[turtle777]

Ok, I'm pretty excited.

After Hamachi for Mac being dead for years and full-featured LogMeIn Pro costing far too much (subscription model), I finally found something that looks very promising.

Slinkware

Started testing it with my iMac and MBP. Installed in a heartbeat. And voila: all services available on the remote Mac. TimeMachine started immediately backing up, w/o a hitch.

Slinkware is currently in Beta and free, they might charge some money later on.
I'd have no problem paying as long as it is reasonable.

-t

[besson3c]

Do you have really fast upload speeds on your home network, turtle? This is about the only way I can think of this being useful, my upload speeds are god awful - too slow to make iTunes play with stuttering or anything other than SSH terribly fun.

[turtle777]

Originally Posted by besson3c 

Do you have really fast upload speeds on your home network, turtle? This is about the only way I can think of this being useful, my upload speeds are god awful - too slow to make iTunes play with stuttering or anything other than SSH terribly fun.

3 Mb/s with Comcast.

Fast enough for everything except maybe video streaming. Haven't tried that yet with Slinkware.

-t

[Simon]

Thanks for the link, turtle. Looks interesting.

I was just a bit turned off by the fact that they use Flash for header text on their website. WTF?

[besson3c]

Originally Posted by Simon 

Thanks for the link, turtle. Looks interesting.

I was just a bit turned off by the fact that they use Flash for header text on their website. WTF?

That's sIFR, it was (maybe still is) a popular way to dynamically generate subheads using a custom font face. This was before font embedding was supported in all major browsers as it is now. Another popular technique was a library called Cufon, which I still see...

Allowances are in order for sites still sIFR and Cufon, as it hasn't been terribly long since font embedding was supported in all browsers (since the release of Firefox 3.5), and this is for design/aesthetic purposes, not functionality.

There was an Appleinsider article recently which stated that the reason why Flash performance is so poor on the Mac is because it is not GPU accelerated like it is under Windows. However, one would think that a static non-moving Flash applet wouldn't cause performance problems. I think it is for this reason why some of the Flash blockers support allowances for sIFR - it's pretty harmless.

[Simon]

Thanks for the info, besson. I just noticed ClickToFlash has a preference to automatically load sIFR.

[ghporter]

What do you plan to use the VPN for? Can this sort of connection be used to keep your sensitive information secure while giving you remote access to it?

I am sort of behind the curve when it comes to connecting anything outside my LAN to anything on it, and I haven't been imaginative enough to think up uses for such connections.

[Simon]

I can think of some examples I'd be interested in.

- iTunes sharing even when you're away from home
- File sharing (secure tunnel) with Macs at home
- Any kind of Rendezvous service without the need for manual DNS setup (dyndns.com et al.) and/or port configuration on your home router
- Screen sharing
- Backup to TC even when you're far away from home

I guess some of these things will require decent uplink speed at home to be any fun. In my case I see about 4 Mbps up which has always worked just fine for file transfers and screen sharing through ssh tunnels. So I'm assuming this will work just fine too. I'm not expecting to stream HD video. OTOH a simple OS X pref pane VPN setup is much more convenient that setting up DynDNS, configuring router ports, configuring ~/.ssh/config for the ssh tunnel, etc. Let alone explaining all of this to a non-geek.

If this is as good as it sounds it will be a huge success. Not just with people like my mother (not that she wants a VPN, but she sure wants me to remotely fix her Mac), but also geeks like us.

[turtle777]

I just streamed a ripped DVD w/o a problem. Awesome.

-t

[turtle777]

Originally Posted by ghporter 

What do you plan to use the VPN for? Can this sort of connection be used to keep your sensitive information secure while giving you remote access to it?

Basically, think of the VPN as an extension to your LAN. You can do from afar everything that your Mac could do when connected via Ethernet or WLAN to your home network.

Slink establishes an ssh encrypted tunnel between your remote computer and your home computer.

Frequently Asked Questions - Slinkware

The only thing to be careful: since this service connects to a central server to initiate the connections (hence, no need for DynDNS or knowing your IPs), you need to trust the middle man.

In that regard, it's not as safe as connecting directly to a VPN server that you would set up on your home Mac.

-t

[turtle777]

Originally Posted by Simon 

. Not just with people like my mother (not that she wants a VPN, but she sure wants me to remotely fix her Mac), but also geeks like us.

I have been using a combination of Hamachi, LogMeIn and ARD for my Mom's MB, but all of it had its pains.

Slink would solve all those problems.

-t

[Simon]

Yeah, that's what I've been thinking too. This looks really promising.

[besson3c]

Originally Posted by turtle777 

Basically, think of the VPN as an extension to your LAN. You can do from afar everything that your Mac could do when connected via Ethernet or WLAN to your home network.


