I recently came across a post from Justin Wise, asking for product suggestions that could help remote workers. It got me thinking about the things I have to do intentionally, as well as the things my office counterparts struggle with. I’ll share briefly some of the things I’ve learned, and then respond to Justin’s request for products that would help.

What Works Great

• The industrial revolution. I am at least “way more” productive when working from home. Email bows beneath my fist, and my task list is consumed like wheat before so much fire. Some of my counterparts in the office frequently complain at the sheer amount of stuff I can get done, leaving them in the dust (office dust too, which is worse than home dust). Last month we started trialing “home working days”, where the guys on our tech team work one day a week from home, to see if they can get more done in those days.
• New kinds of new ideas. Having more time to think and be creative means I come up with new ideas, new ways to solve old problems and so on, typically on a larger scale than I did in the office. I was a great problem solver in the office, but the ideas I got then were helpful on a more micro-scale; they usually arose to solve the problems of the moment. Now I find myself dreaming and crafting new futures, rather than just new ways to get through today & tomorrow.
• Prioritizing. When you get to hold everyone at arm’s length, you can control the flow of chaos to a much better degree, and can decide exactly what will get your attention, and when.

What is a Challenge

• Clear communication. Not being able to just walk into someone’s office, or talk to whomever you want when you want means you must be more strategic and intentional in your communication. It means you can’t just rely on email. You need to schedule face time with people, use video chat and instant messaging. More than anything else, you need to use clear, direct and unambiguous language when you’re writing. What we’re learning though is that just about everything that you must do to communicate better when working from home applies to working in the office as well. If everyone spent the 20 seconds it takes to schedule face time with someone, rather than just barging into their office, imagine the important work that we could all GET FINISHED.
• Team building and encouragement. This is the single most important challenge that I’ve found to date. How can you build a cohesive, well functioning, tight-knit team when you are not physically there?  And how can you avoid treating people like the tasks they accomplish, rather than the human beings they actually are. In the past, when I was my team’s direct manager, we saw a huge boost in their productivity in the two weeks I would spend in the office, and then a notable decline over the next 3 months until I returned. I put this down 90% to the team atmosphere, and 10% to the “when the cat’s away” issue.  The best way we’ve found to alleviate this so far, is to have a local team manager on-site, who then reports to me as Director. The current manager and I have excellent rapport, and it seems that together we’re finding success building the team, encouraging individuals, coaching them towards career goals, and so on. 
• Trust. This is a fascinating challenge, because working from home means you HAVE to learn how to trust things to others. In many ways, you could consider this a strength to working from home, but if you’re like me and you like to control things (to ensure quality, of course), then it’s a challenge. You need to learn how to raise up teams and individuals who understand your goals, purposes and vision. When I first started working from home, this was manifested most often due to things that needed fixing, that I couldn’t physically touch. I had to trust others to be my hands and feet, to get things done. The chief difficulty here is that I could have fixed it faster myself had I been there… but if I had, then John would have never learned, and I would never have developed my patience. Faster isn’t always better. In my current responsibilities, the issue is in letting someone be my mouth, which I find much harder. If Sarah is chairing a meeting in my absence, do I trust that she will effectively communicate the things that I need her to communicate? Will she use my language, or hers? Will she communicate the essence of what actually matters, or will she fluff around on details? If your team can’t communicate what you need them to, the way you need them to, I wager it’s your fault, not theirs. You need to up your game, get your team on the same page as you are… and then get out of the way so they can have a shot at it. Jump on that WebEx call, but mute your mic, and let things play out. Trust them. If they’re not deserving of your trust, I’d question if you deserve to be their manager. (This has been and remains a very difficult issue for me… what I write here is what I aspire to, and have not necessarily mastered.)

