Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to connect two buildings using an Ethernet connection with a switch on each end. The equipment inside the buildings is secure but the cable is not. If someone were to chop the cable and splice on a fresh connector they would essentially be able to get on our LAN. Is there any hardware I can put inside the buildings between the cable to bridge the networks while encrypting the data between them like a VPN? What are the best practices for this?

share|improve this question
up vote 1 down vote accepted

If you are worried about a possible intruder with physical access to your equipment, there is not much one can do to protect his data line. Such an intruder could place cables on the un-encrypted side of a server, and listen in on your traffic.

If instead you have somewhere safe where to place your hardware, then you could easily set up a moderately better solution. The important point is to have two OpenVPN-capable routers (whether dedicated pcs or true routers it does not matter), setting up a site-to-site OpenVPN connection. You can find instructions on how to do that here if you are contemplating a routed VPN, or here if instead you are interested in a bridged configuration. There are advantages to both, even though I prefer incurring the small extra cost of ICMP traffic across the whole LAN in order to have all local resources available to all machines.

Also, the solution depends a bit on the size of traffic you are envisioning: is this a SOHO? Then a solution with a home router like those mentioned in the two references provided is quite suitable. Larger amounts of traffic may require industrial-grade products.

The advantage of this configuration is that it is amply customizable: for instance, you may decide that all outgoing traffic will be channeled thru just one one the two routers, or alternatively you may opt for a solution where only internal traffic is routed thru the VPN, and all outgoing traffic is channeled directly to the Internet by each router. Also, in the case of a bridged VPN, you may disable one DHCP server, and have one router provide internal IPs for the whole LAN, or have both routers dish out private IP addresses, in the same subnet but in non-overlapping ranges; in this case it is easy to take care of DHCP requests trying to cross the divide between the two buildings.

And lastly, with a solution of this type you would have already set up all it takes to provide secure remote access to employees working from home, or road warriors.

share|improve this answer

If it were me; I would purchase two endpoint firewalls with site-to-site VPN over IPSEC; rather than using switches. Assuming cost is an issue Windows Server has built in support for PPTP or L2TP. Client-based VPNs do take a lot to manage though; so count the increased cost of the impact on IT to manage it.

share|improve this answer
I could do this and I prefer to use hardware. Any recommendations for some inexpensive endpoint firewalls? Something prosumer, not enterprise. – Jason G Oct 17 '13 at 17:46
Prosumer, cheap, with optics and sufficient speed? In that case I also want a dozen. Sadly thi sis one case where you get the famous 'A, B or C: choose any two'. And one of those is price. – Hennes Oct 17 '13 at 18:45

If you are running ethernet between buildings, use fiber optics, not wires. You'll be much happier after you have a few thunderstorms and your equipment still works...

It also raises the stakes considerably on cutting into the network, though of course it's still possible, with the right equipment. But it takes a much more prepared and capable attacker.

Then you can lay the VPN layer on top of that, as covered quite well by MariusMatutiae

If you monitor the network link, you will also be able to detect any cuts, as they will take the link down for some period of time before new connectors can be spliced on. Sloppy attackers may also end up changing the MAC address you are connecting to (careful attackers will spoof it, so that's not a reliable check.)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.