Tom here from Lawrence Systems and we're going to talk about OpenVPN and PF Sense. I've done videos on this before, but I want to do a 2020 edition of this particular video and talk about all the details because a few options have changed since the last couple of years since I did a video. If you want to learn more about me or my company head over to LawrenceSystems.com. If you'd like to hire a short project, there's a Hire Us button up at the top. If you want to support the channel in other ways, there are some affiliate links down below to get you deals and discounts on products and services that we talk about on this channel. Now I want to start out with our lab setup. So this is the first part of this where we have to kind of describe where everything is to get you an idea. I have a Windows 10 running in VirtualBox locally on my computer here. VirtualBox has its own NAT firewall and I did this on purpose so I could show you that OpenVPN working through NAT because generally while you use OpenVPN and where you'll be using it, whether you want to connect from home to your office or from one office to another office or whenever you're out and about, you want to use OpenVPN to connect to get to resources on the other side of the network or just tunnel all your traffic. So this is NATed. This is the VirtualBox NAT. This is our pseudo internet, if you will. So 192.1683.24 network and that attaches to the WAN side of a PF sense in my lab here. So it's got a WAN address of 192.1683.195 and then we're going to focus on the fact that it has a 192.168.40 address. Yes, it has a 10 address. We're going to briefly mention it. I just pointed out it exists, but we're trying to get to the goal when we have this configured is to get to this 40 network that is behind this particular firewall. So <IP_ADDRESS> is the gateway. So it's 40 slash 24 and we have this server running Debian on it at <IP_ADDRESS>. So the goal is to get from this network to this network using OpenVPN. So we're going to walk you through how the wizard works. And that's the easiest way to get started with OpenVPN. I've already got some other advanced videos and you're going to do some really tricky things with it. But we'll start with the basics here to get you started and walk through what these steps mean. So go over here to VPN OpenVPN. And this is where you're going to run the wizard. Now I guess I should probably back up real quick here and go over to the package manager because this will make your life a lot easier. The OpenVPN client expert utility. It's a free plugin. I've already got it loaded. You just go in and develop packages, look for OpenVPN client export. It'll save you a lot of trouble you'll see after we run the wizard. So the wizard will configure everything for you in terms of OpenVPN. The client export is really helpful in making it simple when you want to export all the settings and import them in the window. So right now the client export is loaded but there's nothing in here because there's no VPNs configured. And the way it works is you'll have a list of servers here. You can configure more than one OpenVPN server inside a PF sense. And there's special use cases that you want to do for that. I've already got another video on how to use Radius. LDAP is another option. If you have other authentication methods, they are available. But for the basics, we're just going to cover local user access. Now, if it didn't have a certificate authority, the wizard lets you create one. Pretty simple. You just fill out the information of your made up self-sign certificate authority where it's going to click next as I have one. I already have a certificate called LTS VPN. Pretty straightforward there. So we'll go ahead and choose that. WAN, protocol, UDP, multi-home, or just TCP, IDP4. I'm going to say the best way to do this is going to be TCP, IPv4. But it's up to you. You can leave it at default and it'll work perfectly fine and have both enabled. But some people have asked me and I don't have a lot of knowledge on IPv6 myself. It does have support for it but I know there's limitations to it. So don't ask me anything about IPv6 support. Now, if you have the hybrid acceleration, turn that on. I don't in this particular lab environment but all these other defaults are pretty much fine here. So we're going to go down here. Tunnel network. This is important. Make sure this tunnel network does not conflict with any other network. It's defaulting to <IP_ADDRESS> slash 24. And the tunnel network is basically the bridging methodology in between. So even though you see on this here going from this network through right here and getting to here, the tunnel network is essentially an intermediary that is going to be created in here. So we can technically add it to this and we call it ton <IP_ADDRESS> slash 24. And what these are is kind of a virtual network that is the broker to get the data across. And as long as it doesn't conflict with any other networks, you're fine. If it does change it, it's kind of arbitrary that it's set to 70. Now this part here, redirect gateway. This one can be a bit of a challenge because this is a big design decision. So we have the local networks down here that we want to push through. As we want to say, hey, you have access to these networks and it pushes the routing information for <IP_ADDRESS> slash 24 and <IP_ADDRESS>.0 slash 24. But forcing all generated traffic through the tunnel, let me give you a better idea of that. So this is going to come through here, come across here, go into here, and have access to this resource. But how does it get back out to the internet? Well, right now it's going to go from here through the VBox NAT and away we go this way out to the net internet. And when you redirect the gateway, that works differently. So if you redirect the gateway, that means we're going to take and that computer actually goes out of here.  This is redirected gateway to give you an idea. So if you want to use this, that's great, except the problem you run into. Now this is an excellent scenario for when you're out of the office and you want to tunnel all your network back through your office network because you want to make sure that everything you do is encrypted within that tunnel. That works great. But if you have a business and you have a lot of remote users and you want all of their traffic tunneled through the network, now that means all of their traffic. That means if they have YouTube open, Netflix open, anything that that particular computer has VPNed in, it's now redirecting all the traffic there. And this can apply as well. If you're doing a site to site VPN with open VPN, do you want all that site's traffic to completely tunnel through and over this sometimes creates bandwidth problems, restrictions, because you only have so much resources to dedicate to open VPN. Now, if you have a really fast server and a lot of bandwidth, it's not a big deal, but this is a big design consideration. Like I said, as you want to make sure you have the ability to handle the bandwidth, one user, not a big deal, 10 users, 20 users, 30 users later, and all of them have different things open and are not just trying to access this one lonely server down here. They're tunneling all their traffic through and then back out here. So through and back out and it can take a lot of resources to run that. So decide whether or not you want to redirect the gateway. Push whatever networks that you want to have access to. And this is, you know, advantage when you set up multiple VPNs. You can say, maybe I only want to push certain networks over this. You can set up multiple servers inside a PF sense on different ports. This, because I actually set this up a few times just to fall to the port 1195, but you can actually choose any really high level port you want for open VPN. It doesn't have to be on 1194 or 1195, whichever port you choose. Just make sure you have the matching firewall rules for it. Concurrent connections specify the maximum number of clients connected to the server, something if you want to put some restrictions on there, omit the preference for compression. Set the TOS IP header of tunnel packets value. Never really need to set that. Maybe there's some special circumstances where you do. I'm not going to dive into that. Inter-client communication. Allow communication between clients on the server. As I said, this <IP_ADDRESS> network will be where each one of these IP addresses gets assigned. That being said, do you want them to be able to inter-communicate with each other? Probably