What’s Missing

• Better presentations combined with video. Sometimes you really need to be in that room with a whiteboard and action cards and your presentation-software-of-choice… but you can’t be. We’re trying recorded video messages from department directors as a more interesting way of communicating otherwise mundane news to the wider staff, but even then, sometimes your face isn’t enough. I need a tool that lets me combine my video, with other video and graphics, presentation elements, animations etc. to get my message across. Maybe Movenote fills that void? Not sure yet. 
• Super-wide-angle webcams for video conferencing. We have a couple of conference rooms in the office that are routinely used for video conferencing. They can see me fine, but I struggle to see the relevant people in the room. It’s not feasible for us to give everyone in a meeting their own camera, or to invest in a 360 degree camera and the associated software. In very large rooms we’ve set up multiple laptops with webcams so remote people can get multiple views of a room… but this isn’t perfect, and doesn’t work in a small room that’s full of people. Super-wide-angle lenses and webcams would be very helpful here, to let me see everyone standing or sitting around the table.
• Better screen management tools. I typically have video open on my primary monitor, and then content relating to the discussion on a second screen. When doing data comparison or project analysis, I find myself wishing for a third monitor. I need something to help me manage the content of my displays. I’m fairly attached to keeping things fullscreen, but if it works well enough I can be convinced. Google+ Hangouts with Extras looks like it might be useful, letting me combine a Google Doc with video chat.

The first, is Schooley Mitchell Telecom Consultants. 

When I asked my predecessor what John Lake did for us, he said “Oh, John’s a great guy. He’ll help you out with just about anything you need. Call him and introduce yourself, trust me, it’ll save your butt.” He was right on the money, over the years as we’ve negotiated internet contracts, web hosting changes, VoIP projects and more, John has been right there at my side offering guidance and a much-needed second opinion.

In the dark reaches of time, all phones and office equipment at Catch The Fire (then TACF) was managed by our Facilities and Maintenance team. I’m not sure when they first started working with Schooley Mitchell, but I found an email this morning from 2004, introducing John to us in IT, under the auspices of “Telecom and internet consultants that look into all that sort of stuff for us and have saved us tons of money.”

In 2005 John was instrumental in us choosing Q9 Networks as our main server collocation facility, when we performed a major upgrade to our video streaming service.  In the intervening years, John has fought hard for excellent pricing from many service providers, and has always been just a phone call away. He’s steered us clear of a couple of dodgy providers, and even when not negotiating contracts directly, he’s been a sound counselor when I’ve been out of my depth in a new territory or industry segment.

If you’re looking to “staff/contract your weaknesses”, I wouldn’t hesitate to recommend Schooley Mitchell for anything in the telecomms space. They’re a smart, loyal, up-to-date bunch of people. Cheers!

If you didn’t attend the conference, then know that it was a fairly straightforward 2 day affair, with morning keynotes and daytime workshops/sessions. It was hosted by the Victoria Park Plaza, and made use of their great facilities on the lower 2 floors. The first evening featured a drinks reception and afterparty-of-sorts at a bar across the street.

The Conference

Overall, Blackbaud threw a solid event. They’ve obviously got experience in assembling workshops and sessions, and knowing which of their customers can take the stage to help showcase their solutions. I obtained full value from the event by the end of the first workshop, to be honest. The keynote sessions were good, but not great: Tony Elischer was the main speaker and while he certainly had good points, he was a bit too all-over-the-place for me. The session on the second day with an ecommerce expert was decent, but I found the afternoon panel discussion to be mind-numbingly boring. I’ll excuse that in this case as someone like myself wasn’t necessarily the target audience, for a talk on social networking trends. The vendor Marketplace was small but effective, and I’ve already made some great connections with the vendors there. Two of them offered products that I have a need for immediately! Not working directly with Blackbaud Europe, I didn’t spend a lot of time with the Blackbaud people in the Marketplace, but I did connect with one account manager about Blackbaud Mobile.

Big Reveals

Blackbaud revealed 2 big things at the conference. One was an entirely new product, called Blackbaud Mobile, and the other was a mobile interface for The Raiser’s Edge, letting you access your existing RE data from your smartphone or tablet.

