[NRAO]

The Poor Man's VPN

All-in-one version

(Regular [individual slides] version)

Overview

Alternative to full-blown VPN
Why not use the VPN? Several reasons.
Setting up the connection with your SSH client
A Proxy AutoConfigure Script to "split tunnel" web access
How to set up your browser
Conclusions

Introduction

Why not just use the VPN?

VPN installation may be problematic, time-consuming
Kernel Source needed on Linux
VPN may need re-installed if you upgrade kernel version
You may be somewhere that the VPN client isn't

Set up the Connection

On Linux


        ( ssh -N -L 8080:proxy.cv.nrao.edu:3128 login.cv.nrao.edu & )

On Windows

Depends on your client
Putty: Configuration -> Connection -> SSH -> Tunnels
SecureCRT: See Gold Book Docs thereon.
Forward local port 8080 to remote port 3128 on proxy when making a connection to login host.

Proxy AutoConfigure Script

This is available as:

http://www.nrao.edu/poorvpn.pac


        function FindProxyForURL(url, host)

        {

        if (shExpMatch( host, "*.nrao.edu"))

            return "PROXY localhost:8080";

        else
            return "DIRECT";

        }

Configure your Browser

Use Web Documentation
Firefox: Edit -> Preferences (or Tools -> Options) -> Advanced -> Network Tab -> (Connection) Settings
Instead of, e.g. http://www.cv.nrao.edu/cvproxy.pac, use http://www.nrao.edu/poorvpn.pac as the Automatic Proxy Configuration URL.

Conclusions

Quick way of getting NRAO Internal Web Access from "outside"
Problem: need to edit preferences to restore, e.g. cvproxy.pac when at NRAO
Could be solved with multiple profiles (but then have 2 sets of bookmarks)
Solution ONLY gives web (and ssh) access
Could be extended (with multiple tunnels) to include IMAP, SMTP, POP3
Used for months by many staff members