Frequently Asked Questions - Slinkware

The only thing to be careful: since this service connects to a central server to initiate the connections (hence, no need for DynDNS or knowing your IPs), you need to trust the middle man.

In that regard, it's not as safe as connecting directly to a VPN server that you would set up on your home Mac.

-t

Their FAQ doesn't imply a central server is involved, which is a bonus!

Slink works as follows:

-The Slink Preference Pane is installed on a Mac on your home network. This is your home computer.
Slink is installed on a Mac that you want to access your home network with. This is your remote computer.

-The Slink Preference Pane publishes a Slink ID to the Slink name service. This allows Slink to determine the IP address and port of your home computer without the need for domain names.

-The Slink Preference Pane uses NAT-PMP or UPnP to map a port on your broadband gateway. This means that you do not need to configure your broadband gateway manually in order for Slink to work.

-Slink establishes an ssh encrypted tunnel between your remote computer and your home computer.

- All Bonjour services on your home network are discovered by Slink.

- The discovered Bonjour services are automatically published on your remote computer. (But only on your remote computer. They cannot be seen and used by anyone else on the network that the remote computer is connected to.)

- The discovered Bonjour services appear in the Finder, iTunes, iPhoto and other Bonjour aware applications, just like they do at home.

- When a discovered service is used on the remote computer, the network traffic is automatically routed down the tunnel to the home computer.

From the Wikipedia:

NAT Port Mapping Protocol (NAT-PMP) is an Internet Engineering Task Force Internet Draft, introduced by Apple Computer as an alternative to the more common Internet Gateway Device (IGD) Standardized Device Control Protocol implemented in many network address translation (NAT) routers. It was introduced in June 2005. NAT-PMP allows a computer in a private network (behind a NAT router) to automatically configure the router to allow parties outside the private network to contact itself. NAT-PMP runs over UDP. It essentially automates the process of port forwarding.

UPnP is similar to NAT-PMP...

I don't know exactly how these things reconfigure your home router, but this is a far better approach than introducing a middleman.

[turtle777]

Originally Posted by besson3c 

Their FAQ doesn't imply a central server is involved, which is a bonus!

I know it doesn't, but I read somewhere that it needs a central server.

Think about it: how would your Slink client discover what IP is behind the Slink ID you enter ? There has to be a server that acts as a directory with a mapping between the Slink IDs and the IP addresses.

-t

[turtle777]

Also, thinking about it: security is limited by the Slink ID, which really acts as an ID and password concurrently.

8 digits upper case is not very hard to crack or guess

I hope they implement a safer way.

-t

[slinkware]

Olof here from Slinkware. Many thanks for the kind comments on Slink!

A couple of comments on the concerns re security:

• Slink does use a central name service (name-service.slinkware.com) to determine the IP address and port for the Slink ID when connecting. The name service is _only_ used to look-up the IP/port using the Slink ID. All other traffic is straight from your remote mac to your home mac.
• Slink does not have a "middleman" for the actual traffic between your remote mac and your home mac. This traffic is carried in an SSH tunnel directly between your remote mac and home mac.
• The Slink ID is _not_ used for authentication purposes. It is only used to determine the IP address and port of your home computer. Hence, there is no issue with the 8 character Slink ID from an authentication security perspective.
• Since Slink works over SSH (= Remote Login in System Preferences), it is your home mac user name and password that is used for authentication. In other words the authentication is as secure as your password is strong. Please note that Slink does support SSH public key authentication. However, right now you have to set it up manually. We may add automation for this in future versions of Slink.

I hope this answers the security questions. If not, let me know and I will elaborate! We have put a significant amount of effort into architecting Slink for security. After all, any VPN style app is of no use if it is not secure.

At this stage we are working hard to make Slink rock solid. Once we are out of beta we will add new features. We are interested in user feedback so that we can shape Slink in the right direction.

--Olof

Ps. Next version of 1.0 beta will be released in the next couple of days.

[besson3c]

Hey Olof,

What VPN implementation is Slink based on? OpenVPN? IPSec? Something homegrown? Something else?

I believe OpenVPN has an option to pass all traffic through the VPN rather than just traffic on the same subnet. Does Slink do the same? This would be useful for circumventing location specific network services (i.e. accessing sites that are only available in the US), although obviously I have no idea if this introduces a liability that you'd prefer to avoid.

[Cold Warrior]

I love it when developers take the time to hit the forums.

[slinkware]

besson3c,

Slink is based on SSH (Secure Shell) tunneling. (Or Remote Login as Apple calls it.) In other words, it is really lightweight, provides for excellent performance, and provides all the proven security of SSH. We certainly did not want to base Slink on something homegrown. Much better to use an industry "standard" that has been proven and security stress-tested over the years.