Blackbaud Mobile is a robust mobile and social giving solution. If you’ve ever seen a donations short-code (“Text GIVE to 5555″, for example), then you’ll understand the first part of Blackbaud Mobile: generating those SMS codes and numbers. That’s truly the easy part, and there are a number of vendors offering that today, albeit with various flaws and difficulties. Add to SMS shortcode generation:

• the ability to send outgoing SMS messages
• QR code generation, so you can slap a QR code on your poster or product
• social embedding, so you can add your SMS shortcodes and QR codes easily to your Facebook pages, Twitter, etc.
• HTML embedding, so you can do the same for your own pages
• campaign creation and management, so all of the above can be segregated
• analytics on the whole lot, so you can see what methods and mediums are working for each of your campaigns.

I’m pretty excited, it’ll be my first major speaking opportunity, and it’s on a topic that I’m truly passionate about. These Leaders conferences are fantastic, and this year’s event is really open to everyone involved in church ministry, leadership or otherwise. I highly recommend you consider coming up to Toronto in January!

We’re using The Raiser’s Edge for all of our larger constituent management, but we felt we owed it to the pastors to get them a best-in-breed tool, which we’d then integrate as necessary with Raiser’s.

Update: I will be speaking on this very subject, at a conference for pastors and church admin teams in January 2012. You should totally come! Click here for details.

Update: I apologise if there are no line-breaks in this. WordPress is messing up my formatting today.

Update: I’ve chosen to include a sanitized version of our Needs Assessment. The link is further down… it will NOT match your needs exactly, but feel free to use it as a template. Please don’t distribute it online yourself.

I spent some time looking online, and a number of blogs were hugely helpful in our early research phase, especially that of Joel Lingenfelter. After a few weeks, we settled on the following products to examine:

• Fellowship1
• Shelby Arena
• Church Community Builder
• ConnectionPower
• ThinkMinistry MinistryPlatform

One of my team members managed to find a confusing sounding, but actually excellent solution, to this problem. Jesse Middleton posted this last year, and while some minor things have changed, it still works very well. Thanks Jesse! The basic steps are as follows:

1. Register yourself with the Google Apps marketplace as a vendor.
2. Create an application (with the sole purpose being to put a link on the menu bar).
3. Add the application to your domain.

Because you’re not actually publishing your app to the Google Apps Marketplace, it doesn’t cost anything to do this, and won’t get in anyone’s way. You can create as many apps as you might want, for links to various things. Some enterprising individual should take this method and expand on it to allow people to rename and customise these menu items at will.

This week I needed to sort out backing up my ESXi VMs to an another location. A few Google searches brought me into contact with a fantastic set of tools to do just that. Following is the setup I made, with links to the helpful people. Thanks so much to everyone linked below.

1. First you’ll need to decide on your backup location. I decided for an NFS share on my existing backup server, which is running Windows Server 2008. That meant installing the NFS tools for Windows Server 2008, and also finding an available Server 2003 machine to install the User Mapping provider on, as Server 2008 has deprecated it. Read http://miketrellosblog.arcadecab.com/2010/08/setting-up-an-nfs-share-to-receive-esxi-4-1-vm-backups/ and http://blogs.msdn.com/b/sfu/archive/2008/12/15/set-up-services-for-network-file-system-in-windows-server-2008.aspx
2. Use the ghettoVCB script to create the backups of the VMs, take snapshots if necessary, copy the backup to the network location, and then purge the snapshots. FANTASTIC piece of script. http://miketrellosblog.arcadecab.com/2010/08/using-ghettovcb-sh-to-backup-esxi-4-1-vms-to-nfs-datastore/
3. For scheduling the backup job, you may wish to create a specific backup user on your ESXi machine, or perhaps you’ll need to change the root password to something you’re happier to write in a plain text file. Either way, these will help: http://www.yellow-bricks.com/2008/08/14/esxi-ssh-and-non-root-users/ and http://www.theblueboxes.com/how-modify-root-password-vmware-vsphere-esxesxi-4-vsphere-client

Made my life a whole lot easier.