not. Duplicate connections. Allow multiple concurrent connections from clients with the same company name. No, this is not generally recommended, but maybe needed for some scenarios. You run into a problem occasionally if someone drops and tries to connect right away. You may see that be a problem because maybe they dropped and didn't have enough time for it to drop them from the firewall so they'll not be able to connect. So there are scenarios sometimes where you want to have this on there where you allow duplicate connections. It's only temporary because the other one will drop off over time. But maybe you want it or maybe they have more than one computer. The downside of doing it that way if they have more than one computer logging in is you don't know which one's which. So you can have some confusion. So I recommend creating different users if they have multiple computers they want logged in, but do that as you will. You can leave all this at default. Dynamic IP allow connected retainer client connections if the IP changes. Subnet, one IP address per client per subnet. That's fine at default. This is where you can push if you had specific DNS servers that you wanted to force across the network. So it allows you to specify them. Maybe you have internal DNS servers that you want to specify, but it gives you some options here if you want to force certain ones over the network because you want them to have resolution over local resources that they're going to be accessing. You can leave all these other things at default all the way through on the bottom right here. They're kind of special use cases. Add the firewall rule. Yes. And add the open VPN rule. Yes. Go ahead and do those things on there. Let it do that. You can always change them later, but the defaults are just basically wide open rules to allow the open VPN to connect and work. So we're going to go ahead and hit Finish. Now let's go back in and do some fine tuning if you want. This is optional. So the default of the box, this will work. And we have a TLS key for TLS authentication. I dive deeper into hardening open VPN. I've got a lot of open VPN videos on some of these other special use cases or special hardening. You may or may not want to have multiple cipher options. You can disable this if you want. This expands more ciphers. This shouldn't be a problem at all because someone will see SHA-160 and go, hey, isn't SHA-1 broken? This is part of the HMAC authentication and capsulations. So don't really worry about that. Client certificate depth. So do you want each client to have their own client server certificate depth? And what this means is, and all the way over here, this is checking the certificate on a per client basis, as well as all the other settings in here. And this is an extra layer of security. But if you are looking for simplicity and you don't want to deal with any certificates per user, you can set it just on this. We're going to leave it at default, but I'll show you at the client export what that means. So all these can be left at default as well. I did another video on fine tuning the VPNs as well, like I said, for performance. And you can tweak some of these and try them. But the best thing to do right here is just try it when you have the default set up. So it didn't change any settings. Now here's where the client export will help you a lot. We only have one VPN. So test VPN, TCP port 95. This is that multiple client certificate. So we have an admin and a Tom. We got two users on this. The reason you have to get a specific export is because there's a different bundled certificate with each one of these. That's that extra feature. And I'll just show you if we turn it off. Go here. And let's say we're only going to be user off. We'll go ahead and save by an export. Now it doesn't matter. We're only going to do no per client certificates. That means the configuration stays the same, but there's not a certificate for every user. Like I said, this comes down to different methodologies. Maybe you want just a standard installer that we can just change the usernames and add them as needed and not have to deal with certificates, especially if you're using another device to authenticate those certificates. So that's an optional one on there. It still requires, and we're going to dive into this now by first testing this in Linux. So we'll download this file and we'll show you what's inside of it. So we'll go over here. And it still has a certificate. It just doesn't have the per user. So here's that TLS key down at the bottom. Here's certificate needed. So all these parameters are needed in order to get in there. There's our remote client. Here's the resolve retry infinite and the NCP cipher options plus the cipher option right here. So here's all the little details regarding all the settings that are in this particular file. Now we're going to get into Windows, but first let's show you how it works on Linux. And the reason I'm doing this because it's kind of easier to do because Linux has open VPN built in but we'll get to the Windows installer next. So obviously I can't ping 192.168.40, whoops, 119. And if you remember from our map here, 40.119 is this server because it's behind there. And right now I'm on my computer which happens to be <IP_ADDRESS>. Don't worry, we're going to get to the Windows one next. So what we're going to do is from the command line here, I have other videos on how to set this up to be through the actual UI, but we're just going to do it from the command line because this is an easy way to test it. Open VPN, EF Sense Lab. Now you have to run sudo because you need to run Open VPN as a privileged user. This is true both in Windows and Linux. So login is my privileged user then username, password, and away we go. And see if it connects? Absolutely it connects. And we can go down here and ping. Actually first let's disconnect it. So we'll ping that right now and just show you it doesn't work. 40.119, can't ping it. If we do route, the only routes I have are this 192.168.3 network. Go just up arrow and sudo open VPN, that same one again, log in. All right, now we've done it. And the first thing I'm gonna do before I even ping this because we already seen two transmitted, none working. We're gonna put route again. And here was the route. I only have this one network. Now I have all these networks. Here's that intermediary network, 192.168.70. Then we have 192.168.40. Then it says the 40 network has a gateway of the 70.1. So if we want something on the 40 network, go out 70.1. You notice those didn't exist in a route. This is a very important piece to make sure that this route is here. So now we can ping and I can get to that devian server, no problem. Actually, I don't think I have SSH turned on in that particular box at the moment, but we can ping it. But the point is we can get to this network and that's what the goal was here. So we're able to get to the network. I'm able to ping it. It's working. Next. Now let's do this inside a window. So we're gonna go ahead and cancel this and get rid of it. So don't really need to do anything else. We're just gonna go RM. So I deleted the file, it's gone and we're gonna do the same thing, but we're gonna do it with Windows. So we go down here, current Windows installer, no problem. Now this is great. This installer here has everything we need inside of it. So show folder, open VPN, lab, TCP, Windows 7 install. Now it says Windows 7, but if you notice here, it supports Windows 7, 8, 8.1, 2012 R2, and also Windows 10. So all of them are supported actually. I need this installer, I grabbed the wrong one. This is the one, that's the 7, 8, 1 and this is the Windows 10 installer right next to it. I actually did download the wrong one. There we go. Nothing like doing it all live, right? Here's our Windows 10 installer I was looking for. So go ahead and delete this one. Here's our Windows 10 installer. And if I move it over to this folder, I can copy it onto right there and then we're gonna go back over to our Windows machine and run that wizard. Here's this Windows machine, <IP_ADDRESS>. We're gonna do a route print. So you can see here's the local routes that it has, the 10.network and that's really it. It can't go anywhere else. Now it can get on the internet, it is online, but we are certainly not going to be able to ping because there's no route to this. Being 192.168.40, oops, 40.119, nine, there we go. Can't ping anything. All right, go over here. Get this OpenVPN installer copied over and we'll go ahead and run the