- COURSES
- SPECIALS
- BLOG
- MEMBERS
- SHOP
- BOOKSHELF
- ABOUT
- ENROLL HERE
Table of Contents
VPN (Virtual Private Network) is a security technology that provides secure communication over public networks like the Internet. With a VPN, users and networks can communicate securely even if they are in different locations. The main purpose of a VPN is to protect data during transmission. VPN technologies like IPsec provide security through encryption, authentication and integrity protection. These mechanisms help prevent unauthorized access, data modification and data interception.
VPN Security Features
There are different VPN Types and VPN Protocols used in networking. Some VPN types are used to connect remote users to corporate networks, while others are used to connect different company locations. In this lesson, we will learn the main VPN types, how VPN works and the most widely used VPN protocols.
We have talked about what is VPN. Now, let’s focus on how VPN works. A VPN (Virtual Private Network) works by creating a secure connection between two endpoints over a public network which is called a VPN tunnel. Here, when a user sends data through this VPN tunnel, the data is protected. this protection is done with the used VPN protocol. For example, IPsec VPN uses encryption, authentication and integrity mechanisms to secure communication between twoend points.
How VPN Works?
Let’s explain this with an example. Think about an employee is working from home and needs to access the company network. Instead of connecting directly to the corporate resources over the Internet, the employee. He or she want to to connect his/her company network. This is done via Remote Access VPN connection. After connection establishment, this user can access authorized resources in the company. If VPN tunnel isused betweeen different company locations between routers or firewalss, this is calles Site-to-Site VPN.
After talking about VPN definition and how it work, now let’s focus on types. There are two main VPN Types according to their usage. These VPN types are given below:
Both of these VPN types provide secure communication, but they are used for different purposes. In this lesson, we will learn the types of VPN in detail. Let’s start.
Remote Access VPN is the VPN type that allows individual users to connect to private networks remotely over the Internet. This type of VPN is commonly used in corporate networks. For example, employees working remotely from home can securely access their company’s network resources through a Remote Access VPN connection. Here, user can establish a VPN connection to the company’s VPN gateway. After authentication, this employee can access authorized servers, applications and other network resources in the company network like he/she is in the company physically. Remote Access VPN solutions can use different technologies such as IPsec, IKEv2 and SSL/TLS VPN.
Remote Access VPN Example topology
Besides corporate usage, this type of VPN is also used in home networks. Users at home can use Remote Access VPN to connect to the Internet. By doing this, home users can avoid regional restrictions like website blocking. In addition, they use it for better security during their Internet connection.
Another VPN type is Site-to-Site VPN. Site-to-Site Virtual Private Network is the VPN type used to connect two or more networks over the Internet or another transport network. With Site-to-Site VPN, company branches in different geographical locations can communicate securely as if they are connected through a private WAN connection.
Site-to-site VPN Example
Let’s give an example. For example a company has a branch in New York and another branch in London. Instead of using a dedicated private connection, the company can establish an IPsec VPN tunnel between the routers or firewalls of these two branches. With this connection, users in both offices can access authorized network resources securely in company network.
There are two different Site-to-Site VPN types. These are:
In an Intranet-Based VPN, the branches of a company are connected over the Internet as if they are in the same network. In this case, there is only one company and no external connection.
In an Extranet-Based VPN, different companies are connected over the Internet. This type of VPN is commonly used between business partners, suppliers and customers.The main difference is the organizations connected through the VPN.
There are different VPN protocols used to establish secure communication over networks. These protocols use different tunneling, encryption and authentication mechanisms. Some VPN protocols provide complete secure tunneling solutions, while others are used together with additional security protocols.
The most important VPN protocols and technologies are given below:
Let’s learn these VPN protocols one by one.
One of the most important VPN protocols is IPsec (Internet Protocol Security). IPSec for VPN provides secure connections over IP networks using encryption, integrity protection and authentication mechanisms. IPsec VPN is commonly used in Site-to-Site VPN connections between routers and firewalls. It can also be used for Remote Access VPN connections.
There are two different IPSec modes. These are:
IPsec Transport Mode vs Tunnel Mode
In Transport Mode, the original IP header is preserved and ESP encryption protects the transport-layer payload and data. In other words, only the payload of the packet is encrypted. This mode is generally used for host-to-host communication.