As Slink is based on Bonjour (tunneled over SSH), you will only be able to see and use services of the subnet that your home computer is connected to. Please note however, that Slink allows multiple connections to multiple home computers to be active at any one time.

--Olof

[slinkware]

besson3c,

Forgot to answer your last question. We are planning to add the capability to send all web traffic ("safe browsing") through the Slink connection to your home computer. This is very handy for WiFi hot spot situations etc, when you want to ensure that your HTTP traffic is not intercepted.

At the moment we are focusing on making Slink rock solid. We will then add features like safe browsing. Shouldn't be too long before this is available though.

--Olof

[besson3c]

Ahhh, so it doesn't create a VLAN/private network like a VPN, just a point-to-point secure tunnel... I see, thanks for answering that!

[slinkware]

besson3c,

Exactly. Essentially all the Bonjour services of you home network is made available to your remote computer, and your remote computer only, and the traffic is forwarded in SSH tunnels.

As all Bonjour services are published on your remote mac, you can use them from any Bonjour enabled app.

--Olof

[besson3c]

Cool! Then I guess, just to correct the original poster turtle, while this doesn't in anyway suggest anything negative about Slink but just for the sake of being accurate, Slink is technically not a VPN, right?

[slinkware]

besson3c,

Probably depends on how you define VPN. :-) But you are right though, in that Slink does not provide full IP-level connectivity (routed or bridged) between your remote mac and your home network. It provides tunneled connectivity _only_ for the Bonjour services available on your home network. Slink advertises these services via Bonjour on your remote mac. (They are advertised in a way that means that they are only visible to your remote mac and not to any other computers on the remote network.) You could think of Slink as an automatic and Bonjour enabled SOCKS proxy. In other words, an application level gateway style of "VPN". (Not too dissimilar to how some SSL based VPNs work.)

When you connect to a remote service (such as iTunes home sharing) you actually connect to Slink on your remote mac and Slink forwards this traffic through the SSH tunnel to your home mac.

--Olof

[besson3c]

The approach is very clever though, it makes sense to really simplify the whole job by removing a new network interface for assigning machines a private IP and all of that, and just utilizing Bonjour, since so many of the things a Mac user would be interested in accessing would be advertised via Bonjour anyway

I haven't looked to see what the business model of this will be and how you will make your money, but leaving all of that aside, could somebody use the Slinkware DNS name created as a general means to access their home network for everything else? In other words, could this be used as a Dyndns replacement?

[slinkware]

besson3c,

The Slink name service is very specialized and I do not think that this would ever be a dynamic DNS replacement. (Except for Slink itself, that is.) We wanted to make it simple for people to use and what people normally get tripped up on is:

• Setting up dynamic DNS to their home network. --> Handled by the Slink name service.
• Configuring the broadband gateway for NAT etc. --> Handled by the Slink Preference Pane using UPnP and NAT-PMP to configure gateway.

Also, we did not want users to have to register yet another user name and password, hence the automatically generated Slink ID.

As far as business model goes, we are working on that one. If we decide to charge for Slink, we will only do that when we think Slink is solid and adds real value to users. And we certainly would make sure it is very cost effective. In the meantime however, we are having fun!

--Olof

[turtle777]

Originally Posted by besson3c 

Cool! Then I guess, just to correct the original poster turtle, [...] Slink is technically not a VPN, right?

Ha, you know what, I don't care. As long as it just works

Maybe you can explain what the difference between a real VPN and this is.

-t

[Big Mac]

No universal binary means no support for the best Macs. (I'm a troll man, do do do do do, I'm a troll man, do do do do!)

[slinkware]

Big Mac,

We do have experimental support for PPC. Slink is Universal. We are currently working through testing.

--Olof

[Simon]

What about support for Tiger? Any chance you could make that happen too?

[slinkware]

Sorry, we cannot add support for Tiger, as Slink depends on Frameworks added in 10.5 Leopard.

BTW, build 142 is just out.

--Olof

[Simon]

No problem. Yet another reason to update that old Mac mini to Leopard.

[besson3c]

Originally Posted by turtle777 

Ha, you know what, I don't care. As long as it just works

Maybe you can explain what the difference between a real VPN and this is.

-t

I don't know if this is correct as per the official definition of VPN, correct anything that is wrong here Olof, but normally when you connect to a VPN after successful authentication you are assigned an IP on a private subnet (I'm not sure if you can configure any VPNs to have your IP added to the public IP block). Being on this subnet, you can connect to/see other machines on this same subnet. This is sort of like allowing your machine to be assigned an IP by a router which issues private IPs via DHCP.

A VPN also provides a secure tunnel between your personal machine and the VPN gateway so that this remote network is accessed securely. A VPN can be configured so that traffic to IPs within this VLAN are sent through the tunnel, or all network traffic is sent through the tunnel as if your machine is literally connected to that network and using its bandwidth like any other machine on that network.