installer. Windows does a security scan, there we go. Yes, minimize this. You can just next and yes, all the default options work perfectly fine for this. All right, so OpenVPN is loaded and let's go ahead and open it up. So from here, now we have a little icon down here and we're gonna go ahead and connect. Before we do that, pull this route back up again, print. So you can see all the routes. You can see there's no 192.168.40 network to route two. So if we tried to ping anything, it's just not gonna work. So ping <IP_ADDRESS>, can't get to it because the route doesn't exist. We're gonna go ahead and connect username, put in the password and it looks like it's connecting. There we go. PF Sense connected, all right. We'll do a route print now and there's those extra networks. There's that 40 network, there's the 10 network. It's saying that a gateway is gonna be that tunnel network 192.168.70. So if you wanna get any resources on there, that's the gateway to use on this tunnel network. Matter of fact, if you were to IP config with Windows, it now has two different network connections. Here's the 70 network and here's this particular network here. So let's go back over route print that works and now we should be able to ping. So ping and away we go, we're able to get to that server and get to the resources on that side of the network. So that's pretty much it for getting it set up in Windows or in Linux and being able to get to the resources on a network of open VPN is pretty straightforward to do. Now, troubleshooting is another topic. One, read the error messages. This is the biggest thing I see that people don't do and it's so many people that can go through and solve the problem by a quick Google search.  It details out all the steps, everything that's happening for the users connecting. This is really easy and a lot of times you can go through and literally Google by right-clicking Google search and you wouldn't believe how many times you just find the answer. You'll say error because this happened, error because of that happened, failed this, failed that and those are really quick ways you can start doing it, especially if you're trying to fine tune and tweak things and you've changed a bunch of settings and you're not really familiar with open VPN, you'll lead to breaking it. Also feel free to delete everything and run the wizard. Sometimes starting it back over is a good way to start and start from a base known working. Also, once you get it working, before you do the tuning, do a backup restore. If you grab the backup file before, once you know it's working, before you start tuning it, you can then easily roll back to the known working state and a lot of times I'll download a backup called known working good. That way worst case scenario, I can always just restore back to the known working good state of the system. Now, another note here, when you go here to open VPN, you can go here. So I went open VPN and I go this and this will show you the users connected. So I got user time. Now, because I'm running virtual box on my computer, 192.1683.9 is my computer and this Windows computer, as this 10 address behind here, it shows my computer's IP address, just FYI. It shows the public IP of whatever that user is connecting from. So even if they're three nats deep behind something else, you'll actually see their public IP right here from where they're coming in. And the virtual address that they're assigned, this is that 70.1 is the gateway for the tunnel network inside of PF Sense. 70.2 has been assigned to user time when they connected and what kind of data they're sending right here. Now you can also add over here at PF Sense, go to the dashboard and you can click add this open VPN right here. Won't let me add it twice, I don't think. Nope, doesn't look like it. Oh yeah, I will, neat. I've never tried adding it twice. So if you wanted to put this in more than one spot on the dashboard you can, I'm kind of fine with one spot. But this will list out all the users, especially if you're dealing with a lot of VPN traffic, you can kind of narrow it down and make some determinations of how many users are logged in and go from there. Once again, it kind of goes to defined tuning. So hopefully this helps get you started with open VPN. There's lots of advanced videos I have on how to use different authentication like free radius for this, even loading a free radius server within PF Sense is the video demo I have on that fine tuning and what the different settings mean as far as the cryptographic settings and some of the performance tuning goes with it. There's a lot of settings you can tweak because the wizard only exposes so many, but obviously once it's all configured and set up, everything's exposed, including if there's anything that they didn't have inside of here, custom options are in there as well. So if you have some custom configuration things you wanna do with open VPN, you can actually push different settings right here as well in addition to, for example, it's gonna be pushing routes and I'll do another video on that a later time. All right, thanks. And thank you for making it to the end of the video. If you liked this video, please give it a thumbs up. If you'd like to see more content from the channel, hit the subscribe button and hit the bell icon. If you like YouTube to notify you when new videos come out. If you'd like to hire us, head over to laurancesystems.com, fill out our contact page and let us know what we can help you with and what projects you'd like us to work together on. If you wanna carry on the discussion, head over to forums.laurancesystems.com where we can carry on the discussion about this video, other videos or other tech topics in general, even suggestions for new videos, they're accepted right there on our forums, which are free. Also, if you'd like to help the channel in other ways, head over to our affiliate page. We have a lot of great tech offers for you and once again, thanks for watching and see you next time.


So welcome everyone. This is Houseways Mains. It's March 10th Thursday and it's Thursday morning. So we're going to be talking about education finance restructuring. As has been our practice session, I'm going to turn things over to Emily to run the meeting. We have two hours of testimony and conversation on education finance at 11. We'll take a break at 11 and 1115 actually we'll need one. 1115 we're going to go back to the age 716, which is the bill we spent quite a lot of time on the last couple days on the at 173 transition. And my hope is to have that voted just to let people know so we should have enough information to do that. So I guess that's it. Any questions or announcements anyone can ask before we get gone. Morning everyone. So, last, right before the break, we sort of went through the original recommendations of the task force and everyone flags their questions and so today, I think it's sort of a stack of some answers. That's probably the easiest way to explain it and so have an order to talk to us about how we measure poverty and what that, how that sort of interacts with food assistance programs. And so and or would love. And so we're going to have nor talk about that and then Brad and Julia are going to talk about tuitioning and how that is calculated and how it impacts budgets. We're going to take a break and then at 10 Professor Colby is going to come in to answer a few more of our technical questions. And so looking forward to that. And with that, and more the floor is yours. We have documents from you. You do but I sent them late yesterday afternoon, so apologies for that. But you do have some detailed kind of stats and data from me about the two main points that I'm going to make. Good morning, everyone. I'm a nor Wharton I'm the executive director of hunger free Vermont. And my understanding is that I have been asked to come in and speak with you this morning about sections four and five of the. I'm not sure what we're actually calling this bill the people waiting bill is what I'm going to call it. This morning. And so I really would like to just make sure that I am available today to answer all of your questions about the two key changes that are made in sections four and five of this bill and one is. No, I'm sorry to interrupt you. I just want to awkwardly enough, we actually don't have a bill and we're not looking at a bill over in the Senate. And really just talking about the recommendations of the move to free and reduce lunch and then move to the. I understand less than the language. Okay, reason