In Tunnel Mode, the original IP packet is encapsulated inside a new IP packet. In other words, the entire packet is encrypted. When ESP encryption is used, the original IP packet is encrypted and a new outer IP header is added. Tunnel Mode is widely used in Site-to-Site IPsec VPN connections.
IPsec uses security protocols such as ESP (Encapsulating Security Payload) and AH (Authentication Header). ESP is commonly used because it supports encryption and integrity protection. You can learn more about this technology in our IPsec lesson.
IKEv2 (Internet Key Exchange version 2) is a protocol used to establish and manage IPsec security associations. It is not a standalone encryption protocol. It works with IPsec to negotiate security parameters, authenticate peers and establish secure connections.
IKEv2/IPsec is widely used in Remote Access VPN. One important advantage of IKEv2 is its support for mobility through MOBIKE. This allows supported VPN connections to continue when a device changes its network connection, such as moving from Wi-Fi to a mobile network.
Because of its security and mobility capabilities, IKEv2/IPsec is an important VPN solution for modern networks.
SSL/TLS VPN is another VPN technology commonly used for Remote Access VPN connections. Modern SSL VPN solutions use TLS (Transport Layer Security) to protect communication. SSL is the older predecessor of TLS.
SSL TLS VPN Topology
SSL/TLS VPN solutions allow remote users to access corporate applications and network resources securely from their own locations. There are two common approaches. These are given below:
In Clientless SSL VPN, users can access selected applications through a web browser and a secure VPN portal.
In Client-Based SSL VPN, users install or run a VPN client to establish a secure connection and access authorized network resources.
OpenVPN is another VPP solution which is open source. It is one of the popular VPN solutions in today’s netwrok world. This VPN solution uses SSL/TLS encryption on tunnels. It is a highly secure protocol that supports many encryption algorithms. It is awidely used VPN type in both corporate networks and commercial VPN services.
OpenVPN Topology
OpenVPN supports different encryption algorithms and authentication methods. It can operate over UDP or TCP, depending on the network requirements.
There are some advantages of using OpenVPN. One of the advantages of OpenVPN is its flexibility. It can be configured for different network environments and security requirements.
WireGuard is a modern VPN protocol designed to provide secure communication with a simple and efficient architecture which uses a smaller codebase and a fixed set of modern cryptographic algorithms. It uses UDP (User Datagram Protocol) for communication and supports secure tunneling between devices and networks. WireGuard is used in remote access solutions, Site-to-Site VPN connections and commercial VPN services.
One of the important advantages of WireGuard is its performance. Its lightweight design can provide high-speed VPN connections with relatively low overhead.
WireGuard VPN Topology
Layer 2 Tunneling Protocol (L2TP) is another VPN protocol widely used in the networking world which is used to transport PPP traffic over IP networks. L2TP does not provide encryption. So, it is used together with IPsec to provide secure VPN communication.
It is used together with IPSec because of its previous vulnerabilities. IPSec provides additional security to L2TP. In this combination, the tunnel is created by L2TP and encryption is provided by IPSec.
Today, this solution is considered as a legacy VPN solution. Instead of it, modern VPN deployments often prefer alternatives such as IKEv2/IPsec, OpenVPN and WireGuard.
SSTP (Secure Socket Tunneling Protocol) is a VPN tunneling protocol developed by Microsoft and built intoWindows. It is similar to OpenVPN, but unlike OpenVPN, it is mainly used on Windows systems. SSTP uses TLS to establish a secure connection and transports PPP traffic through this connection.
SSTP commonly uses TCP port 443, which can help VPN traffic pass through some firewalls that allow HTTPS traffic.
SSTP can still be used in certain VPN deployments, especially in environments using Microsoft technologies.
PPTP is one of the older VPN tunneling protocols that uses Point-to-Point Protocol (PPP) to encrypt data through the tunnel. PPTP uses PPP and GRE-based tunneling to transport network traffic. Older PPTP deployments commonly used MPPE for encryption. It was widely used in the past because of its simple configuration and relatively low processing overhead. It has some weakness so it is not commonly used today.
Besides traditional VPN protocols, there are other Virtual Private Network technologies used to provide private network connectivity for secure communication. Some of these technologies are MPLS VPN, Hybrid VPN and SSH Tunneling. Below, we will talk about these technologies also.
