SecurityFocus is designed to facilitate discussion on computer security related topics, create computer security awareness, and to provide the Internet's largest and most comprehensive database of computer security knowledge and resources to the public. Gutenprint on Mac OS X would not be possible without CUPS, the open-source print spooler built-in for Mac OS X starting with version 10.2 (Jaguar). Gutenprint is strictly a printer support package. For multi-function devices, it supports only the printer function. Server and Application Monitor helps you discover application dependencies to help identify relationships between application servers. Drill into those connections to view the associated network performance such as latency and packet loss, and application process resource utilization metrics such as CPU and memory usage.

1.10.11.1 Utilizing SecureNAT to Make Things More Convenient
1. 1.1.About SecureNAT
2. 1.2.Accessing an Extremely Secure LAN Via Remote Access That Was Not Possible With Previous Technologies
2.10.11.2 Using SecureNAT For Amazingly Simple, Secure Remote Access With No Administrator Rights
3.10.11.3 A Practical Example Network
1. 3.1.Network Layout Example
2. 3.2.Purpose
3. 3.3.Preliminary Preparation
4.10.11.4 Starting Up VPN Bridge on the Remote LAN
1. 4.1.Configuring and Starting Up VPN Bridge
2. 4.2.Beginning the Initial Configuration of VPN Bridge
3. 4.3.Enabling SecureNAT
4. 4.4.Configuring the Cascade Connection to the VPN Server On the Internet
5. 4.5.Starting the Cascade Connection
5.10.11.5 Using Remote Access
6.10.11.6 SecureNAT and Security
7.10.11.7 The Dangers of Misusing SecureNAT

Before, administrator rights were a necessity when setting up a remote access VPN. But by using the SecureNAT capability built in to SoftEther VPN Server and SoftEther VPN Bridge you can build a remote access VPN that does not require administrator rights but retains all of the same functionality. This section will explain how to use SecureNAT to enable you to access your LAN from a remote location.

10.11.1 Utilizing SecureNAT to Make Things More Convenient

About SecureNAT

As explained in section 3.7 Virtual NAT & Virtual DHCP Servers, SecureNAT consists of the TCP/IP stack operated in user mode and Virtual NAT/Virtual DHCP Server. In particular, when IP access via Virtual NAT is performed the data is automatically relayed to the host using Socket API at the user level. This is a very advanced and intriguing technology.

Accessing an Extremely Secure LAN Via Remote Access That Was Not Possible With Previous Technologies

As explained in section 10.4 Build a Generic Remote Access VPN, to set up a VPN to allow remote access to an existing LAN from a remote location you must first install VPN Server on the LAN you wish to connect to remotely. In addition, that VPN Server must be able to be seen from the Internet. Finally, use local bridging to connect the Virtual Hub to the physical LAN and your remote access VPN is complete. This type of configuration will allow you to connect to an existing LAN remotely, but you will need system administrator (or network administrator) rights to complete the set-up in the following two locations:

When using the local bridge functionality to make a bridged connection between the Virtual Hub and the existing LAN you will need system privileges or administrator rights on the computer you install VPN Server to in order to execute the vpnserver process in service mode or user mode.
To enable access to the VPN Server from the Internet you will need to have a global IP address or configure your NAT or firewall to enable port forwarding to your VPN Server. You will need network administrator privileges to perform this configuration.

Therefore, if you want to enable secure and easy remote access to a device you have installed or are managing on a LAN, you will not be able to use VPN Server to set up a remote access VPN server as you would normally because you will need both system administrator and network administrator privileges on that LAN.

10.11.2 Using SecureNAT For Amazingly Simple, Secure Remote Access With No Administrator Rights

Your network environment must meet the following criteria to set up a remote access VPN using SecureNAT. Please refer to section 3.7 Virtual NAT & Virtual DHCP Servers for more information about the SecureNAT functionality.

There must be a computer running Windows, Linux, FreeBSD, Solaris, or Mac OS X that you can log on to as at least a general user on the LAN you wish to connect to remotely.
Also, you should receive confirmation from your network or system administrator that it is OK to access the LAN remotely before you begin setting up anything.

Normally, a LAN that meets the above conditions but consists of private IP addresses behind a NAT, firewall, or proxy server can not be connected to from outside the network. However, by utilizing the revolutionary new SecureNAT technology available only with SoftEther VPN you will be able to connect to even this type of network freely and securely from a remote location.

10.11.3 A Practical Example Network

Network Layout Example

In order to make the explanation in this section easier to understand, the method described here is for the sample network layout shown in the image below.

Network Layout.

First, there is a very secure network protected by a firewall or NAT that can not be accessed from the Internet. For this example, the network's IP address is 192.168.1.0/24. However, web sites can be viewed on the network by routing traffic through the firewall or NAT proxy server first. Also, the computer at IP address 192.168.1.1 is running Linux, although any other operating system that will run VPN Bridge such as Windows or Solaris is also acceptable. Assume that you do not have root access to this computer, but can log on to it as a general user. There is also a laser printer connected to the network at 192.168.1.10 that needs to be maintained.

Purpose

The reasons for using SecureNAT in the example network layout above are the following:

You will be able to perform remote maintenance on the laser printer at 192.168.1.10 on the network 192.168.1.0/24 which normally blocks all connections from the Internet.
If you explain to the administrator of 192.168.1.0/24 the situation and receive permission to set up such a VPN, but are worried about costs or the difficulty of changing the network's firewall settings, you can still set up the VPN without modifying the firewall.

Now we will explain in detail how to perform remote maintenance on the laser printer at 192.168.1.10 once you have reached this point in setting up the VPN.

Preliminary Preparation

The computer you set up with VPN Server beforehand at the IP address 130.158.6.51 is the VPN Server computer. Create a Virtual Hub on this VPN Server (the default Virtual Hub 'DEFAULT' will do) and create a user so that you can connect to that Virtual Hub later through VPN Bridge (assume you make the user 'test' with password authentication for this example). Please refer to section 3. SoftEther VPN Server Manual for more information about configuring VPN Server.

10.11.4 Starting Up VPN Bridge on the Remote LAN

Configuring and Starting Up VPN Bridge

First, you will need to physically visit the remote LAN (in this case, the LAN that contains the laser printer for remote maintenance at 192.168.1.10) at least once for the initial configuration process.

What you will need to do here is to log in as a general user to the Linux computer with the IP address 192.168.1.1 and install SoftEther VPN Bridge.

VPN Bridge is free to use if you just want to use it to connect to VPN Server. After unpacking the VPN Bridge Linux install package's tar.gz file and installing VPN Bridge on the computer at 192.168.1.1, the executable f

Table of contents

Bwanadik 4.1.0 10.11.5 For Mac