for those ideas. Probably identical. I just want to sort of give you a technical update. Thank you so much representative green hyzer. Okay, so yes, so I would just really like to be available this morning to answer any and all of your questions about how we move, how we currently measure low income students or students living in poverty or particularly disadvantaged students, and also kind of better way to capture that data with universal income declaration form. So, I'll just summarize my two main points and then I'd like to just, you know, we take any questions that you might have and I'm happy to elaborate on anything. The first point that I really would like to make this morning is that there's a couple of different ways that the state of Vermont, and in fact, all states in the United States, use to measure students in poverty, or low income students, and one is household enrollment in three squares Vermont or snap, and the other is the student enrollment in the free and reduced price school meal program at their school. And the most common of these is the free and reduced priced meal application. Both of these methods pretty significantly undercount the number of students who are low income or who are living in economically disadvantaged households. So, we at hunger free Vermont have been advocating for a long time to disconnect the way that the state of Vermont accounts for which students are economically disadvantaged for purposes of providing education support from these nutrition programs. And that the reason why these nutrition programs undercount the number of students who we could define as low income is that both these programs require the parents or guardians of these students to actively apply for and be accepted to a nutrition benefit program, either three squares Vermont or school meals. And that is up to the individual parent or guardian to make that choice about whether or not to apply for these programs. These programs have application processes that are pretty intrusive and complicated, and many families from many different reasons choose not to apply, or are not able to correctly make it through the application process in order to apply. In addition, these nutrition programs are federal programs, and the income cut off for the programs and the rules around who qualifies for them are set by the federal government and the state of Vermont doesn't have any control over that. And so many families may in fact count as low income or be experiencing low incomes and yet not qualified for the program. Those are all the reasons why these programs undercount the number of students who are low income or economically disadvantaged. And so, what that means for education funding right now is that the state of Vermont and school districts in Vermont are actually leaving federal dollars on the table, and I'm not talking about school meal program dollars now. I'm talking about education support dollars. They're leaving those dollars in DC, instead of fully being able to draw them down and make use of them the way they're intended, either to provide supports for individual students, like, not not having to pay to take the PSAT or the SAT, or not having to pay to apply for college or tutoring support that might be supported by federal dollars but need to be applied to individual students. So those those kinds of individual student support programs are underused and underfunded because of this connection to these nutrition program applications, but also dollars to be used school wide to support low income students are also being not drawn down to the just extent that they could be. So that is my first point and I'd be happy to talk more about this phenomenon of undercounting students by tying to the federal programs. A quick question while we're while we're on the last point that you made with changing with moving ultimately to the universal form. Effect our effect school districts eligibility for that kind of federal money that you were just talking about, or are they going to continue to use another one of the other measures. So that that is a critical question, and the answer is, yes, the universal declaration form could be used to draw down to document and draw down all of that education support money from the federal government, both for federal students and for school wide programs. So, and, and I can answer that with 100% confidence, because at the request of the people waiting task force, I did a lot of research on this question. I spoke to people at the US Department of Education. I worked with a national organization the food research and action center. I reached out to other states and collected examples of the kinds of universal income declaration forms that they use to see the range of kinds of forms that are committed by the by the US Department of Education. And so, I know for for certain that the kind of form that we're talking about and envisioning here can be used to access all of those different kinds of federal education funding for schools. Thank you. You're welcome. Yeah, thank you. What are the differences in forms in different states I'm just curious about that. Well, I can send you later today samples of those forms. So, the really good news about this form from my perspective is that it can be very, very simple. So I don't know how many of you have ever seen a school meal program application form. It is very complicated. It requires families to list every single source of income that they receive. It requires them to sign an attestation that they understand that they could get in terrible trouble for fraud. If they're not telling the truth on this form. It is teeny tiny print. And it's very, very complicated and confusing. And this is one of the reasons why many families either don't fill it out at all, fill it out incorrectly. And imagine what it would be like for a parent who does not, who's for whom English is not their first language and they may not read well in English to try to fill out this form. All of that. None of that has to happen with this universal income declaration form, because all of that is required for the meal program under USDA rules but none of it is required under the US Department of Education to draw down the federal education dollars. All that has to be on that form as far as the US Department of Education is concerned is a list of the students, the children in the household, a number of the number of people in the household, the names of the students, so you can reach them with individual educational supports, and you can just an income range that families can check a box that this is this is the range in which our household income falls, and you're done. So, I think that we can solve a lot of problems in Vermont by adopting this kind of a form that the stigma is a lot less the difficulty in completing it is a lot less. The other reason why the stigma is a lot less, in addition to the fact that families are not asking for an individual benefit by completing this form. Right there, it's not tied to a school meal it's not tied to three scores remind it's not tied to anything it's, it's tied to helping the whole school community. You can see all the funds that it's entitled to, and while federal law prohibits the state of Vermont, or a school district from requiring families to complete a school meal application. The federal law permits the school district to require every family to complete this universal income declaration form. And that means that, instead of only families in need, filling out this form, every family can fill out this form just as part of identifying their student in school every year. And we're going to get a much more accurate count of how many pupils are in each school in Vermont who are actually meet whatever criteria is set by the legislature for defining them as economically disadvantaged I think it's going to, it's going to solve a lot of problems that our schools have right now with drawing down all the federal funds they're entitled to. And also it's going to assist the state of Vermont a great deal in determining how to distribute state education funding to particular categories of students. Hi, Nora. So question you said that school districts can require that all of the parents of all of their students fill out this universal declaration form. What happens in the parent won't fill out a declaration do they have the power to say sorry your child can't come to school until you fill this out or how far does that go. Well, so technically, they, they may have that power. I, I, I'm