What the script does:

• Starts an ASR backup and saves it to a network location using the computer name and and current date for the filename.
• Monitors the file writing progress to figure out when the file has stopped being written to, and then kills ntbackup.exe (this is because ntbackup will wait for a floppy to be inserted, and thus hang around forever).
• Deletes any backups matching the computer name that are older than a certain threshold. This can be turned off.

Copy the below, paste it into something.vbs and then edit it. Run when you’re ready. I’ve scheduled this on my servers to handle ASR backups’ monthly. It works great… that is until I upgrade to Server 2008 and have to figure something else out. If you have any difficulties with the script, you can uncomment the Wscript.echo lines and it will give you some output. If you wanted you could also record that output to a logging file, I guess. Actually… you could also email the output pretty easily, if you wanted to do that to. There’s an idea…

'The purpose of this script is to generate a full computer backup using Windows ASR (via ntbackup).
'An ASR backup will automatically write ASR files to a floppy disk if it's in the drive, so this script
'waits till the backup has finished, and then kills ntbackup.exe so there are no instances hanging around.
'Note that ntbackup will probably overwrite any files on your floppy, so use this with caution.
'This script also has an option to delete older backups with a filename matching the current structure,
'provided the backup is older than a certain threshold. Options are below.
'Credits: Thanks to just about everyone who has written a VBscript how-to online.

Dim BackupServer, BackupPath, BackupLocation, BackupFilePath, BackupCall, WaitTimeForBackupCommence, WaitTimeForWrites, WaitTimeToRecheck, MaxBackupAge

' ************ USER CONFIGURABLE SETTINGS ****************

BackupServer = "servername" 'specify your servername ex: "backupserver.domain.com"
BackupPath = "f$\ASRs\" 'specify your folder path, must include trailing slash ex: "G$\ASR-backups\"
WaitTimeForBackupCommence = 600000 'how long to wait after the backup has started before we start looking to see if the backup is finished
WaitTimeForWrites = 30000 'how long to wait between file checks (the filesize is checked to see if it has stopped growing)
WaitTimeToRecheck = 300000 'how long to wait before we start checking the filesize once again, in case was still growing
DeleteOldBackups = true 'set to True or False depending on if you want the script to clean up older backups or not
MaxBackupAge = 45 'days to keep backups for
' ************** END OF USER CONFIGURABLE SETTINGS ***********

Set WshNetwork = WScript.CreateObject("WScript.Network")
BackupLocation = "\\" & BackupServer & "\" & BackupPath
BackupFilePath = BackupLocation & WshNetwork.ComputerName & "_" & Datepart("yyyy", cDate(Date)) & "-" & Datepart("m", cDate(Date)) & "-" & Datepart("d", cDate(Date)) & ".bkf"
BackupCall = "ntbackup asrbackup /f """ & BackupFilePath & """"

Set wshShell = WScript.CreateObject ("WSCript.shell")
wshShell.run BackupCall
set wshShell = nothing

'Ssleep duration sufficient for the file creation to begin, maybe 5 minutes
'WScript.Echo "sleeping"
WScript.Sleep(WaitTimeForBackupCommence)

Dim stoploop
stoploop = 0
While stoploop = 0

'WScript.Echo "looping"

Dim Filesys1, BackupFile1, BackupFileSize1
Set Filesys1 = CreateObject("Scripting.FileSystemObject")
Set BackupFile1 = Filesys1.GetFile(BackupFilePath)
BackupFileSize1 = BackupFile1.Size
'WScript.Echo "filesize is " & BackupFileSize1

'WScript.Echo "sleeping"
'Sleep duration to check for file size change
WScript.Sleep(WaitTimeForWrites)

Dim Filesys2, BackupFile2, BackupFileSize2
Set Filesys2 = CreateObject("Scripting.FileSystemObject")
Set BackupFile2 = Filesys2.GetFile(BackupFilePath)
BackupFileSize2 = BackupFile2.Size
'WScript.Echo "filesize is " & BackupFileSize2

If BackupFileSize2 = BackupFileSize1 Then
stoploop = 1
'WScript.Echo "file has stopped growing. ending script"
Else
stoploop = 0
'WScript.Echo "file is still growing. looping again"
Set BackupFile1 = nothing
Set BackupFile2 = nothing
'WScript.Echo "sleeping"
'Sleep duration to wait for checking for file size change again
WScript.Sleep(WaitTimeToRecheck)
End If
Wend

