Recommend me a VPN

[sporkman]

I'm kind of annoyed with OpenVPN as I could never get it to work in my particular scenario for site-to-site use. I find it's great for getting from a coffee shop to my home net though, so I'll leave that as-is.

But I have 3-4 other sites where I would like to have site-to-site setups between my home (simple network - two WANs, one just for backup, one LAN net, that's it) and some remote networks.

My requirements are:

- The other end only has proprietary stuff that only does IPSEC, so I have to tunnel back to a FreeBSD host at the other end rather than the router (I know this complicates things)
- I need to filter the traffic on my end - I should be able to reach out, none of the remote sites should reach in
- I do need to add additional routes, accessed via the remote sites
- The other end is FreeBSD in all cases, so whatever I run has to support FreeBSD

OpenVPN confuses me in these type of use cases as it has it's own internal/hidden routing table. If anyone thinks it could support the above, I'd give it a try, but I've had no luck with this on OPNSense (worked on pfsense, but not with any setup that let me filter traffic).

Or if you want to make a case for using the Cisco and SonicWall IPSEC VPNs at these sites instead, I'm all ears, but I fear interoperability headaches, and it seems like adding additional remote routes is a real pain.

Or pitch me on something I've not mentioned!

[mimugmail]

Why dont you use IPsec for this?

[banym]

I agree with mimugmail.
Why no IPsec.

[sporkman]

Never had much luck with IPSEC and since it's a kernel-level thing instead of a userland daemon, generally a real pain in the ass to debug.

[banym]

I use it every day.
Very stable, and flexible.

If you got used to the error handling it is o.k to debugg and Google is you friend.
Stay to fix configuration of encryption, hashing and DH group and everything is fine.

*sense systems worked with every vendor I got confronted with on the other side.
And as afar as I understand OpenSwan/StrongSwan is an userland implementation that integrates with kernel.

[sporkman]

I agree with mimugmail.
Why no IPsec.

Also since IPSEC relies on GRE being let through, NAT not breaking it, etc. I do prefer something that just uses one protocol over one port. Easier to diagnose basic connectivity.

An example - ongoing issue where one of these carriers is doing something, including a note that some content inspection gear is doing something dumb:

https://puck.nether.net/pipermail/outages/2019-October/012696.html

[mimugmail]

Then just use OpenVPN Sorry, but all vendors use one of them or both