SSH (Secure Shell) is another method used to establish secure remote connections between network devices and servers. ith SSH, a secure connection is established between a client and a server, and data is transferred through an encrypted tunnel. SSH provides encryption, authentication and integrity protection for communication. Besides secure remote administration, it is used to forward traffic through encrypted tunnels. However, SSH is not generally classified as a traditional VPN protocol. It provides secure tunneling capabilities but does not automatically create a complete network-level VPN connection.
MPLS VPN is a VPN solution commonly used by service providers to connect customer networks over an MPLS infrastructure. It provides logical separation between customer networks and allows different organizations to use the same service provider infrastructure. So, MPLS VPN is one of the most widely used VPN types in large-scale networks. However, MPLS VPN is complex and expensive, making it unsuitable for home users.
MPLS VPN Topology
There are two main types of MPLS VPNs. These MPLS VPN types are given below:
Layer 2 VPNs include:
Layer 3 VPNs are also knowns as VPRN in Nokia Networking. Layer 3 MPLS VPN services commonly use VRFs and MP-BGP to separate and distribute customer routing information.
According to the used technology, there are also different types of Pseudowires (VPWS).
MPLS VPNs has explained detailly in another lessons. You can check MPLS VPN lessons to learn more about them.
Hybrid VPN is a VPN type that combines multiple VPN and WAN technologies. For example, MPLS and IPSec VPNs can be used together within a Hybrid VPN. Although this approach can be expensive, it helps overcome the disadvantages of one protocol by leveraging the advantages of another.
For example, a company can use MPLS VPN for its primary WAN connection and an IPsec VPN over the Internet as an additional connection. With this approach, companies can benefit from different network technologies according to their security, performance and availability requirements. Hybrid VPN solutions are commonly used in enterprise networks where multiple WAN connections are available.
As we have talked about, there are many protocols used for Virtual Private Networks. Each protocols has its own advantages and disadvantages. Below, you can find a VPN comparison table for their security level and common usage area.
| VPN Protocol | Security | Common Usage |
|---|---|---|
| IPsec | Strong | Site-to-Site VPN |
| IKEv2/IPsec | Strong | Remote Access VPN |
| SSL/TLS VPN | Strong | Corporate Remote Access |
| OpenVPN | Strong | Remote Access, Commercial VPN |
| WireGuard | Strong | Remote Access, Site-to-Site VPN |
| L2TP/IPsec | Depends on IPsec Configuration | Legacy VPN |
| SSTP | Strong | Windows VPN |
| PPTP | Insecure | Legacy Systems |
VPN Protocol Comparison Table
The main purpose of a VPN (Virtual Private Network) is to provide secure communication over untrusted networks, such as the Internet. VPN technologies like IPsec use encryption, integrity protection and authentication to protect data and verify communicating peers. It also provide this during the communication. VPNs also improve user privacy, but they do not guarantee complete anonymity.
Remote Access VPN is used by individual users to connect to a company network. Employees working from home can be a good example for this type of VPN.
Site-to-Site VPN, on the other hand, connects entire networks together securely over the Internet. The connectiojn between brach offices of a company can be an example of this type of VPN.
IPSec secures VPN communication by verifying the identity of devices (authentication) and protecting data with encryption. It ensures that data is not altered or accessed by unauthorized users during transmission.
An important difference between MPLS VPN and IPsec VPN is encryption. MPLS VPN does not provide encryption by default. It provides traffic separation through the service provider network. If encryption is required, additional technologies such as IPsec can be used.
Modern VPN protocols like WireGuard, OpenVPN and IKEv2/IPsec provide strong security if we implement and configure them good. The best VPN protocol depends on network requirements, device compatibility, performance and security policies in your network.
No. PPTP is an outdated VPN protocol with known security vulnerabilities. It should not be used for modern secure VPN deployments. More secure alternatives include IKEv2/IPsec, OpenVPN and WireGuard.
Gokhan Kosem is a Network Engineer, Instructor and the Founder of IPCisco.com with 15+ years of experience in Cisco, Nokia, Huawei, Juniper, Linux, Service Provider Networks, Routing and Switching technologies.
He has worked on the backbone networks of major service providers and network vendors including Nortel, Alcatel-Lucent (Nokia) and has extensive hands-on experience with Cisco, Huawei, Juniper and Nokia networking technologies.
He has trained thousands of networking students worldwide through IPCisco.com, Udemy, books, labs, quizzes, and educational content across multiple social media platforms.
IPCisco.com | Best Route to Your Dreams
Leave a Reply