VPN 是安全连接私人网络的好方法。 它们甚至可以用来掩盖你的公共 IP，这样你就可以访问公共服务器而不被追踪。 市场上有许多 VPN 产品，从开源软件到专有软件，从自我管理到 VPN 即服务，功能繁多。
我最近接到一项任务，要在市场上找到最好的产品。最佳是一个模糊的术语。 一个涵盖所有基本功能的开源 VPN 最适合简单的实施。 或者，对于中高预算的实施而言，具有大量简单性和定制化功能的专有 VPN 可能是最佳选择。 因此，我决定比较一下市场上的不同产品。 完全开源的 VPN 不在此范围内。
以下是我在开始之前牢记在心的事情：
- 简约: 管理员可轻松设置网络、用户和 SSO 等。
- 远程访问：从任何远程位置和任何平台访问专用网络。
- 强大的加密功能: VPN 客户端与 VPC 之间的加密隧道。
- 现场到现场的实施: AWS VPC 与远程网络之间的隧道连接，例如，办公室网络与 VPC 之间的连接。
- 门禁控制: 例如，某些用户只能访问某一组主机。
- 第三方应用程序的访问控制: 只能通过 VPN ip 与第三方应用程序建立连接，不能直接连接。
每个 VPN 都可以处理相同的功能，但处理方式可能不同。 在此，我们要确定比较的标准：
- 建筑学
- 定价
- 门禁控制
- 高可用性/复制
- 议定书
- 客户
- 业绩
- 图形用户界面
- 认证
- 两步 AUTH
- 易于设置和使用
以下 VPN 符合上述标准，并进行了全面比较。
- 淘宝网
- 普利妥尔
- 佛跳墙怎么下载不了
- 脉冲安全
佛跳墙怎么下载不了
普利妥尔
Pritunl 是一种分布式可扩展基础设施，没有主服务器。 因此，Pritunl 可以根据需求轻松扩展。 它使用 mongodb 作为数据库，可以安装在同一实例上，也可以安装在托管实例上，以备我们需要冗余的 vpn 服务器时使用。
基本的 pritunl 集群架构。
Pritunl 远程访问
逐地实施修剪
OpenVPN 接入服务器
OpenVPN 作为独立的 OpenVPN 访问服务器在 VPC 中运行。 它还可以作为主节点和辅助节点（具有多个实例的集群）运行，如果主节点出现故障，则由辅助/备用节点接管。 但该功能在 AWS 上无法使用。
使用 OpenVPN 访问服务器进行远程访问。
站点到站点实施 OpenVPN 接入服务器。
佛跳墙怎么下载不了
AWS 默认支持站点到站点 vpn 访问和远程访问 vpn 隧道。 这些服务完全由 AWS 管理，这意味着管理员无需担心故障或高可用性。
以下是远程员工连接多个 VPC 的架构图。
aws 中的站点到站点 VPN
点击这里有关 aws 客户端 vpn 端点的更多信息
脉冲安全
Pulse 安全简单的实施与 openVPN 几乎相同。 可以使用 cloudFormation 模板在 aws 中配置 PCS 实例。 它可以通过任何 PCS 客户端软件进行连接。
点击这里管理指南
佛跳墙怎么下载不了
普利妥尔
分布式架构是 pritunl 的核心。 因此，很容易实现冗余和处理故障切换。 一台 pritunl 主机可以运行多个 OpenVPN 服务器实例。 每台服务器都可以连接到多台主机，这样，如果其中一台主机出现故障，就可以在另一台主机上启动服务器。
OpenVPN 接入服务器
OpenVPN 接入服务器为故障和恢复提供备份/备用节点。 不过，这一功能在 AWS 上无法使用。 但我们可以使用路由 53 在 OpenVPN 接入服务器上实现 HA。
这里是实现相同目的的文件参考。
脉冲安全
Pulse Secure 建议使用虚拟流量管理器（Pulse 产品）作为负载平衡器，通过多个 PC 实例的主动-主动集群实现高可用性。
以下是 pcs 主动-主动配对的示意图
佛跳墙怎么下载不了
佛跳墙怎么下载不了 完全由 AWS 管理。 因此，我们无需明确担心复制和冗余问题。
佛跳墙怎么下载不了
OpenVPN 接入服务器
OpenVPN 访问服务器具有内置的基于规则的访问控制。 这意味着，我们可以定义用户可以访问哪些网络/主机，其他网络/主机则被禁止访问。
普利妥尔
Pritunl 并不像 Openvpnas 那样提供基于规则的访问控制，但可以通过组来实现访问控制。 不过，它似乎不像 openvpn 那样简单明了。
脉冲安全
Pulse secure 支持基于规则的访问控制。 例如，我们可以允许或拒绝某些特定角色使用 tcp://*:80,443。
佛跳墙怎么下载不了
可允许特定用户组（活动目录 SID 或 IDP 中的组 ID）访问特定网络。 不支持基于端口或协议的访问控制。
佛跳墙怎么下载不了
OpenVPN 接入服务器
顾名思义，OpenVPN 接入服务器是基于开源 vpn 协议 openvpn 构建的。
普利妥尔
Pritunl 的默认核心协议也是 OpenVPN 协议。 但它也实现了 wireguard 协议。 它在站点与站点之间的链接中使用 IPSec。
脉冲安全
供应商未透露
佛跳墙怎么下载不了
佛跳墙怎么下载不了 使用 OpenVPN 协议进行远程访问隧道。 IPsec 用于站点到站点的 VPN
佛跳墙怎么下载不了
OpenVPN 接入服务器
OpenVPN 客户端支持几乎所有主要平台。 以下是列表：
- LinuxOpenVPN 客户端支持几乎所有主要平台。 以下是列表
- 窗户
- IOS
- 苹果操作系统
- 安卓
佛跳墙怎么下载不了
佛跳墙怎么下载不了 客户端支持以下平台
- 窗户
- 苹果操作系统
由于 佛跳墙怎么下载不了 使用 OpenVPN 协议，因此也支持第三方 OpenVPN 客户端。 但如果使用联合认证方法，第三方 OpenVPN 客户端将无法使用。
脉冲安全
脉冲客户端适用于以下操作系统
- 视窗 10
- Windows 8.1
- Windows 7+
- macOS 10.15
- macOS 10.11
- Ubuntu 17.x
- Ubuntu 16.x
- Debian 9.x
- Debian 8.x
- Cent OS 7.x
- Cent OS 6.x
- RHEL 7.x
- Fedora 26
- 安卓
- IOS
此外，脉冲安全客户端还可以通过网络浏览器启动。
普利妥尔
以下是 Pritunl 客户端支持的平台列表：
- Ubuntu-18,20
- Fedora-33
- Debian-10
- Centos-8
- arch linux
- 甲骨文 linux-8
- macOS 英特尔
- macOS 苹果 硅
- 窗户
不过，pritunl 也支持 OpenVPN 客户端，但 OpenVPN 客户端的一些功能（如自动同步 VPN 配置文件）比较滞后。 因此，它可以支持所有主流平台。
佛跳墙怎么下载不了
以下 vpns 的带宽均为其声称的带宽。 实际性能可能有所不同，可通过 iperf 确定。
OpenVPN 接入服务器
openVPN 服务器的性能取决于我们想通过 vpn 服务器路由多少带宽。
配备 AES-NI 芯片组的现代 CPU 处理单向传输的每 Mbps 数据需要使用 12MHz 的 CPU 频率。 因此，举例来说4 核心系统在3千兆赫将被视为12,000MHz. 相当于1000 Mbps 最大吞吐量. 内存方面，粗略估计每 150 台连接设备需要 1GB 内存。 大约 16GB 的磁盘空间应该绰绰有余，因为需要存储在磁盘上的数据只有连接和程序日志，以及用户证书和设置。
OpenVPN 建议单个实例不要使用超过 1000 个连接。 但默认限制为 2048 个。
普利妥尔
我们知道，pritunl 的核心是 OpenVPN 协议，因此对硬件的要求几乎相同。 不过，Pritunl 声称在客户端和服务器端都使用快速英特尔 CPU 和 AES-NI 的情况下，每次连接的最大带宽为 100mbps。