not going to speak for any school district but I, you know, they probably wouldn't enforce that, but I think that here's what we know from schools in Vermont, who already use this kind of form. So, schools that are providing universal meals under the community eligibility provision already have to use what's called the household income form. And that's what the agency of education calls this form right now. It is more complicated than it needs to be, according to federal law so I think we could make the form better and simpler, but we already have school districts and individual schools in Vermont, who use this form. And we've, we've, you know, I've spoken with several principles from schools, and they've developed some pretty effective and sophisticated methods of making sure that they collect these forms from all or nearly all families. And what they find is that just telling people, this, this is what we need in order to make sure we get all the education funding, please help us out, is a pretty effective appeal, actually, and many schools, you know, are successful in collecting a very high percentage of these forms, much higher percentage than, you know, you're still, you're still getting a much better picture of how many students in your schools are at what income levels by asked by by requiring all families to complete the form then you are by taking whatever you get from the school meal application collection, which is what's happening. And we're, what kinds of things do the principal or the school nurse, who's working on getting these forms out. Who's working on getting them back. What happens when English is not a primary language what happens with the people who are not very connected to getting forms back how many hours does it take per form to get back, etc. So, I'm, I'm, I may not be the best person to really precisely answer all those questions since I don't, I'm not working in a school, but the one, one, the first important thing to understand is that schools do all of that to get school meal applications back now it's hard to get school meal applications back, and it takes a lot of time and effort, and then the processing of those forms is incredibly time consuming because somebody at the school has to actually do the math of adding up everybody's all this list of different kinds of income that we'll get, and making that determination as opposed to noting, this is the box that got checked for this income range. So, so it's incredibly time intensive to collect school meal applications. This, this income form would be much simpler, we could make it as a state, we could make it much simpler. I think that what works well for forms like this. What are best practices is, you know, you, you might include it along with the other forms that are mandatory. So you, so every, every parent or guardian must fill out an emergency contact information form for their students they must fill out permissions for their students to participate in sports there's all kinds of things that they have to complete. And if this pretty simple form is included in that list. You know, you'll, you'll be able to collect quite a few of them, probably the majority that way. So best practice for school meal applications is to send the meal application separately in the mail over the summer with a return stamped envelope to encourage families to complete it. So, schools could continue to do that with this universal income declaration form if they wanted to. So what we do about families who, for whom English is not their first language or who have other challenges with completing the form. That's a challenge that we face now as well with school forms, and so, you know, ideally, we would have this form be translated into many different languages, and we would, we would make it as easy as possible for families to complete it. But right now we have that challenge schools have that challenge with all the forms that they need families to complete and so I assume that they would use similar methods to collect this form. So that's your question. Yes, I wonder if I just wonder if we could hear from maybe when new ski who who has experienced with trying to collect the forms and what kind of people power takes to do it. And we might write that when they scan Burlington both already use universal income declaration forms. Yes, that's correct. George you had a question, and then we're going to wrap up pretty soon after that. Okay, hi George told me Jericho wasn't there when we introduced ourselves. First of all, thank you for all your work on this and thank you to the task force for taking this office been a long time frustration for me to see me under counting in our communities of poverty. I have a couple quick questions. First of all, who has, who is the keeper of this information and who has access to it. And, you know, for some folks it might be sensitive information, how do we, how do we guarantee the confidentiality of this. That's a, that's a really good question. So, there are a lot of strict rules in place around school meal applications and information, what we call direct certification information, which schools receive from the department for children and families about which families are enrolled in three scores Vermont and reach up and other programs that automatically qualify their children to receive free school meals. So, there are careful protocols in place only certain people have access to that information. And I, I, I expect that similar kinds of protocols could be implemented for this form and should be because it is sensitive information. I think that I think what's most sensitive about the information right now is our things that could be eliminated on this form, because on the school meal application. Right now, families have to write in, you know, this income is from child support payments this income is for this temporary job this income is from this other thing and they have to disclose a lot of really personal information about how they get their money. That this this form this universal income declaration form could just be a box that a family would check to say the our household income is under this number or it's over this number or it's in this income range, and that would be the only information that they would be providing I think the form itself could mitigate a lot of that of the concern because their families just wouldn't have to disclose as much information. But it that still there should be protocols in every school district already has them for how they handle the, the, the many different kinds of sensitive in information that families are providing them already about their students their students health needs their students food allergies, there's a lot of private information. And then I think we're also going to need to talk to Brad and some other data people at a way about how they get it from school districts because I think there's some questions about sort of under reporting and some districts as well. My question was, I assume and what's proposed there is a exception of car rides for things like state play students or foster kids, that sort of thing is that am I correct that there is an exception for those sorts of things. Yes, I'm not sure if in the existing bill but I think that sort of standard protocol with state play students have a specific or specifically named in one of the versions that I saw that was true. And if I might add to that. So, there's a group of students there's some there's several groups of students where information about whether or not they count as low income students is automatically provided to schools through a private electronic means by the Department for Children and state placed foster care children are part of that group, migrant children who are identified are part of that group. Students, as I said before whose families received three squares Vermont and students whose families receive reach up schools will continue to receive that information through a secure electronic channel. Regardless of what happens with this particular form. So that doesn't answer it for all students because some some groups of students are identified at the school district level so students who are homeless. And, and in some cases students who are migrant are the homeless liaison for the school district is the person who collects that information and provides it to the school. So, things it's a little different depending on what group of students were talking about how that information is handled now. I can't see your face. Scott, did you