60

Chapter 6. Virtual Private Networks

Figure 6 1. A Network and Remote Client Connected by CIPE

The diagram shows a network running CIPE on the firewall, and a remote client machine acting as a

CIPE enabled node. The CIPE connection acts as a tunnel through which all Intranet bound data is

routed between remote nodes. All data is encrypted using dynamically generated 128 bit keys, and

can be further compressed for large file transfers or to tunnel X applications to a remote host. CIPE

can be configured for communication between two or more CIPE enabled Linux machines and also

has network drivers for Win32 based operating systems.

6.2.1. Why Use CIPE?

There are several reasons why CIPE would be a smart choice for security and systems administrators:

Red Hat Linux ships with CIPE, so it is available to all Red Hat Linux edge machines (for example,

firewalls or gateways) that you wish to connect to your Intranet. Red Hat Linux also includes CIPE 

supported encryption ciphers in its general distribution.

CIPE supports encryption using either of the standard Blowfish or IDEA encryption algorithms.

Depending on encryption export regulations in your country, you may use the default (Blowfish) to

encrypt all CIPE traffic on your Intranet.

Because CIPE is software based, any older machine that is able to run Red Hat Linux can become a

CIPE gateway, saving an organization from having to purchase expensive dedicated VPN hardware

simply to connect two LANs securely.

CIPE is actively developed to work in conjunction with IP Tables, IP Chains, and other rules based

firewalls. Simple peer acceptance of incoming CIPE UDP packets is all that is needed to coexist

with existing firewall rules.

Administrators can configure CIPE through text files.

6.2.2. CIPE Installation

The installation of CIPE is equivalent to installing a new network interface under Linux. The CIPE

RPM contains configuration files found in

/etc/cipe/

, the CIPE daemon (

/usr/sbin/ciped cb

),

network scripts that load the kernel module and activates/deactivates the CIPE interface (

if* cipcb

),

and sample configuration files found in

/usr/share/doc/cipe  version /samples/

. There is

also a detailed texinfo page explaining the CIPE protocol.