAT at once... > > It could be that one or both VPN's are using a technology other than > IPsec, in which case, the issues are completely different. PPTP usually > works fine through NAT, for example. There are other protocols as well, > which may or may not work through NAT. > > In addition, if they are using IPsec with a Nortel Networks Contivity > VPN switch on their end, it may have a feature called "NAT Traversal" > which wraps the entire IPsec flow in UDP packets (the administrator > chooses the port number, but Nortel recommends 10001/udp). If this is > the case, it might make sense to turn OFF any IPsec-passthrough features > of your router, so that the NAT Traversal kicks in. > > -- > Charles R. Anderson <cra(a)wpi.edu> / http://angus.ind.wpi.edu/~cra/ > PGP Key ID: 49BB5886 > Fingerprint: EBA3 A106 7C93 FA07 8E15 3AC2 C367 A0F9 49BB 5886 > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > > >

Jan. 4, 2003

RE: [Wlug] HP workstation up for grabs (free)

by Doug Geiger

I'd be happy to take that off your hands - if it's still available. -- Doug Geiger runexe(a)bioradiation.net http://bioradiation.net/~runexe/ If you're crossing the nation in a covered wagon, it's better to have four strong oxen than 100 chickens. Chickens are OK but we can't make them work together yet. -- Ross Bott, Pyramid U.S., on multiprocessors at AUUGM '89. GNU Privacy Guard Fingerprint: E06F 00C8 50D3 19FC 6F6B 3F56 6B76 0762 DD37 4686 > -----Original Message----- > From: wlug-admin(a)mail.wlug.org > [mailto:wlug-admin@mail.wlug.org] On Behalf Of Mike Peckar > Sent: Friday, January 03, 2003 1:56 PM > To: wlug(a)mail.wlug.org > Subject: [Wlug] HP workstation up for grabs (free) > > > HP 9000/710 workstation > 32MB RAM > 50 Mhz CPU > 812MB disk (2x406) > 1024x768 graphics > 17" Monitor > Keyboard, mouse, but no CD and no RD > Was last running HP-UX 10.10 w/ CDE > > Also, looking for a halfway decent sparc - please contact me offline. > > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > >

Jan. 3, 2003

HP workstation up for grabs (free)

by Mike Peckar

HP 9000/710 workstation 32MB RAM 50 Mhz CPU 812MB disk (2x406) 1024x768 graphics 17" Monitor Keyboard, mouse, but no CD and no RD Was last running HP-UX 10.10 w/ CDE Also, looking for a halfway decent sparc - please contact me offline.

Jan. 3, 2003

RE: [Wlug] Color matching scanned photos vs. printed output

by Skip Gaede

Hi Andy, I have just discovered that the GIMP can work with color profiles. See http://www.coloraid.de/, which was referenced at http://www.normankoren.com/color_management_3.html Norman Koren has a web site that discusses a lot of aspects of digital darkroom. To calibrate things, you need a printed color chart, an example of which is the IT8 target. I have seen them sold by Praxisoft for $70.00, but you can get the same chart from Germany for $10.00 US + $5.00 S&H. Check out SCARSE which is a Linux program for scanner profiles. HTH, Skip > -----Original Message----- > From: wlug-admin(a)mail.wlug.org [mailto:wlug-admin@mail.wlug.org]On > Behalf Of Andy Stewart > Sent: Friday, December 27, 2002 1:09 AM > To: Worcester Linux Users' Group > Subject: [Wlug] Color matching scanned photos vs. printed output > > > > Hi Everybody, > > I've been playing with my new toy, an Epson 1660 Photo > scanner, which works > very nicely with Linux. > > I have noticed that photos that I scan in and then print > don't look the same > as the original. I am using Xsane, Gimp-Print, and CUPS. If > it matters, the > photo is 4x6 inches, scanned at 400 DPI, and printed in 1440x720 high > quallity mode. The photo was originally printed from my 3 > Mpixel digital > camera (2160x1440 pixels), so I believe I've used a more than > sufficient DPI > when scanning. > > I suspect the problem is that neither the scanner nor the > printer is perfect, > and that the cumulative effects of the transfer functions (scanner to > computer to monitor to computer to printer) are causing this. > Its actually > worse if I let Xsane compensate for me with its automatic > adjustments of > gamma, brightness, and contrast. Adjusting the image on my > monitor screen > probably isn't going to help much since my monitor isn't > perfect, nor is > there any guarantee that I have it properly adjusted. > > Is there any good way, other than trial and error, to fix > this? Would > generating some simple test patterns help in making the > proper adjustments? > > Thanks, > > Andy > > -- > Andy Stewart, Founder > Worcester Linux Users' Group > Worcester, MA USA > http://www.wlug.org > > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

