Overview

The goal of this project is to connect dozens of inexpensive wireless routers such as the Linksys WRT54GL to two or more Check Point VPN gateways. A number of special requirements must also be met to support VoIP.

The Linksys WRT54GL is one of many routers capable of running OpenWRT. OpenWRT is a Linux distribution for embedded devices. The term SOHO VPN Router will be used to refer to an inexpensive router running OpenWRT.

Special Challenges include:

• Supporting DHCP Assigned IP Addresses on the SOHO VPN Router WAN ports.

• Requires the use of a Dynamic DNS client on the SOHO VPN Routers.
• Requires the use of the Interoperable Device objects in Check Point
  • Requires Dynamic Addresses
  • Requires the use of certificates to authenticate VPN tunnels. This documentation shows how to use the Check Point Internal Certificate Authority (ICA) to create certificates that can be used with the SOHO VPN Routers. Check Point identifies certificates based on Distinguished Name (DN) in the matching criteria box. Check Point uses FQDN for link selection.

• Reduce latency by creating a full-mesh network.

• A hub and spoke VPN community is created in Check Point.
• Although the Check Point VPN Community is Hub and Spoke, the individual routers have spoke to spoke connections to create a full-mesh network. Shell scripts are used to create and maintain the spoke to spoke tunnels.

• Support QoS on the SOHO VPN Routers

• Remote users need to be able to save large Excel spreadsheets to a file server at the corporate office while speaking with clients on a VoIP phone. This presents a special challenge since it is normally not possible to separate traffic classes within an IPSec tunnel. The QoS engine can either be linked to the ipsec0 interface or the br0 interface. Running two instances of QoS will not produce the desired results.

• Q: How do you get QoS to work on multiple interfaces when only one is allowed? A: Add a second router (What do you want for $50?) and run the IPSec tunnels on router #1 and QoS on router #2.