Virtual Private Network with example

A Virtual Private Network (VPN) creates a secure, private connection (a tunnel) over a public network such as the Internet. Data is encapsulated and encrypted, so it behaves as if the users were on a private leased line, but at a much lower cost.

How it works

1. Both ends authenticate each other (passwords, certificates, pre-shared key).
2. A tunnel is created: the original packet is encrypted and encapsulated in a new packet with the VPN gateway's address (e.g. IPsec ESP in tunnel mode).
3. The packet is carried over the Internet and cannot be read or changed.
4. The receiving gateway decrypts and delivers the original packet.

Types

• Site-to-site VPN: connects two LANs through VPN gateways.
• Remote-access VPN: a single user connects to the office network using VPN client software.

Protocols

IPsec, SSL/TLS VPN, L2TP, PPTP, OpenVPN.

Example

A bank has its head office in Kathmandu and a branch in Pokhara. Instead of renting a private line, each site has a VPN gateway connected to the Internet.

Branch LAN --[VPN GW]====== encrypted tunnel ======[VPN GW]-- HQ LAN
 192.168.2.0/24         over the public Internet       192.168.1.0/24

A branch PC sending data to a head-office server has its packet encrypted by the Pokhara gateway, carried over the Internet and decrypted at Kathmandu. An employee at home can likewise use a remote-access VPN to reach the HQ servers securely.

Advantages: security, lower cost, scalability, remote access. Disadvantages: some speed overhead, depends on Internet quality.