Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

So I am having a problem. My office is in need of VPN capabilities, but our current network has a lot of sensitive data, so we are going to use two routers with two different VPN connections on two different networks (but the same internet connection). The higher level network will house all of our sensitive material, and our senior level employees will be able to access it. The other one will be used for general connection to our sale documents, printers, and mobile devices.

Configuring these two isn't the problem. My problem is that the higher level VPN network needs to have a one way connection to the first one, so all of our senior level employees can still access the sales documents and printers.

I know this is complicated, but can anyone give me any advice on how to go about setting this up using either Tomato or DD-wrt firmware?

Thanks all.

share|improve this question
add comment

2 Answers 2

up vote 0 down vote accepted

I have some knowledge of the workings of complex VPN solutions, as I wrote the StrongSwan chef cookbook currently used with Ironfan to establish VPNs within Amazon clusters.

What you ask is not beyond the realm of possibility; but I, personally, would not use either of the choices you gave for controlling the VPN connections you described.

What I feel you should be doing is this; dedicate an office machine to be the 'master' for both VPNs. Passthrough all IPsec traffic to this machine from the router(s). You'll need to keep both VPNs separated to keep the level of security you need; and your senior level employees will be required to connect to both. Within each of their VPN connections' configuration on their local machine you will need to use the setting to 'only use routes for assets on that subnet'. (It may be worded slightly differently across different OSes)

Know This: security mechanisms are complex and myriad; here is a listing from which you may choose to get ideas about where to go from there.

share|improve this answer
    
Thank you very much! I will look into this. You may have just helped us dodge a bullet! –  SysLamp Feb 4 '13 at 5:05
    
@Syslamp I'm currently available for hire if you need this done properly. :) –  Jerry W Jackson Feb 4 '13 at 5:12
add comment

You should also look at Logmein Hamachi's zero config VPN solution.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.