have a question or did I just want to just say quick one. So, my, my biggest concern with our existing system is that we have a huge variation of uptake rates around the state both for snap and for FRL. Is it your opinion that just moving the universal declaration would solve that problem. I believe that it really would go a long, long way to solving that problem and you're absolutely right. We are rural school districts, I believe our higher income school districts are the ones where the undercounting is more than that of our low income students and therefore those school districts and those students are actually at a great disadvantage for receiving a lot of the support that are tied to income and I believe that moving to a universal income declaration form would really make a huge difference. We all are students everywhere and all our families everywhere but especially for low income students and families who are in rural districts, small schools, where everybody knows your business, and also higher income districts where you're a smaller group of this overall student population. Thank you. I think we need to transition so wondering if you have sort of anything final you want to add really appreciate you spending this time with us. And all the thought you've given to this issue. It's an absolute pleasure. I can't tell you how excited I am that the legislature is taking up this question. And I believe that we can really make a tremendous difference and a tremendous impact through the work that you're doing on this complicated process so I would like to thank all of you, and I will provide the committee with some additional more kind of technical information about the federal government rules around this form and some samples of the form from other states. I would like to say that I think it's really important that this form is designed with great care and thought, should the form be enacted that we really need to take the time with the agency of education to develop a form that uses every possible best practice that's as easy as possible for families to complete that is translated into multiple languages, ideally that has a web based version that families can complete. I would really transform the way that that school districts are able to identify and help low income students without the degree of stigma and shame that is attached to that now, and that would be an amazing accomplishment. So thank you all very much. Thank you. Next up we're going to hear from Brad. And Brad before you jump into positioning. Am I correct that sort of the way we measure poverty has also a big impact on the Ed fund because of the federal dollars that we draw down based on how many kids were counting. So as our for example, was based on those numbers. Brad James age of education yes as Esther was based, Esther dollars are based on how title one is allocated which is itself based on poverty counts from the school districts. So in that sense, yes, the the monies that came in. Well, I don't remember how the total amount for Vermont was done. I know that the amount we got it was allocated out to supervisory is based on the title one allocations. I think I don't remember off the top of my head how at the, the, the initial Esther amount, or any of the extra amounts were determined that came to individual states or might for all I know there might have been a small state minimum like there was in title one. I don't I don't know I can find out for you though. Totally shifting gears. Okay, so, so I'm going to give you kind of a brief overview of what's happening with tuition, just kind of a high level. I have one handout for you today. I believe it's called tuition overview and as Monty Python said now for something completely different because it's not numbers. It's actually words this time. I didn't know I'm having I want to I struggled with this. I really did. I struggled. But, but it's like, Oh my God, there are words on the page. What do I do. So anyway, here, here we are so. So I think I think the the first real question that we need to talk about is, is what is announced tuition because that's what everybody hears about they hear about announced tuition they hear about average announced tuition. And that's what they're that's what they're calculated and determined that's what they're said it is a tuition rate. I'm not going to necessarily follow what I have written in order because I don't do those things very well. And I certainly not going to read it to you. So, school districts have to announce their tuition by January 15. If they don't, then the prior years, they're the current year I guess I should say tuition rate is used for the following year. The same holds true for independent schools that they have to announce their tuition to the boards that their trustee boards have to announce theirs and then the same date in there. The, the, the announced tuition then is collected by us how is it determined. There's no guide there are no guidelines for how it's determined basically what the law says is that a school district should not set a tuition rate that is higher than what it costs their resident students so that that's, I mean it's, it's more complex that that's that's what it boils down to. So that's what school districts trying to do. There's no guy and saying use this use this you do this. It's, it's the school districts do it themselves. Once those announced two reasons are done. There, there is a, there is a, a true up the following year, based on actual information. So if, if they announce a tuition of $20,000 for this coming year, the year happens the school districts pay who are sending kids, but then the final numbers come out and it was really $17,000, then there's a true up conversely if they did low there's a true up if it goes high to so so that's that's a stretch that's called the maximum allowable tuition rate. But that happens the following year that true up. So, the next thing that's probably critical to know about is what's called the average now tuition. And that's the one that the independent schools really pay attention to who don't set their own rates, and we'll come to those of it shortly. The average announced tuition is broken up into two sets one for elementary grades, K through six, and one for secondary grades seven through 12 and then it may be 912 maybe 712 whatever the case may be seven eight. What the average announced tuition for elementary schools is is it is the average of all the union elementary school districts in the state for that year. That's, that's what comes out to be the average union average announced tuition for you, elementary schools, by the same token for secondary schools. It's the average announced tuition for all the union school districts grades seven through 12 or nine through 12 whichever the case may be or seven eight some cases. So I gave you under to a very quick. So the average announced tuition is I meant to put in percentage changes I forgot. But here's five years of what they are so the average announced tuition a T is my brief age for average announced tuition. Average announced tuition for the union elementary schools in nine in f y 19 was just just over $13,900 for this coming school year it's up to just over $16,000. And for union high school districts, did I type that incorrectly that looks funny. You check my notes. So on your on your piece of paper where it says average announced tuition for you in high schools where it says 12,600 18 make that 15,600 18 I apologize. I'm going to do things quickly see numbers I can I can see you now. So, so that 12,600 eight should be 15,600 eight I apologize for that. So one from 15,600 18 to f y 23 for the school year next year to just about $17,300 that just kind of give me an indication what's happening. So why are these numbers important, because this is this is the tuition rate that most independent schools districts set. Okay, they use because they're allowed to go up to that level. And so that's where most of them said their tuition rates. We tend to get lots of calls saying what's the tuition rate from the independent schools and we get it posted, sometimes a little bit later than we anticipate but we get it posted. So these are the numbers. Okay. So who does school districts pay their tuition to. They pay tuition, they pay tuition to public schools either in state or out of state or even out of country I think they've used not out of country public school though. They pay tuition to approved independent schools in Vermont. They pay tuition to independent schools