'WScript.Echo "Killing NTBackup..."

strComputer = "."
strProcessToKill = "ntbackup.exe"

SET objWMIService = GETOBJECT("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" _
& strComputer & "\root\cimv2")

SET colProcess = objWMIService.ExecQuery _
("Select * from Win32_Process Where Name = '" & strProcessToKill & "'")

count = 0
FOR EACH objProcess in colProcess
objProcess.Terminate()
count = count + 1
NEXT

'WScript.Echo "Killed " & count & " instances of " & _
strProcessToKill

'only delete files if delete=true
if DeleteOldBackups = true Then

Dim fso
Dim oFolder
Dim oFile
Dim oSubFolder

Set fso = createobject("Scripting.FileSystemObject")
Set oFolder = fso.GetFolder(BackupLocation)
For Each oFile In oFolder.files
If DateDiff("d", oFile.DateCreated,Now) > MaxBackupAge Then
If Instr(1,oFile.Name,WshNetwork.ComputerName,1) Then
oFile.Delete True
End If
End If
Next

''WScript.Echo "finished deleting stuff"

End if

''WScript.Echo "not deleting stuff today"

WScript.Quit

Like many SMBs, we spend a lot of our time fighting fires and running from one project to the next. Taking time out to plan for the future is a luxury not often afforded, or not often pursued. I’ll admit also that in the past our organization has had a bad track record for not sticking to plans in the long term. So I was a little reticent about spending weeks of time last year on a 5 Year Plan… but I did it anyway.

Read the full article here: http://blogs.catchthefire.com/office/2010/08/20/the-benefits-of-planning/

When opening GP, we received the error:  “Your path to the data is incorrect.  Please enter the location of you Pathnames File.” I took a look around, but couldn’t find any obvious solutions. We were using Pervasive SQL on the backend, which I’m told is really a flat file DB.

I called Microsoft support, but they’ve stopped supporting our version of Great Plains of course. Thankfully, after digging through old records and talking to previous employees, I was able to get in touch with Rimrock Corporation. They’re situated in Toronto and are Great Plains support experts. Evidently they set us up when we first started with Great Plains Dynamics.

So, after just a couple of minutes looking around, their support agent had me set the pathnames file to “C:\Dynamics” which is were the main GP Dynamics install was. After that it prompted for a drive mapping, but it had everything listed that it needed… another OK click, and we were in. Fully functional again… just in time for the audit.

So big thanks to Rimrock Corporation. If you’ve got a problem with Great Plains Dynamics, especially an old version (version 6 in our case), they’ll save your life.

I found the answer here. You can use the SysInternal tool “Process Explorer” to see what command line argument has been executed for each process. In the case of vmware-vmx.exe, the virtual machine client name is in the command line executable, so you can figure out which VM matches the process.

Genius. Thanks a lot rsa911!

The first thing you need to be aware of, is that you’re likely going to authenticate to pfsense’s OpenVPN implementation with certificates. The OpenVPN client includes everything you need to create server and client certificates, but you need to bear in mind that server certificates made by “machine A” will only ever validate client certificates also made on “machine A”. For me this meant finding a permanent location, a machine on my network that’s not going to go away, from where to generate all the certificates. If you’re just testing OpenVPN, this is no big deal, and you can download the client to your laptop and generate the certificates from there. If you’re planning for production use however, you’ll need to find a good home. Whatever you choose, this machine doesn’t need to be accessible to clients to authenticate against; once the certificates are created you’ll copy them to the firewall which will handle authentication. I chose to create the certificates (install the OpenVPN client) on one of my certificate authorities, because it’s here for the long haul.

The first thing you need to do is generate keys and certificates for your clients and pfsense to use.

1. Download and install the most recent version of OpenVPN, from http://openvpn.net/download.html If you plan to connect from a PC with Windows Vista you should get version 2.1 or newer. Install OpenVPN using the default options.

