REQ: Low-end site-to-site VPN router that does split tunneling

Do a Google search in this group for the many posts from Mike Drechsler. I have taken his advice used the Netopia 3386-ENT routers (around $105 each) in a setup very similar to yours, but with 3 sites and a handful of remote connections. The configurations are not for the faint of heart, as they are all text-menu driven. I had quite a few setup issues, but the were mostly due to my inexperience. Their web site has a lot of good technotes, and Mike has been a great help. After a couple of weeks of playing with them, the settings become fairly straightforward and instinctual. I'm about to go live with remote access to my custom app via Terminal Services, and the 3 sites appear to have stable meshed IKE/IPSEC-secure VPN tunnels over ADSL (384k/1.5Mb) as of today. No VPN clients required at the sites, only the built-in XP VPN configs(PPTP+MPPE) for the remote users.

I'm only passing the RDP protocol through the site-to-site VPN tunnels though, so your app's performance may vary depending upon the client-server communication requirements.

Hope this helps.

I just realized I never said thank you. Thank you. :) I ended up asking them to find someone else to do it as I didn't feel confident enough that my suggestion would work. They didn't have 3 weeks to get set up.

Cisco/Linksys BEFVP41's will work just fine. All of the encryption is done in hardware in the BEFVP41's. No VPN client is required. It'll take you all of 1 day to set up.

I am unsure of what you mean by "split tunneling". In your diagram you show two locations (left -L and right -R), this could be 10 locations, it wouldn't matter but I'll stick to L & R.

When you set up the BEFVP41's you need to do 3 things:

1. Be sure to upgrade the BEFVP41's software to 1.01.04. Even new one's straight out of the box may have old software rev's in them, so be sure that you update to the latest version and at least 1.01.04.

1. Set up a domain name for the routers. If one or both of the sites are using dynamic dns then you can easily set up a DDNS with DynDNS
   formatting link
   ). Set the broadband modem to bridge mode and the BEFVP41 to automatically update DynDNS (30 sec works well).

2. Set up the BEFVP41 VPN tunnels to each location. Let's assume that Left PC's are 192.168.2.100-105 and the Right are

For BEFVP41-L: You set the Local Secure Group (subnet, IP address, or IP range); IP Range 192.168.2.100 - 192.168.2.105. This will allow all PC's with those IP's access to the encrypted VPN tunnel.

Next you set up the Remote Secure Group (still in BEFVP41-L), where you want to go. You can set it up the same as Local Secure Group (subnet, address, range) and in this case if you only wish PC's L to access the server you'd enter IP Addr 192.168.6.106.

Next you set the Remote Secure Gateway. YOu can set by FQDN, IP Address, Any. In this case you've assigned a DDNS to the BEFVP41-R, so set FQDN and the DDNS of BEFVP41-R (example floss-r.dynalias.com).

Next you set the encryption type and key management.

For BEFVP41-R you reverse the process & enter the DDNS of BEFVP41-L (example floss-l.dynalias.com).

In BEFVP41-L, click the Connect button and the VPN tunnel will be built between the two locations. All PC-L's can now access the server via the encrypted VPN tunnel by it's IP address 192.168.6.106 (or domain name if you've given it one). The VPN tunnel will stay up 24x7 unless you lose power.

If you are running Win2K or WinXP-P in PC-L's it's wise to set up Terminal Services at PC-L for the server application, otherwise you will be transfering huge amounts of data back and forth across a relatively slow DSL line and the users *will* experience lengthy delays.

PC-L & PC-R can still access the internet as normal. Be aware that because PC-L and PC-R do have access to the internet that they can be hacked, get viruses, etc., just like any other PC, so be sure to set the firewall in the BEFVP41's to *on* and add any other protective measures.

The above may sound a little complicated, but it's not really. There are a few settings that I've left out, but those are the basics.

I've set up multiple store locations using the same/similar setup (all using dynamic DNS DSL), and once set up properly I seldom have any problems at all. I do run full virus & spyware scans once daily on all the systems, have added extra software firewalls on the PC's & other protective measures, etc. Early on the only problem that I had was a user in one store liked to surf the internet a little too freely and kept picking up spyware & other nasty stuff. A few clicks in the router & firewall settings fixed that though :-).

Thanks for the reply. I did see that, but I didn't see any indication they support split tunneling.

I forgot to add that you can set up multiple VPN tunnels within those same routers; VPN's to another location, VPN's for certain PC's to access certain applications/servers, or another set of PC's on the other side, etc. You are not restricted to only 1 VPN tunnel in the BEFVP41's. I forget what the actual number is, but it's rather large (check the Linksys site) and should be more than sufficient for your purposes.

The server is actually a Unix/Linux (not sure which) server and the application is text based. It is accessed via basically terminal emulation on the PC's. Thus, I don't expect the amount of data transmitted back and forth to be exorbitant.

This was the key requirement. Being able to access the Internet at large and also a VPN over the same physical Internet connection is called split tunneling. I had no idea LinkSys's low end routers could be configured to support this.

Thanks, Mikah

So what did you end up doing?