meeting education quality standards and I think there might be two next year I'm not sure. And I'm not, I'm never clear whether that for the Academy is considered to be meeting education quality standards now or not they were in the past I don't know if they are now. And I believe Sharon Academy is working towards it and is going to be presumed is not the correct word but they're going to be meeting. They're going to be meetings at school quality standards, or education quality standards I take that back for this coming school year provided they meet certain conditions. So there should be one or two districts and do that. And then independent schools that are in other countries and other states as long as they're meeting the, the laws that govern independent schools in the states and countries. And then independent programs approved by the state pro State Board of Education. I think there are two, and then approving independent programs and the ones I think up when I hear approved independent programs I think the team parent education centers because those are the ones I'm more familiar with there probably a few others but that's what I think when I hear approved education program. So that's who school district can pay their tuition to it's it's again it's prescribed and statute as to what they're doing what they can do. Um, we're down on number four here. How much tuition to school district paid other districts. It depends. If they're if it's it depends on if it's if it's to an independent school if it's to a public school it depends if it's an elementary school or a secondary school. If it's for if it's for an elementary student grades six through eight, then they pay full tuition to a public school in or out of state. If it's to an improved independent school, they pay the lesser of three choices, they pay the lesser of the average announced tuition for you know mentally schools, or, or the actual tuition charged by the independent school is very rarely the lesser of the average announced tuition, or they pay the average of what they're paying for all their other resident elementary school students that they're tuitioning. Okay, generally speaking, it's the average announced tuition that people pay. Just, just as what's going on. And then in terms of secondary students like elementary they pay full tuition to their secondary student for their secondary students to a public school in their in state or out of state. If you have independent schools functioning as an approved in as an approved regional center, career technical center CTE, then they pay full tuition that would be what Linden Institute and Fedford Academy together, not Fedford Academy together they act as a regional technical center. So they get to charge their full tuition. If they, if it is a independent school meeting school quality standards, then full tuition is paid. And I don't think I put this one on there. If, if it's a designated school, such as that for Academy. Fedford Academy is a designated school by the school district of Fedford and Stratford, then they pay, then that acts as a public high school so they get they get that full tuition is paid to them also, and other districts come in and also pay the same. And again if that for Academy is meeting education quality standards they get in from that aspect also. So if you're sending a kid to the CTE, but he's still getting basic education at his original school. Do they prorate that because they go full tuition to the CTE. They, they, if, if the student is going to a CTE for six less a half time they should be prorating it. I would, I would need to check to make sure that's what's happening but I have a feeling that if that was not what was happening I would be I would probably be hearing about it. Yeah. Okay. Thank you. Sure. There is a provision for secondary students not elementary students but for secondary students. There is a provision that the receiving school district, the board of the receiving school district the ones who tuition is paid to can make a different statute with sending districts. If they choose to do that, then they have to offer it to all school districts that are sending not just to select few so it's you can you can make that decision but then it applies to everyone coming in this school district not not individual parents or anything but to the school districts that are sending their kids in a couple of quick examples of exceptions. Byrne Burton, Byrne Burton Academy charges less to school districts in their area who send most of their kids there. The voters in those school districts approve a higher tuition rate they're allowed to do that I forgot to mention that earlier. They approve a higher tuition rate so they, they, they can ignore whatever the statute says because if the voters have said do we want to pay higher. So Byrne Burton gives them a discount and most most of the students in that area tend to go to Byrne Burton. So when that happens is this way that look to a voter is there like a second. A second article on there when they vote that is that how it is. I, it's a good question representative back and I don't know the answer because I don't, I haven't seen any of those warnings I don't know if anybody on the committee, I think some of my primer who on the committee is in that area they may know I don't. Because our article one ballot language is pretty prescriptive. The article on ballot language is pretty prescriptive. But what it's what it's talking about is, is it's talking about an amount so my guess is why it's a good question I don't know the answer I'm not even going to guess. I'll look around and see if I can find it. I'll check to I can use a fine ballots online or warnings online. When I, I'm sort of reading the process about their sort of an average created and then people are maxing to that and then I sort of a new average is created the next year. Does that sort of created an artificial inflationary effect on some level. I don't, I don't, I don't think it, I don't think it does because, because the, you know, we're talking independent schools kind of going to the max and you know that's logical. Because it's coming from what the, what the public schools to think is going to be their costs that's really where it's coming from the pushes not from the independent side it's really from the public side and they're all their inflationary factors and whatever it is that they're dealing with. Right, so I don't, I don't think it's anything an artificial increase or anything that I think it's, you know, pretty much based on reality, because again as I said there's that provision that says they that school districts should not do more than a tuition rate for incoming students more than what their residents are. And then there's that true up the following year, you know, if they over, if they over, over bill, yeah, over bill or under bill, then they get, then they get to make up the difference up to a certain point. And when you, when districts are figuring that out. Public districts are figuring that out. And they're looking at the per pupil cost in order to sort of determine that do they, do you know if they use their equalized per pupil costs or their non equalized per pupil costs. So the two, the two, two additions are built on actual people on actual head counts. So, so the enrollment, which differs from ADM and equalized peoples. So I think the problem with what they're doing is a prior figure out what costs there are, and then they're using their enrollment counts is what I think is what I think that I don't know for certain but I'd be shocked if anybody's using their equalized per pupil costs just because equalized peoples enrollments can be significantly different and equalized peoples are districts enrollments are at schools and this kind of board of school. No, it's just a comment I'm just trying to work through my head is is that you know you have a system where where voters can vote for more than the average announced and it kind of almost makes me just try to try to get my head like what would would it be any different than what we have right I'm just trying to get my head around that. Yeah, I understand I think what the average announced tuition does is it provides a target for both the independent schools which which they think is low, which I'm sure you've heard. I think it's too low in most cases, but it provides a target for them, and it provides an an idea of what's going to happen with some of the school districts who are paying those two issues. One of the things I think I mentioned