2. Start a command prompt with administrator-rights. In Vista this is done by clicking on START and then type CMD… CMD.EXE should appear, you can RIGHT-Click on it and select ‘Run as Administrator’

3. Change the command prompt directory to the directory you installed OpenVPN, and the easy-rsa directory inside of that. Such as c:\programfiles\openvpn\easy-rsa

4. Run the “init-config.bat” file. This creates the initial configuration files.

5. Edit ‘vars.bat’ file, in your favourite text editor. I tend to use Wordpad, as Notepad can’t always handle linebreaks. If using Vista, you may need to open Wordpad as an administrator (you can follow the procedure in Step 2, above). The following lines in the file need to be edited:

“set KEY_COUNTRY=XX”
2 Letters country ID – I use CA for Canada

“set KEY_PROVINCE=XX”
2 Letters Province ID – I use ON for Ontario, but you could use na as in ‘Not Applicable’

“set KEY_CITY=XXXXXXX”
Name of your city (can be longer than the above line).

“set KEY_ORG=XXXXXXXXXXXXXX”
The name of your company or organisation.

“set KEY_EMAIL=youremail@address.com”
Put an email-address here. Don’t use a private personal address, since this address will be attached to the Certificate Authority certificates. You generally don’t need to put a real address here at all.

Save the file.

6. Run the “vars.bat” file.

7. Run the “clean-all.bat” file.

8. Run the “build-ca.bat” file. This will create the certificate authority records. You will be prompted to enter some various answers. You should be able to leave them as their defaults (populated by what you entered in the vars.bat file), except “Common Name” – here you should put something like “pfSense-CA” (in my case I chose a name related to the certificate authority I was generating these keys and certs on).

9. Run the “build-key-server.bat server” file. You’ll be prompted again for some answers; leave them as their defaults except for “Common Name”, you should use the value “server”.

10. Run build-dh.bat

These are all the steps necessary to generate the certificate authority keys and certificates. You only need to follow these steps once, per installation of pfsense. You could begin to setup pfsense with these certificates now, but we’ll leave that step till the end, seeing as we still need to make the keys and certificates for the clients to authenticate. The following section can be repeated for each additional client you wish to add.

11. Run the “build-key.bat” file, but append a unique client name to the end of it, like “ovpn_client1″ or “username”. For example, run: “build-key.bat client1″
Again you will be prompted for answers, the default values are fine, except for “Common Name” – here you need to enter the client name you just chose, such as “client1″ (or whatever client name you chose when you ran the batch file.)
This client name (“client1″ or whatever you chose) will be the name of the keys, the certificate and the name you’ll identify the connection as, later on. You can use whatever name you like, for our production use we use usernames or emails so we can easily identify who the certificate and connection belong to. At this stage, you can choose to generate as many as you want (with unique names), for all the clients that will be connecting to pfsense.

12. Now you’ll need to copy files (some of your newly created keys and certificates) out of the easy-rsa keys directory, and into the OpenVPN config directory. If you’re testing and you chose to create the certificates on the same machine that will be your client, this is simple; you can simply copy from “c:\program files\openvpn\easy-rsa\keys” to “c:\program files\openvpn\config”. However, if you’ve generated the certificates on a central server, such as I did on my certificate authority, then you’ll need to transfer a copy of these files to the actual CLIENT’s install of OpenVPN. In any case, the following files should now be copied from “c:\program files\openvpn\easy-rsa\keys” to “c:\programfiles\openvpn\config”.

ca.crt
client1.key
client1.crt

(Remember, “client1″ is the name you chose when creating the client certificates. If you’re copying the files to another client, make sure you give the correct set of files to the user who needs them. If you don’t see a .crt file but only a .csr file, chances are that you don’t have admin privileges, or something else went wrong in the process. If you’re using Vista, you may need to look at generating the keys and certificates on a NON-Vista machine.)

