N800 VPN Client. Cash Reward?
 

So I'm a decent programmer myself, but with no experience with Maemo yet combined with no experience with the technical side of VPN or kernel patching, this is not something I want to attempt coding...

My school/work uses PPtP and IPSEC VPN (see http://kb.iu.edu/data/ajrq.html )

What I really want is a simple GUI that allows me to enter the required name/pass/key options and will connect using the above protocol and allow me to use my N800 @ the office.

I really have little knowledge on how big of an undertaking this is, but I know it could definitely benefit the community if something like this happened and I'd be willing to put up some cash to someone who was able to get it working (and I assume some others would do the same).

I'm not talking about owning the rights or anything gross and non-opensource friendly. Just a small reward for someone who's willing to use their valuble time to write some software they wouldn't normally take the time to write perhaps.

If you think you might be able to do this, or perhaps know some more info on the technical limitations of the N800 hardware to allow this, or even if you want to offer up some money yourself, please post here!

If it doesn't work out, at least I gave my attempt to make it happen :)

Thanks guys!

Re: N800 VPN Client. Cash Reward?
 

There is desktop linux support for PPtP (the MS variant) with tools, these could probably be ported to the N800. The kernel has the PPtP support too, but this is possibly not enabled in the N800 version so you would have to build your own.

There is however OpenVPN available already, and where I work we switched from PPtP to OpenVPN and thus that's where my interest is so unfortunately I'm not raising to the challenge of getting PPtP to work -- I'm more interested in getting the OpenVPN support integrated into the network applet, as now it's a hassle to use.

Re: N800 VPN Client. Cash Reward?
 

Hey, another IU tablet user! (PM me and if you want we can try and get it to work over spring break). IU has a decent iu-vpn script, but if I remember correctly the N800's kernel does not have the required kernel modules, so it'll have to be replaced.

The latest firmware update might have fixed it, but my tablet is still being repaired, so I've not tested it.

Re: N800 VPN Client. Cash Reward?
 

I too go to IU, and have a N800.. and am currently completely unable to use it on the campus wifi network..

This is the email I got back from tech support:

Hello Chris. I hate to tell you this, but the only
VPN services IU provides are PPTP and L2TP over
IPSec. If your PDA's client doesn't support either of
those, then I'm afraid it won't be able to connect.

The decision to run L2TP over IPSec rather than full
IPSec over both transport and tunnel modes was made
quite some time back in order to ensure compatibility
with the largest majority of connecting clients -
Microsoft Windows computers - without the need for
additional software. Another reason was flexibility;
there's no telling what protocols might be called
for, and L2TP over IPSec provided the ability to
transport more than just TCP/IP. Granted, that
flexibility doesn't mean much nowadays - what
*doesn't* use TCP/IP? - but it was a legitimate
concern back in the planning days.

Now, the current IPSec servers are Cisco ASA 5500s.
There's no plan that I'm aware of to enable pure
IPSec connections alongside or in replacement of L2TP
over IPSec.

We do have a pool of Cisco 3000 VPN servers that's
running PPTP, but there's no plan to have them run
IPSec. On the contrary, those servers ability to use
IPSec was recently disabled; they're one year short
of their end-of-life cycle, and the administrators
intend to retire them.

Anyway, that's the state of VPN here at IU. Sorry
there's no answer to hooking your Nokia up, but L2TP
over IPSec is the way the service owners chose to set
them up. Now, I don't know much about the distro of
Linux that goes on your Nokia, but is it possible for
it to use any of the "Swans" (FreeS/Wan, OpenSwan,
or StrongSwan)? Or something like isakmpd? I don't
know what would go into that; While I've played with
Mandrake/Mandriva, Red Hat/RHE/Fedora, and Gentoo,
I've never really driven that deep into Linux, so I'm
not certain what's involved in getting those apps to
run.

Re: N800 VPN Client. Cash Reward?
 

This is why you should go to Purdue. It is much better and it also has one of the best college wifi networks. Do you have PAL at IU? If so maybe I can help. Otherwise go Purdue.

Re: N800 VPN Client. Cash Reward?
 

Thats a nice pitching line... I dont think thats a real solution though..

Re: N800 VPN Client. Cash Reward?
 

Hi,

I just saw your posting, and I think I may know how to pull it off, though it will take me some time to put the solution together with a GUI. I can however most likely put together something that can be used from a shell much quicker while we get the GUI worked out afterwards. I've configured VPNs on a LOT of systems and routers and most of my time was spent configuring IPSec in crossplatform setups for functionality between Windows & Linux.