Jan. 3, 2003

zaurus

by Wesley Allen

Hi gang, Well, I'm thinking about just going out and getting a zaurus for myself, I've seem them for around $330 as some places. Should I do this, or just convert my iPAQ as I planned? There are some features of the iPAQ that I like (like inviting attendees to meetings), but getting some sync-ability with Linux is just over the top for me.... Anyone get zaurus to sync with Evolution? Wes

Jan. 1, 2003

encyclopedia

by doug waud

Hi all I wonder whether I have found a gap in availability of applications for Linux :-( Specifically, I have been looking for a CD encyclopedia which will run on a Linux box (in particular a couple I set up for my two grandkids). Wine does not seem to provide a work-around both because it does not seem to be happy with any CD encyclopedia and because it would require buying Win* to get the CD stuff installed (and neither computer is worth as much as Win* would cost). I tried searching for Linux + Encyclopedia but that just gives me encyclopedias about Linux. A search for CD + Encyclopedia gave a reasonable list but none runs under Linux (as you might expect, all run under Wintel and a few on Macs). Does anyone know of a general CD encyclopedia that one can use with Linux? doug PS The grandkids take to the linux boxes quite naturally. I showed the older one how to type "lpr -Plp3 filename" to print a file. He later reported that he tried it on his brother's box but, since it was a second computer and Q comes after P and 4 comes after 3 he used -Plp4 (obvious isn't it:-) ) and it worked! :-)

Dec. 31, 2002

Web site down?

by Keller, Tim

At least from Stratus, I'm not getting any connectivity to www.wlug.org ... (actually I'm not sure that this email will get there either...) Tim.

Dec. 31, 2002

Re: [Wlug] vpn behind firewall

by Michael Long

I have gotten both vpn's coexisting nicely with each other. I can now connect to my desktop at work via vnc. It looks like I can now remove my windows partition...YEA! Now for my final issue. I have not been able to configure my cisco vpn to allow me access to my local lan when connected the vpn is running. This is proving to be most inconvenient because I do have a web server running that is accessable to the outside world. Unfortunately the webserver is unavailable when the vpn is activated. I am thinking that if I add a second nic card to the box and configure it properly that I should be able to have one card handle the webserver traffic and the other card will handle the vpn traffic. Does this seems like a sane configuration? If so can someone point me to documentation that will explain how to accomplish this. Thanks again, Mike > Well, my editor ate that one... Let's try this again. > > On Tue, Dec 24, 2002 at 05:58:15PM -0500, Michael Long wrote: > mlong> it if anyone could give me some clues or at least some intelligent > mlong> questions to ask so that I might make this thing work. It is sometimes > mlong> necessary to "help" the help desk in order that they can help you. :) > > "VPN" can mean many things... but usually it means a PPTP or IPsec > encrypted tunnel. IPsec uses port 500/udp for ISAKMP key exchange, and > IP Protocol number 50/51 for ESP/AH encryption/authentication (i.e., not > TCP or UDP). > > IPsec wasn't designed to work with the hack that is NAT (Network Address > Translation, Internet Connection Sharing), so if you are sharing one > real IP address to multiple computers with a Linksys, you can run into > issues. Basically, vendors like Linksys have hacked around the IPsec > limitation to make it sort of work through the NAT. Make sure you have > turned on the "IPsec passthrough" features of your router (NOT IPsec/VPN > endpoint). You should also look for an upgrade to the Linksys firmware > to see if it addresses your issue... It is hit-or-miss often times with > these SOHO routers. Good luck. > > mlong> Part 2: I am planning to fire up a vpn connection to my employer on > mlong> Thursday for the first time. Are there any issues running 2 vpn > mlong> connections behind a firewall. > > The IPsec through NAT hack I mentioned above usually only works with ONE > IPsec session at a time, so if both VPN's use IPsec, you may be out of > luck unless you take turns using the VPN software. On the other hand, > some vendors have figured out a way to allow multiple IPsec sessions to > work through NAT at once... > > It could be that one or both VPN's are using a technology other than > IPsec, in which case, the issues are completely different. PPTP usually > works fine through NAT, for example. There are other protocols as well, > which may or may not work through NAT. > > In addition, if they are using IPsec with a Nortel Networks Contivity > VPN switch on their end, it may have a feature called "NAT Traversal" > which wraps the entire IPsec flow in UDP packets (the administrator > chooses the port number, but Nortel recommends 10001/udp). If this is > the case, it might make sense to turn OFF any IPsec-passthrough features > of your router, so that the NAT Traversal kicks in. > > -- > Charles R. Anderson <cra(a)wpi.edu> / http://angus.ind.wpi.edu/~cra/ > PGP Key ID: 49BB5886 > Fingerprint: EBA3 A106 7C93 FA07 8E15 3AC2 C367 A0F9 49BB 5886 > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > > >

Dec. 31, 2002