However, you can establish a secure tunnel with OpenSSH without being assigned an IP by the VPN host... If I'm understanding Olof this is exactly what Slink does. The tradeoff here is that you don't have free access to the entire remote network like you would with a VPN. You cannot, for instance, SSH to individual machines in your home network unless these machines advertise connectivity with Bonjour. Bonjour is the middleman used to mediate what you have access to on this network.

Again, feel free to correct any errors Olof

[GENERAL_SMILEY]

A real plug'n'play VPN is iVPN.

You just install it on the machine which you want to connect to, you don't need any software for the client machines (as PPTP/L2TP VPN is part of OSX), it also works with PCs (Vista/Windows7) and iPhones.

Tunnelling Bonjour service over it is something else. Maybe use Network Beacon

[slinkware]

Originally Posted by GENERAL_SMILEY 

A real plug'n'play VPN is iVPN.

You just install it on the machine which you want to connect to, you don't need any software for the client machines (as PPTP/L2TP VPN is part of OSX), it also works with PCs (Vista/Windows7) and iPhones.

Tunnelling Bonjour service over it is something else. Maybe use Network Beacon

I disagree. As I would

iVPN and other L2TP/IPSEC solution are certainly not plug'n'play. For example:

• IPSEC solutions are notoriously tricky to NAT. iVPN does not support automated NAT traversal. This is an issue both on the client side and the server side. Slink has no client side NAT issues (single outbound SSH/TCP session) and automatically configure NAT on the server side.
• You may not be able to see and use all the Bonjour services of your home network with IPSEC style VPNs. With Slink all your Bonjour services are visible and usable. Bonjour is what makes Mac networking plug'n'play!
• iVPN does not support dynamic DNS plug'n'play. With Slink there is no need to worry about dynamic DNS and domain names. The Slink name service takes care of this for you in a plug'n'play fashion.

In other words, we think Slink is very much plug'n'play!

Also, we are soon adding SOCK4,SOCKS5 and HTTP proxy capability for Slink client connections to get around firewall and policy issues. That is not easy to do with IPSEC VPNs. (To say the least.)

--Olof

[Simon]

Also, iVPN is $23.

Slink is free. And will hopefully stay that way.

[GENERAL_SMILEY]

Originally Posted by slinkware 

IPSEC solutions are notoriously tricky to NAT. iVPN does not support automated NAT traversal. This is an issue both on the client side and the server side. Slink has no client side NAT issues (single outbound SSH/TCP session) and automatically configure NAT on the server side.

I have L2TP set up at home, it is pretty simple - I can imagine it might seem complex if you don't know how to do port forwarding on your router (very easy in Airport) - the hardest thing for Mac users is realising that L2TP conflicts with a port number (4500) used by "Back To My Mac" so it has to be disabled (obviously you don't need it).

The Bonjour tunnelling is pretty clever though.

[olePigeon]

If Slinkware doesn't work for you, you can find a new Cisco Pix 501 for about $150, $50 used. Hardware firewall & tunneling VPN. It just uses the Cisco VPN client.

[ghporter]

Originally Posted by olePigeon 

If Slinkware doesn't work for you, you can find a new Cisco Pix 501 for about $150, $50 used. Hardware firewall & tunneling VPN. It just uses the Cisco VPN client.

You'd still need to know your (current) Internet IP to use that from the outside, though, wouldn't you?

[Simon]

Originally Posted by ghporter 

You'd still need to know your (current) Internet IP to use that from the outside, though, wouldn't you?

That part can be taken care of by using DynDNS and running a little daemon on one of the Macs on the private LAN that updates their database.

The only thing you have to make sure is that that Mac sends the public WAN IP to DynDNS rather than the private LAN IP. It's nothing more than a simple menu setting, but it's the one thing I've seen people get hung up on. Once you get that right you can forget about it and it'll work pretty much forever.

[olePigeon]

Could Slinkware be used as a low cost thin client? Set up a host machine with different accounts (maybe LDAP), and use Slink from various client computers to connect to the host computer?

[olePigeon]

Originally Posted by ghporter 

You'd still need to know your (current) Internet IP to use that from the outside, though, wouldn't you?

Sign up for a Dynamic DNS service.

[slinkware]

Originally Posted by olePigeon 

Could Slinkware be used as a low cost thin client? Set up a host machine with different accounts (maybe LDAP), and use Slink from various client computers to connect to the host computer?

Well, not exactly what Slink was designed for. For example Mac OS X does not really support multiple simultaneous screen sharing sessions. (In the sense that all uses will share the same "screen", including a user sitting in front of the Mac.)

--Olof

[slinkware]

Just a heads-up: Slink is out of beta and Slink 1.0 is available for download:

Download Slink - Slinkware

Enjoy!

--Olof