The GUI would be a front end to OpenSwan one of the more powerful VPN applications out there. The solution that your campus requires, to make it simpler for their Windows clients to connect is actually a hell of a lot more complicated. IPSec creates a Layer 3 tunnel from peer to peer, then L2TP tunnels PPP inside another Layer 2 GRE tunnel, and finally PPP will authenticate and give you an IP on your campus' network. This is not an easy task to configure - but due to M$'s wisdom that is how "their" version of IPSec built in clients work!

The result is that you will need a Shared Key from your campus as well as a login and password to connect.

Now on the N800, which I am going to purchase this month (yay!) runs a version of debian, it should be possible to rebuild the packages necessary for your VPN client solution, which would roughly be:

1. openswan or strongswan w/ x.509 certificate patches
2. L2TP patched version of ppp
3. kernel modules for IPSec, either native or openswan implementations as well as any other protocols we are likely to need (GRE etc etc).
4. iproute2
5. Our own custom made front end (possibly written in GTK+) that configures and Initiates/Terminates tunnels for openswan.

Now, I haven't investigated OpenVPN - it may be that much easier to implement this solution with that piece of software - but honestly, I looked at your post and said - HEY I KNOW HOW TO DO IT. So lets try!

- Mephistos

Re: N800 VPN Client. Cash Reward?
 

Mephistos, did you get the developer discount? If you're going to seriously create this tool I think you should.

Question: will the app you're talking about work with a SecureID card token?

Re: N800 VPN Client. Cash Reward?
 

I believe someone already did this, for the 770.

A company called Stinghorn announced a L2TP/PPTP VPN client for the 770. It required that you flash a custom kernel, to get the support needed.

Unfortunately, their website (www.stinghorn.com) is dead now. Google for them, and you'll see quite a bit of stuff.

If someone has a backup of their cvs/subversion tree, it might make the task considerably easier, as it will just require updating things to the N800

Re: N800 VPN Client. Cash Reward?
 

No, wasn't aware of it. But I haven't commited to making a purchase yet (waiting on next pay day). Where do I sign up for it?

Re: N800 VPN Client. Cash Reward?
 

L2TP/PPTP is not exactly the same as L2TP over IPSec which is what we are talking about here. It would be useful to have a client, however, most of the time these clients are just custom scripts that setup a GRE connection to tunnel PPP though. There is a plain PPTP client out there for debian, it should be a matter of course to get it working for the N800. Once you mix IPSec into this, things get a little crazy. This is shaping up to turn into a suite of VPN based clients it looks like. :)

Re: N800 VPN Client. Cash Reward?
 

Shouldn't the standard MS PPtP stuff work? That's my understanding from the reply from the sysadm. If so I'm in line with the previous poster (and I mentioned this in my first reply too - see posting 2).

Re: N800 VPN Client. Cash Reward?
 

The developer discounts have all been allocated.

It's worth noting that many people clamouring for an easy to use VPN solution all require different things. Personally, I now need PPTP, however others need OpenVPN, others L2TP, others IPsec etc. etc.

A single easy-to-use GUI which handled all of the above would be the real killer app...

Re: N800 VPN Client. Cash Reward?
 

Though it seems unlikely anyone will ever code such a beast, it would be truly wonderful to have. I bought my N800 expecting to make an IPsec VPN connection to my Netgear router at home. I saw there were VPN clients for the internet tablet and foolishly never investigated whether there were multiple incompatible VPN technologies.

Re: N800 VPN Client. Cash Reward?
 

sjgadsby , openvpn is a bit complex to set up, but you just need to open one UDP port on your router and you're done.

Re: N800 VPN Client. Cash Reward?
 

I have considered that, but at this time I don't have a particular desktop I keep powered on (and running a set OS) at home. I'd like to use the VPN built into my router to access whatever's on the network.

Re: N800 VPN Client. Cash Reward?
 

PPTP is bad; the control & authentication channels are outside the encryption.

L2TP is better, but by itself the protections suck (weak encryption).

Cisco's IPSec + XAUTH suffers from incompatibility with, oh, everything not Cisco, and has a group enumeration vulnerability.

L2TP/IPSec is best of the lot, but it really needs EAP-TLS authentication to be secure.

SSL VPNs are the new buzzword, but they make you jump through hoops to transport anything other than application protocols.

Nah, I'm not cynical. :)

-- C

Re: N800 VPN Client. Cash Reward?
 

I like the sound of this - and yes it would be a killer (set of) app(s). As for unlikely to code such a beast: It's been coded, all the connection methods have. Though not integrated into a single client - but what we could make is a single front end and have all the clients work under it, that is not an unreasonably hard undertaking, I mean it's just configuration files and scripts we need to create. It would not be too much of a stretch to get it working. I'm not a GUI programmer - however I can make the back end work, and this looks like a cool cool project that would be useful to a lot of people - and again I think I know exactly how to do it. I can't wait to get one of these babies in my grubby hands to start playing with it.