13. On the OpenVPN client machine, make a file in the “c:\program files\openvpn\config” directory (this is the same place you just placed a copy of the keys and certificates), called “client1.ovpn” (or whatever name you chose for your client, above). Edit the file in your favourite text editor, and enter the following lines (leave out the hashes/pound signs):
####
client
dev tun
proto udp
remote [ip or DNS name of your pfsense server] 1194
ping 10
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
comp-lzo
pull
verb 3
####
You’ll need to enter the public IP address or DNS name of your pfSense box in the ‘remote’ line. You can also adjust the port, if for some reason you are choosing to not use the standard one. For the lines beginning with ‘cert’ and ‘key’, make sure you enter the name of the files you copied across in step 12.

Congratulations, you’ve got everything ready on the client side to connect to pfsense! This section is the only one that needs to be repeated, for future clients. If you have more than one OpenVPN client (and created keys and certs for them in step 11), you may choose to make all the .ovpn files for your clients now (with the corresponding .key and .crt names). These would need to be copied to the appropriate clients install of OpenVPN, like the keys and certs did in step 12.

Now we need to configure pfsense.

14. Log into the web-gui of pfSense.

15. Select VPN/OpenVPN on the menu, and add an entry in the ‘Server’ tab. Use the following settings:
Protocol: UDP
Local port: 1194
Address pool: 192.168.200.0/24 (Pick any network that you DON’T currently use, this will be assigned to your OpenVPN clients.)
Local Network: 192.168.0.0/24 (Enter whatever the network is that you want the VPN clients to connect to, ie. your local network.)
Remote Network: blank
Cryptography: BF-CBC (128 bit) – or use what you want
Authentication Method: PKI

You can choose to use TCP and/or a different port number, if you have a reason for doing so. Remember you’ll need to set that custom protocol and port in the .ovpn file created in step 13.

Now you need to have access to some of the files created in step 12. If you made the keys and certs on a central server, you’ll need to access them there. The folder is “c:\program files\openvpn\easy-rsa\keys” (or wherever you chose to install).

16. Copy the WHOLE contents of ca.crt (open with your favourite text editor) into the “CA certificate” input box.
17. Copy the WHOLE contents of server.crt into the “Server Certificate” input box.
18. Copy the WHOLE contents of server.key into the “Server Key” input box.
19. Copy the WHOLE contents of dh1024.pem into the “DH parameters” input box.

20. Tick DHCP-Opt: Disable NetBIOS (I don’t use it anyway)

21. Tick LZO Compression

Well done. Now pfsense has the CA keys and certificates installed, so it can validate requests made to authenticate against it. Now we need a few simple rules in the firewall.

22. On the WAN interface you should make a rule like:
PASS
WAN
Protocol: UDP
Source: any
OS type: any
Destination: any
Destination port range from: OpenVPN
Destination port range to: OpenVPN
Leave the rest as default.

You can choose to check the log box, if you’d like to be sure traffic is being passed. Remember if you chose to use custom protocols and ports for OpenVPN in steps 13 and 15 above, you’ll need to adjust this rule accordingly.

23. Add a rule on the interface that contains the network you defined in step 15 (local network), this may be LAN:

PASS
Any protocol
Source: 192.168.200.0/24 (whatever the range of the network defined in step 15′s “address pool”)
Destination: LAN (or whatever the local network is)

24. Depending on how locked down your local networks are, you may need to add another rule on the interface that contains the network you defined in step 15 (local network), this may be LAN:
PASS
Any protocol
Source: LAN (or whatever the name/IP range of the network defined in step 15′s “local network”)
Destination: 192.168.200.0/24 (This is the OpenVPN network that you entered as “address pool” in step 15.)

25. Apply the new rules.

That’s it! Your clients should now you should be able to connect using OpenVPN. Right click on the OpenVPN icon in the system tray and select Connect.