在 pritunl 上实施 wireguard 会更快，因为 wireguard 协议比 OpenVPN 更快。
佛跳墙怎么下载不了
AWS 建议使用 iperf 测量其 vpn 连接的带宽。 根据 AWS 的说法，带宽取决于多个因素。
AWS 最多允许 2000 个并发连接。 而且可以通过增加限制请求来提高并发连接数。
脉冲安全
PSA 有 3 种虚拟设备。 数据表如下。
| 适用范围 | 最大并发用户数（SSL） | 最大隧道吞吐量（ESP 模式） | 最大隧道吞吐量（SSL 模式） | 中央处理器 |
| PSA3000-V | 200 | 408 Mbps。 | 268 Mbps | 2 |
| PSA5000-V | 2500 | 514 Mbps | 484 Mbps | 4 |
| PSA7000-V | 10000 | 2.4 Gbps | 1 Gbps | 8 |
佛跳墙怎么下载不了
OpenVPN 接入服务器
OpenVPN 支持使用谷歌身份验证器和一些第三方应用程序（如 DUO）进行多因素身份验证。
普利妥尔
Pritunl 提供 4 种双因素身份验证方法：
- Yubico YubiKey
- Duo 硬件令牌
- Duo、OneLogin 和 Okta Push
- 谷歌验证器
佛跳墙怎么下载不了
这里使用 AWS Managed Active Directory 支持多因素身份验证。
参考 URL：为 AWS 管理的 Microsoft AD 启用多因素身份验证 - AWS 目录服务
脉冲安全
Pulse Connect Secure 支持个人电脑和移动设备的不同 2FA 方法，包括 RSA SecurID、Google Authenticator、okta 和 Duo。
佛跳墙怎么下载不了
OpenVPN 接入服务器
OpenVPN 的开源版本提供了所有基本的隧道功能。 因此，对于不需要图形用户界面、安装和管理简便的简单用例，可以使用 OpenVPN 社区版。 OpenVPN 社区版与 OpenVPN 企业版的比较如下这里
企业版的成本取决于并发用户数量。 成本估算这里
普利妥尔
Pritunl 是一款基于 openvpn 协议的开源软件，因此其免费版也支持所有基本的 vpn 隧道功能。 不过，要想获得更多功能，还需要企业版。 每个集群的费用为 70 美元。 集群的定义是一个 Mongodb 数据库和任意数量的 pritunl 服务器。
佛跳墙怎么下载不了
AWS 佛跳墙怎么下载不了 按每小时活动客户端连接数和每小时与 佛跳墙怎么下载不了 关联的子网数收费。
AWS 客户端 VPN 端点关联： -#@# A blog site on our Real life experiences with various phases of DevOps starting from VCS, Build & Release, CI/CD, Cloud, Monitoring, Containerization. VPNs are a great way to securely connect your private networks. They are even used to mask your public IP, so that you can access a public server without getting traced. There are a number 佛跳墙怎么下载不了 offerings in the market ranging from open-source to proprietary software, self-managed 佛跳墙怎么下载不了-as-a-service, and with a huge range of features. I recently got an assignment to get the best offering in the market. Best is a vague term. An 佛跳墙怎么下载不了 covering all the basic functionalities can be best for a simple implementation . Or a 佛跳墙怎么下载不了 having a lot of simplicity and customisation can be best for a medium or high budget implementation. So, I decided to compare different offerings in the market. Complete 佛跳墙怎么下载不了s are out of the scope. Here are the things I kept in my mind before starting: 佛跳墙怎么下载不了 can handle the same feature but it may be in a different way. Here we are defining the criteria for comparison: 佛跳墙怎么下载不了s have qualified above criteria and has been compared throughly. Pritunl Pritunl works as a distributed and scalable infrastructure with no master server. So, Pritunl can be easily scaled up based on the requirements. It uses mongodb as its database which can be installed on the same instance as well as on a managed instance in case we need a 佛跳墙怎么下载不了 server. Basic pritunl cluster architecture. Pritunl Remote Access Site-to-site pritunl implementation OpenVPN Access Server OpenVPN works as a standalone OpenVPN access server running in the VPC. It works as primary and secondary nodes as well (cluster with multiple instances), where in case of failure of primary node, secondary/standby node takes up. But the functionality does not works with AWS. Remote Access with OpenVPN Access Server. Site-to-Site Implementation of OpenVPN Access server. 佛跳墙怎么下载不了 AWS implicitly supports both 佛跳墙怎么下载不了 access and remote 佛跳墙怎么下载不了 tunnels. These services are fully managed by AWS which means administrators need not worry about failures or high availability. Below is an architecture diagram for a remote employee to connect to many VPCs. 