<< Back to article

VPN

A Virtual Private Network (VPN) extends a private network across a public network (typically the internet), enabling secure communication as if the devices were directly connected to the private network. VPNs encrypt traffic between endpoints, providing confidentiality, integrity, and authentication.

Types of VPN

Site-to-Site VPN

Connects entire networks together, such as a branch office to headquarters. Routers or dedicated VPN appliances handle encryption and tunnelling.

Remote Access VPN

Allows individual users to connect to a corporate network from remote locations. Clients install VPN software that creates a virtual network interface.

Client-to-Site (SSL VPN)

Web-based VPNs that use TLS for encryption. Users connect through a browser, no client software required.

VPN Technologies

IPsec (Internet Protocol Security)

IPsec operates at the network layer, encrypting IP packets. It is commonly used for site-to-site VPNs and remote access.

  • Transport mode: Encrypts only the payload, original headers visible.
  • Tunnel mode: Encrypts the entire packet, including headers. A new IP header is added.

Linux implementation: strongswan, libreswan.

OpenVPN

OpenVPN is an open-source SSL/TLS-based VPN. It operates at the transport layer and can traverse NAT/firewalls.

Features:

  • Uses OpenSSL for encryption.
  • Supports TCP and UDP (default 1194).
  • Client and server available for all major platforms.
  • Highly configurable.

WireGuard

WireGuard is a modern, lightweight VPN protocol. It is simpler than IPsec and OpenVPN, with a small codebase (~4,000 lines).

Features:

  • wg-quick for easy configuration.
  • Cryptokey routing: each peer has a public key and allowed IPs.
  • High performance, minimal overhead.
  • Roaming: handles IP changes seamlessly.
  • Built into the Linux kernel (5.6+).

WireGuard configuration example:

[Interface]
PrivateKey = <server-private-key>
Address = 10.0.0.1/24
ListenPort = 51820

[Peer]
PublicKey = <client-public-key>
AllowedIPs = 10.0.0.2/32

Tinc

Tinc is a mesh VPN daemon that creates a secure network by routing traffic through encrypted tunnels between nodes. It supports full mesh routing and automatic failover.

Linux VPN Tools

wg-quick up wg0              # Start WireGuard
wg-quick down wg0            # Stop WireGuard
openvpn --config client.ovpn # Start OpenVPN
strongswan up myvpn           # Start strongSwan

Use Cases

  • Secure remote access: Employees accessing internal resources from home.
  • Bypassing censorship: Accessing blocked content (use responsibly).
  • Network extension: Connecting IoT devices across the internet.
  • Anonymity: Routing traffic through VPN providers (note limitations).

Security Considerations

  • Use strong encryption (AES-256-GCM, ChaCha20-Poly1305).
  • Authenticate peers with certificates or preshared keys.
  • Implement kill switches to prevent traffic leakage if VPN drops.
  • Verify certificate hosts and use certificate pinning where possible.