As a bonus, you can configure OpenVPN on pfsense to allow clients to access additional networks. In our case we have multiple VLANs and multiple IP ranges for VPN clients, and we want our OpenVPN clients to be able to access ALL these networks. To do this, you need to “push” the address ranges out to the clients, so that the client machines know how to route to those networks. (This is basic TCP/IP routing stuff, and is beyond the scope of this guide.) You’ll also need the appropriate rules in pfsense to allow this traffic. Go to VPN/OpenVPN in the pfsense web-gui, browse to the bottom of the Server tab, and look for the “Custom options” input box. You can enter multiple custom options separated by semi-colons. The option for pushing additional networks is:
push “route 192.168.4.0 255.255.255.0″ (or whatever the network range happens to be)

All I can say is good freaking job Amazon. Here is a company using it’s clout to effect some positive change. I am sick of the massive amount of plastic and crap I get sent when I order just about anything, from just about anywhere. Simplicity of opening is one thing, as I have certainly sliced my fingers (and mouth) when trying to open plastic sealed RAM and memory cards, not to mention toys. But the materials used are what urks me the most; so much plastic for often small items. It’s very wasteful.

My only fear is that this may result in some cases of mindless box sizing. Like the example I posted previously of HP sending ridiculous packaging, we get the same thing from Ingram Micro and CDW. They generally have a set number of box sizes, and the minimum size may be much larger than some of the items they ship. Periodically you’ll get a USB hub smaller than your fist arriving in a 1 foot by 1/2 foot box. Sad really.
But if companies can avoid this pitfall, then more power to Amazon and this great initiative!

- I’m managing the relaunches of 5+ websites, which as anyone familiar with that process knows, can be a crapload of work. We’re going to rebuild our DotNetNuke infrastructure from a clean slate, as we’ve been upgrading this thing since version 2, and have fundamentally different requirements since the customizations made at that time.
- We’re ramping up our CRM/ERP application, Everest, customizing it more than we’ve ever done, utilizing more areas of it than we’ve ever done, and plan to have the remaining departments at TACF into the system within the next 6 months. This has been a mammoth effort, for the last 3 years, and we’re nearing the next phase, which is optimization and cleansing.
- We’re developing a bunch of sweet applications to make our lives easier and more productive.
- We’re testing an Asterisk based VoIP solution and integration with our existing PBX, to leverage all sorts of great new features. We’re also looking at a Jabber/XMPP server (Openfire) and rolling out staff wide intranet chat.
- We’re evaluating a large software rollout for the final few months of this year, possibly rolling out Office 2007 to our staff. Our long term plans involve more open source usage, like Open Office, so I’m hoping we can use Office 2007 for a couple of years, and then when it’s time to move on from that we go open.
- We’re also finally examining Windows Server 2008, and what systems of ours could benefit from that.

There’s lots of other stuff too… it’s all go. It’s exciting. I love it.

Apple provide a document that offers a trivial level of assistance in setting things up. If you’re already using ActiveSync for other devices, then you’ll be working already. If you’re not using ActiveSync (or aren’t sure if you are), but you are using Outlook Web Access already, then you’re just a couple of steps away. There are a few guides out there for enabling ActiveSync, which is really a simple matter of enabling in Exchange System Manager, and ensuring it’s enabled for the user that needs it (enabled by default for all users).

In our case, we had a small spanner thrown into the mix, because we use forms authentication on Outlook Web Access. I suppose this would affect anyone setting up Exchange ActiveSync, if they also used HTTPS and Form Authentication for their OWA. You can test ActiveSync/OMA (Outlook Mobile Access) by browsing to “http://servername/oma”. If it’s working, you should receive a login prompt, and then posssibly a warning about an unsupported device, followed by being able to get into some sort of email account display.

We received the following, from OMA:

Outlook(R) Mobile Access is supported only on Microsoft(R) Exchange Server 2003. Currently your mailbox is stored on an older version of Exchange server. Please contact your system administrator for additional assistance.

This is the error manifested by using Forms Authentication with HTTPS, specifically on the “servername/exchange” directory. Microsoft describes the fix in this article. We went with resolution method 2, that requires you to copy the Exchange virtual directory (in IIS), and then adjust registry settings to point to the new copied folder (which doesn’t use forms auth or ssl).

After a few IIS restarts and a couple of tests, we had our iPhone syncing like a champ!