that the other day when I was in one of the talking about why is education spending high, or it was not at least it was on what I wrote down was one school district said the tuition rates from the independent schools to other kids to were much higher than they anticipated, they anticipated good amount but the cost came in higher. And so, you know so so I think if you took away average announced tuition, my guess is that independent school tuition would increase, not necessarily everywhere but my guess is that across the board, there'd be a general increase. And so that would that would be an increase in education spending. So if you did the opposite, which was say that everyone needs to stick to average announced tuition instead of all these confusing carbots. Then what would happen is I would, I think that that's the tuition rate for burn Burton would go to I was assuming the voters can't approve it at a higher amount is that what you're saying. Yeah. Okay, then, then, then, then the tuitions in the burn Burton area would decrease to whatever the amounts tuition is probably a couple thousand dollars less per student. It would not impact St. Johns Barry or Lyndon Institute because they act as a regional technical center, and it would not impact that for the academy because they are a designated high school, and I think they need to take education because it's not 100% sure on that. But one way they're they're they're meeting. So really only impact burn Burton pretty much everybody else is at that there's there's no option for them. I don't think I don't think anybody is has voted to pay more to any schools other than burn Burton trying to think if they do for long trail or something I don't think anybody has that I'm aware of. All right, so I think I think the impact would would be regional. If this was, most of the people at the announced tuition average announced tuition levels, they will charge the parents if they want to. Amazing how personal policy can be in a small state. Jim had a question and then David. A statement and a question read as you know, I'm strafford's been charging the average, but would like to charge more. They're finding their. They're budget a little tight. I'm you know something about it. You and I've talked about this brand, but you said it's really someone else's office that's working on this issue. You said strafford. That's what I thought I thought I thought I heard today strafford. Just while we're thinking of it strafford does have its own deal, but Sharon Academy, yes, Sharon Sharon Academy, because they talked about it last session with the think house Ed, we're trying is has been trying to make sure that education quality standards eq s and I believe I believe that that I'm not sure it's finalized yet but I believe that they're going to move forward and we're agreeing with them that that they will be meeting education quality standards for this coming year. I think I'm not 100% sure on this representative. But I think they still need to do a few things or sign off on some things and they will do it then we'll be checking. That that's my understanding I'm not 100% clear on it, but it but my understanding is that they will be considered presumed to meet education quality standards this following year so they will be able to charge whatever, you know, they will receive whatever they choose to charge. And for limited by the average announced action. Thank you for people in the room or around the table or anywhere, Sharon Academy offers an excellent education. It's sort of more independent minded than the structures of other tools. Was it David or George saying. Yeah, well I just pulled up the ballot article for the tachanica green district which is the, the merge district that includes many many of the town send their students to burn burn. And I'll just read it it's interesting. Thank you to your question, Scott. It's, and it's not what I expected. Shall the voters approve payment of the of the announced tuition rate of burn Burton Academy, and the amount of $19,200 for resident pupils and grades nine to 12 who attend any approved Vermont independent school. And there is no second. They're basically saying that they could pay that amount of money to burn burden or any others independent school. So it seems so yeah, yes, but no more than that, no more than that and it does say the announced tuition so it doesn't doesn't seem to be suggesting it's a discount. Yeah, my, my understanding is they've always been a discount but I but you, but I don't know for a fact, but that has been my understanding for years and years and years. But yeah okay that's interesting yeah so, so they could be paying $19,000 to somebody who would ordinarily be getting the average announced tuition of what was it 17 or something like that 16. Scott and then we're going to wrap. I think what's also really complex really complicates this conversation is the fact that special education is usually on top of this. The school districts when they do their, their per pupil spending that special education spending that's not supported by state grant gets rolled into their per pupil spending. But it's not, it's not part of the tuition that it gets paid if they travel for special services. That's an amount of money on top of that that complicates it. And then you also have this phenomena where when school districts are capturing grant money. Almost always, not always that grant money is for the purpose of operating their school, which lowers helps them to lower their per pupil spending, but then independent schools don't really have access to them. So, I mean there's a lot of things that are going on and it's very complicated. There, there are and in terms of the maximum tuition rate the maximum allowable tuition that people reconcile against they do back out special education costs from that calculation. Right. My guess they're probably not in the announced tuition because there's no, there's a piece of excess spend of excess costs for special education that most pass on. Yeah. So if they're not giving special services, they're playing paying that announced tuition plus, yeah, whatever that cost is right. Thank you very much Brad for spending time with us again today. I don't know if we're going to see you again later today so maybe we'll see you soon. Thank you. Around 11. Yes. Okay, great. Now I'll probably listen into Tammy. I'm going to take a break until.


So, before I came to Cambridge, I graduated in 2018. I'm a fresh graduate and I was doing law. I went to law school back in India, so I did BLLB honors. It's a five-year course program. And I specialized in corporate law. And by the time I opted for the corporate law specialization, I realized that this is what I want to build my career in. This is what I want to specialize in. And I eventually realized that I would like to deepen my understanding of the subject. And I eventually opted for the MCL as opposed to the general LLM or any other course for which was being offered to me by Oxford or other universities. I think the MCL, the overall experience of the MCL was brilliant. I loved the subject, especially the Michael Bistrom subjects that is international mojo control and law firm is a business. They were absolutely enriching. And they were nothing like anything that I've studied before. So I would give 10 marks for both those subjects. Eventually, it got slightly stressful because the subjects became a bit theoretical, especially in the lentor. But I didn't mind it. Again, the curriculum is very international. The cohort is very international. I made good friends with my classmates. So overall, it had been a very enriching experience. I think the entire year at Cambridge has been wonderful. It's like a stressful vacation. I loved my time here. And it's more about the experience and the exposure and less about the course and the curriculum, even though the curriculum is very exclusively tailor-made for people who would eventually like to specialize in corporate law. But the way Cambridge is, the university and the students and the faculty and the friends that we make here and the town, it's beautiful. So anybody who is expecting to be in Cambridge will have a great time. I did get a training contract at two firms, one international and one magic circle in London. But I'm planning to go back. I have a job offer back in an Indian firm. So I would be joining that. I'm going back. And I would probably be joining the Insolvency Practice. And I would start working as a finance lawyer in that international firm.