佛跳墙怎么下载不了 in aws Click here for more information about aws 佛跳墙怎么下载不了 endpoint Pulse Secure Pulse secure simple implementation will be almost the same as openVPN. A cloudFormation template could be used to provision a PCS instance in aws. And it can be connected through any pcs client software. Pritunl Distributed architecture is at the core of pritunl. So, it is easy to have redundancy and handling failovers. One pritunl host can run multiple instances of OpenVPN server. And each server can be attached to multiple hosts, so that if one of the hosts fail, the server can be started on another host. OpenVPN Access Server OpenVPN access server provides backup/standby nodes for failure and recovery. However, this feature does not works with AWS. But we can achieve HA on OpenVPN Access server using Route 53. Here is the document reference to achieve the same. Pulse Secure Pulse Secure recommends High Availability through active-active cluster of multiple pcs instances with a Virtual Traffic Manager(a pulse product) as a load balancer Here is the diagram of pcs active-active pair 佛跳墙怎么下载不了 佛跳墙怎么下载不了 is fully managed by AWS. So, we do not need to worry about replication and redundancy explicitly. OpenVPN Access Server OpenVPN access server has inbuilt rule based access control. Which means, we can define which networks/hosts a user can have access to and rest are blocked. Pritunl Pritunl does not provide rule based access control like Openvpnas. But there are groups to achieve access control. However, it does not seems as straightforward as openvpn. Pulse Secure Pulse secure supports rule based access control. For example, we can allow or deny tcp://*:80,443 for some specific role. 佛跳墙怎么下载不了 Access to specific networks can be allowed to specific user groups(Active directory SID or Group ID in IDP). Port or protocol based access control is not supported. OpenVPN Access Server As the name suggests, OpenVPN Access server is built upon the open 佛跳墙怎么下载不了 protocol openvpn. Pritunl Pritunl also uses OpenVPN protocol at its core by default. But it implements wireguard protocol as well. It uses IPSec for site-to-site links. Pulse Secure Not revealed by the vendor 佛跳墙怎么下载不了 佛跳墙怎么下载不了 uses OpenVPN protocol for remote access tunneling. And IPsec for 佛跳墙怎么下载不了 OpenVPN Access Server OpenVPN client supports almost all the major platforms. Here is the list: 佛跳墙怎么下载不了 佛跳墙怎么下载不了 has clients supported on following Platforms Since 佛跳墙怎么下载不了 uses OpenVPN protocol, third party OpenVPN clients are also supported. But if you are using a federated authentication method, third party openvpn clients will not work. Pulse Secure Pulse clients are available for below OS Apart of that, pulse secure clients can also be launched from web browser. Pritunl Here is the list of Pritunl clients supported platforms: However, pritunl supports clients of OpenVPN as well but openVPN clients lag some features like automatic sync 佛跳墙怎么下载不了 profiles. So it makes it supportable for all major platforms. Bandwidth of 佛跳墙怎么下载不了s are the one that they claim. Actual performance may vary and can be determined with iperf. OpenVPN Access Server Performance of an