So far, I can see we will need the following:

- IPSec software (as in openswan or strongswan)
- custom kernel for the N800 w/ appropriate networking apps (like iproute2 iptables etc etc)
- for PPTP pure Microsoftian connection, you need these 3 debian packages:
kernel-patch-mppe - MPPE Encryption for PPP
pptp-linux - Point-to-Point Tunneling Protocol (PPTP) Client
pptpd - PoPToP Point to Point Tunneling Server (if you want MS Windows machines to connect to your N800 through PPTP).
- L2TP has no specific client, you can literally setup scripts to create the appropriate GRE tunnels configured with a PPP connection through to authenticate with the server.
- a Front end (in the beginning there was text) that we can make into a Maemo-prettied GUI for the masses.

Unfortunately the install of this is *not* likely to be easy. It will most likely require a custom kernel unless we can make those modules that we need into packages from the default kernel, I think that would resolve the instalation hassles and make it a lot easier to install.

Re:Texrat - I believe that I've seen patches for SecureID, but my quick perusal of the respective IPSec implementation's FAQs I didn't see any mention beyond a subject header. SecureID is sent as part of XAUTH in IPSec, if there is cash to be had for this project, maybe we can find someone willing to write a patch that implementes this functionality. I don't want to do it for the money and I don't have the skills to implement that myself, I just want to create solution for us to use.

Re: N800 VPN Client. Cash Reward?
 

3 of the people on this threat attend Indiana University. Our university supports two solutions, either PP2P, or L2TP over IPSEC.

It would seem that L2TP over IPSEC will be the easiest solution to implement.

This page here (http://www.jacco2.dds.nl/networking/linux-l2tp.html) has instructions on setting up a linux machine as a L2TP over IPSEC VPN client.

The three components needed:

IPSEC - The N800 already has vpnc, although, I am not sure if this will work. The author's instructions use openswan.

PPP support - is this included in the kernel by default?

LT2P support - This will need to be ported, although, it doesn't involve a kernel module (thank goodness). The best one seems to be: http://www.xelerance.com/software/xl2tpd/

Re: N800 VPN Client. Cash Reward?
 

[QUOTE=genome4hire;37542]3 of the people on this threat attend Indiana University. Our university supports two solutions, either PP2P, or L2TP over IPSEC.

It would seem that L2TP over IPSEC will be the easiest solution to implement.
[/url]

Not too sure. IU's Unix Support has a rather good set of scripts for setting up the PPTP connection, and so the only thing needed is to install the pptp client (easy rebuild of the Debian package) and replacing the kernel with one that has the required crypto modules.

Whether to build a GUI on top of that or not is optional. It might be useful, but then again, there's PPTP support for NetworkManager in their Subversion repository, which who knows, we might get in OS2008.

http://kb.iu.edu/data/akcx.html

Re: N800 VPN Client. Cash Reward?
 

Being a Linux sissy, I was wary to try vpnc from the command line, but after installing the vpnc app and the GUI interface today I was able (contrary to earlier reports) to connect to my campus VPN (New York University) using the GUI interface which works well. Since I spend 70% of my day on campus, this now renders the N800 completely indispensable, mobile computing campus wide, online apps for taking notes in classes and if I leave my desktop on via VNC or RDP I will be able to connect for power use at any time :D

Re: N800 VPN Client. Cash Reward?
 

Someone said the first discounts were used up, but Nokia also states that they are open to appeals for further discounts. I don't recall the link offhand but the info was on a maemo page and the link is somewhere in this forum.

As for the VPN tool itself, I agree that a ubiquitous front end with every option under the hood is the killer app.

Re: N800 VPN Client. Cash Reward?
 

Hi just ordered my N800 and was looking at the VPN options.

All looks familiar with not having the right VPN options.

If you look on Jacco website above you'll see a link to mine as I converted all that stuff to run on the ipcop version of Linux. Don't tell me now I'm going to have to do the same on N800!

Although I didn't have to bother with custom kernels as openswan is part of IPCop distro. All I did have to do was port L2TP; and configure PPP and Openswan for it to work. Less familiar with Debian as I'm a Redhat man myself (well for the last 7 years, was slackware before that).

Duncan

Re: N800 VPN Client. Cash Reward?
 

Amazing on so many levels.

People are actually interested in my project idea?

People at my school know what an N800 is?

What a concept! :)

Re: N800 VPN Client. Cash Reward?
 