openVPN server is dependent on how much bandwidth we want to route through 佛跳墙怎么下载不了 server. A modern CPU with an AES-NI chipset uses 12MHz of CPU to process each Mbps transferred in one direction. So, for example, a 4 core system at 3GHz would count as 12,000MHz. Which equates to 1000 Mbps maximum throughput. For memory, It’s a rough estimation of 1 GB of memory for every 150 connected devices. Around 16GB of disk space should be more than enough as only data that are necessary to store on disk are connection and program logs, and user certificates and settings. OpenVPN recommends not to use more than 1000 connections from a single instance. The default limit is however 2048. Pritunl As we know pritunl uses OpenVPN protocol at its core, so the hardware requirements would be almost the same. However, Pritunl claims a 100mbps maximum bandwidth per connection with fast Intel CPU with AES-NI on both client and server side. A wireguard implementation on pritunl would be faster as wireguard protocol is comparatively faster than OpenVPN. 佛跳墙怎么下载不了 AWS Recommends to use iperf to measure bandwidth for 佛跳墙怎么下载不了 connections. According to aws, bandwidth depends on a number of factors. Pulse Secure PSA has 3 types of virtual appliances. The data sheet is below. OpenVPN Access Server OpenVPN supports multi factor authentication with google authenticator as well as some third party apps like DUO. Pritunl Pritunl offers 4 methods of Two factor authentication: 佛跳墙怎么下载不了 Pulse Secure Pulse Connect Secure supports different 2FA methods for PCs and mobile devices including RSA SecurID, Google Authenticator, okta and Duo. OpenVPN Access Server OpenVPN Provides all the basic tunnelling features in its open source version. So, for a simple use case, where we do not need GUI and ease of installation and management, OpenVPN community edition can be used. A comparison of OpenVPN Community Edition and OpenVPN Enterprise is available here For Enterprise edition, cost is dependent upon number of concurrent users. Cost estimation of can be estimated here Pritunl Pritunl is an open source software built upon openvpn protocol, so it also supports all the 佛跳墙怎么下载不了 tunnelling in its free version. However for more features it will require an enterprise edition. Which costs 70$ per cluster.. A cluster is defined as a single Mongodb database and any number of pritunl servers. 佛跳墙怎么下载不了 AWS 佛跳墙怎么下载不了 charges for the number of active client connections per hour and the number of subnets that are associated to 佛跳墙怎么下载不了 per hour. AWS 佛跳墙怎么下载不了 endpoint association: – $0.10 per hour The prices may vary a little in some regions. Click here for more information Pulse Secure There is no straight forward pricing for pulse secure. The pricing here works on quotation basis. I had approached sales team, but there is no callback yet. According to above, the cost for 500 users, 1020 devices and 20 applications, the price comes as $86,688 annually OpenVPN Access Server OpenVPN access server is quite easy to install. Following popular ways can be used to get OpenVPN Access Server installation. There are detailed guides for installation and configuration. There is good community support as well. There is no on call support. Instead, we can create tickets on support system which is available 24/7 Pritunl As it is also OpenSource, Installation is quite easy here. Following are popular ways to install it. Online documentation is quite good. Open Source community is not as mature as openvpn but common issues can be found there. Setup and use is a little different than OpenVPN, but once architecture is understood, its easy to use. No On call support or a dedicated ticketing system, there is email support and slack channel. 