Hi all,

I would also like to be able to connect to my school's VPN, however, they stated clearly on their website that they do not support linux. I still believe that it is possible to use the N800 to log in, but I need some advice.

Here are the settings that they recommend for Windows XP. Can someone advice me on the relevant VPN client to use on the N800 and what I should do? I'm new to this...

It uses PPTP for the protocol.

Creating a new VPN connection
1. Click Start, then select Control Panel.
2. Click "Network and Internet Connections".
3. Click "Create a connection to the network at your workplace".
4. In the New Connection Wizard window, select "Virtual Private Network connection", then click Next.
5. In the box under "Type a name for this connection in the following box.", type a descriptive name, such as "SCHOOL".
6. Click Next.
7. In the box under "Host Name or IP address", type "130.95.11.2" (without quotes).
8. Click Next.
9. Tick the "Add a shortcut to this connection to my desktop" box if you want to a shortcut for the SCHOOL connection on your desktop.
10. Click Finish.

--------------------------------------------------------------------------------

Connecting to the SCHOOL VPN
1. Click Start, then select Connect To, then select "SCHOOL" (or the descriptive name you gave your connection).
2. Enter your SCHOOL username and password in the appropriate boxes.
3. Click Connect.
4. If you are prompted to enter a windows networking username and password, click the Cancel button.



Luke

Re: N800 VPN Client. Cash Reward?
 

btw, i managed to get on the wireless network, but without a way to hook into the vpn, its useless to me at the moment. i hope those of you who are experienced can give me a hand! thanks!


Luke

Re: N800 VPN Client. Cash Reward?
 

I just purchased my N800. I'm still a total noob on this thing, however I'm going to figure it out right away. As for your PPTP connection - if you can find the PPTP-client sources and compile it you should be fine, I don't know yet how compatible the arm binaries from debian are - but they will work, the only thing you need to worry about is the MPPE compression from M$ that needs to be built into the kernel, possibly as well patched into PPP. Once I can figure out how to rearrange this virtual keyboard so I can type IPs properly as well as use the PIPE | symbol I think I'll get myself testing the pptp-linux client.

Re: N800 VPN Client. Cash Reward?
 

Mainstream Linux can work with MS PPTP, it has the necessary support in the kernel and some application to use it. If this is or could be made available for the N800 is the question.

Re: N800 VPN Client. Cash Reward?
 

No question. I am using PPTP with my n800.
You just need an armel version of pptp and a patched kernel for you n800.
The rest is the same stuff as it is in linux.

Re: N800 VPN Client. Cash Reward?
 

So, can you share your kernel and armel version of pptp? :)

Re: N800 VPN Client. Cash Reward?
 

sure.
take a look at http://maemo.lancode.de

greetz

Re: N800 VPN Client. Cash Reward?
 

Loki: Thank you so much!

I installed the package, and flashed my kernel with the image you provided.

After 2 hours of hacking the config scripts (I've never setup a VPN connection in linux before) - I have something that can connect to my university VPN.

One question: Right now, I use "pon" and "poff" to start and stop the vpn connection. I see that you created a ip-up.local script which seems to do some maemo specific stuff, although, I'm not totally sure what it does. I'm guessing that it somehow updates a GUI to tell you that it's connected. Can you confirm this, and explain it a bit more?

For those (2 or 3) of you who attend Indiana University, and would like a copy of my config files, drop me an email: csoghoian at gmail dot com.

It's a shame that it's my last week of classes for the semester - i've had the N800 at my house all semester long, unable to work on campus.. But finally, i'll be able to take it to class now!

Chris

Re: N800 VPN Client. Cash Reward?
 

So can I confirm that I need to flash this onto my N800

zImage-os07-3.2007.10-7-mppe.bin

and then install this

pptpclient-1.7.0.deb

For me to use PPTP VPN? Chris, can you send me your config file as a reference? Where is it stored?

Re: N800 VPN Client. Cash Reward?
 

yeah. flash your device with the new kernel (Image-os07-3.2007.10-7-mppe.bin). your kernel now knows mppe-algorithm which is needed by pptp.

then install pptpclient-1.7.0.deb. this installs an armel compiled version of pptp into your system.

now you can follow this link:
http://pptpclient.sourceforge.net/ho...figure_by_hand
(a ssh-server on your nokia and a pc is recommend for this)

but after this is also done, there is just one hurdle. take a look at the routing stuff you can find also on the link.
i think http://pptpclient.sourceforge.net/ro...#all-to-tunnel is a good point to start.

after the routing stuff is done, everything should went fine...

greetz

Re: N800 VPN Client. Cash Reward?
 

Hi guys,

Thanks for the help. I'm having some problems...

I normally use Windows XP, and the Nokia flasher doesn't allow me to flash zImage-os07-3.2007.10-7-mppe.bin which is like only 1.5mb (?) . So I tried loading Kubuntu and using flasher-3.0 to flash. It took like 1 second to flash it I think and the N800 booted up find after that, everything appears to be the same before flashing. So I'm just wondering if I flashed it? Is there any way to check?

I tried the flasher.dapper file to flash, but it complained about some API being the wrong version. So I ended up trying the flasher-3.0 (which I'm not sure whether it worked or not).

Help required!

Luke

Re: N800 VPN Client. Cash Reward?
 

Oh, btw, must I be root in order to run the pptp client? that pon command?

At the moment, it says on dip group has access...

OK, so I went into root....

I followed here
http://pptpclient.sourceforge.net/ho...figure_by_hand

then I ran the pon command and that's it...i don't even know if it works..

no indication....how do I check? I'm trying to get into my school's VPN...should I do this when I'm in school? Cos my laptop allows me to VPN to the school from home too. How to check?

Re: N800 VPN Client. Cash Reward?
 

the binary is just 1,4 MB because it is just a kernel image. not the whole maemo os. after the flashing all settings,data and programms should are there and work fine too.

i used the x86 binary (http://maemo.org/downloads/d3.php?f=flasher-3.0) too, to flash my device. the flash command must be run as root to ensure the right to use the usb-ports. the process should take 2-4 secs... but there will not be any messages a la "mppe was enabled!" but i imagine that there was a green(not blue) indicatior bar during flashing. u can just check it if you install pptp, set all settings and try to connect to your university. if there is an error a la "your kernel doesn't support mppe" ... than you know that there was something wrong.

Is there linux on your laptop too? if so, i recommend you to sit down with your laptop and try to connect the laptop via pptp. (no gui, just use the config files and the xterm)

if you got this working, sit down with your device, flash it, install pptp, set all settings, and have the same fun as on your laptop!

hint: use the follwing command to start the connection:
look at the output of the line above, it will tell you all necessary about your tunnel ...

greetz

Re: N800 VPN Client. Cash Reward?
 

Hi Loki,

Yup! I did all that. It does have lots of data reported back from the debug, but sort of hangs at 1 portion until I CTRL-C it. And then it will shut down the pptp link and give me back the prompt.

Roughly, it goes to the MPPE 128-bit stateless compression enabled, then there's some sent and rcvd data...
not replaching the default route to wlan0 [192.168.1.1]
then
Cannot detemine ethernet address for proxy ARP
local IP address 130.95.91.181
remote IP address 192.168.0.144
Script /etc/ppp/ip-up started (pid 2897)
Script / etc/ppp/ip-up finished (pid 2897), status 0x0

then it hangs there

sending a ctrl-c causes

script /etc/ppp/ip-down started (pid 2901)
MPPE disabled
...
modem hangup
connection terminated
...
script /etc/ppp/ip-down finished (pid 2901), status = 0x1

then I get back my prompt.

What does all that mean? Thanks in advance!

Re: N800 VPN Client. Cash Reward?
 

your xterm doesn't hang, it runs your application (pptp) and waits for it to get finished. don't forget the "&" at the end of the command if you wish to use the same xterm for other applications at the same time.

your log seems to be fine ...
try
if you get "ppp0: error fetching interface information: Device not found"
something went wrong, but if there is a device ppp0 u just have to fight with routing.

try to ping your gateway. try 192.168.0.1 or 192.168.0.254

look at http://pptpclient.sourceforge.net/ro...#all-to-tunnel
these lines do the necessary stuff...
your tunnel seems to be fine, but there seems to be trouble with your routing. google a bit and make yourself confident with routing...

greetz

Re: N800 VPN Client. Cash Reward?
 

Hi Loki,

Yup, ppp0 does report back with an IP. I'm using IPHome applet and it shows up when I tap on the applet.

So yes, I think I'm left with routing it. I'll go read the link you provided. I'm not really a linux person, so all this is pretty new to me. Thanks for your help!

the ip-up and ip-down scripts mentioned in the link look different from the ones on the n800's /etc/ppp/ directory. Am I supposed to create new ones or modify the existing ones?

I managed to install PING to the N800, but when I tried to ping those IPs you suggested, couldn't get the ping reply.

BTW, when I tried poff "filename" it doesn't seem to work. I get

/user/bin/poff: /usr/bin/poff: 40: getopts: not found
/user/bin/poff: /usr/bin/poff: 46: getopts: not found
/user/bin/poff: No pppd is running. None stopped.

Is there something I need to do?


Luke