佛跳墙怎么下载不了 There is no need of installing anything, You just need to create the 佛跳墙怎么下载不了 endpoint from AWS VPC GUI. Which makes it super easy to use. To contact support, there are standard support plans which comes with AWS Account. Pulse Secure Pcs houses too many features and configurations apart for a 佛跳墙怎么下载不了 tunnelling. So it makes it difficult to understand. However everything can be done from GUI Itself. But still it makes it complex than all the above alternatives. Its online documentation was not easy to understand, according to me. For Installation, CloudFormation template can be used in AWS or similar templates in other cloud providers like gcp and azure as well. It also distributes the package as a hardware device with preloaded software. PCS has on-call support 24/7. It has even a platinum support for mission critical deployments with faster SLAs. Selection of the 佛跳墙怎么下载不了 can be hectic and time consuming. Hope this blog may help you cut through your precious time. Happy Virtual Private Networking. 🙂 Reference links for used images Link 1, Link 2, Link 3 and link 4 Blog Pundit: Naveen Verma Opstree is an End to End DevOps solution provider Connect Us
佛跳墙怎么下载不了
佛跳墙怎么下载不了
Click here for admin guide佛跳墙怎么下载不了
佛跳墙怎么下载不了
佛跳墙怎么下载不了
佛跳墙怎么下载不了
佛跳墙怎么下载不了
AWS allows maximum of 2000 concurrent connections. And this can be increased through limit increase requests.Applicance Max Concurrent Users (SSL) Max TunnelThroughput(ESP Mode) Max TunnelThroughput(SSL Mode) CPU PSA3000-V 200 408Mbps 268 Mbps 2 PSA5000-V 2500 514 Mbps 484 Mbps 4 PSA7000-V 10000 2.4 Gbps 1 Gbps 8 佛跳墙怎么下载不了
Multi Factor Authentication is supported here with AWS Managed Active Directory.
Reference URL: Enable multi-factor authentication for AWS Managed Microsoft AD – AWS Directory Service佛跳墙怎么下载不了
AWS 佛跳墙怎么下载不了 connection: – $0.05 per hour
Pulse secure gives a cost estimation portal which can be found here.佛跳墙怎么下载不了
佛跳墙怎么下载不了
OpenVPN Pritunl PulseSecure AWS Access Control Rule Based Group based. Rule Based Group Based Authentication Local + thidparty (see details above) Local + thidparty (see details above) Local + thidparty (see details above) Local + thidparty (see details above) Availability/Replication Replication with Route53 In-Built. (just need to add hosts) Cluster with Pulse traffic manager AWS Managed. Clients All major OS All major OS(including ovpn clients) All major OS All major OS(including ovpn clients) Ease 4/5 3/5 2/5 5/5 GUI 5/5 4/5 3/5 5/5 MFA Yes Yes Yes Yes (Active Directory) Performance 1000 mbps max 100 mbps 514 mbps with 4 CPU Not given. Assuming 1000 as ovpn Pricing for 500 connections (Assuming all 500 connections active for whole mnth) 1095 / month 70$ / month Quotation not yet confirmed 18144$ / month Protocols OpenVPN OpenVPN, Wireguard, IPsec Not Revealed OpenVPN, IPsec.
佛跳墙怎么下载不了