VPN Theory

VPNVPN
Copyright by Hacking Feder
Powered by LJ Projects

WHY VPN?
• Geographically separate offices need to
communicate.
• Collaboration
• Mobile users
• One Network
•

VPN
• Allows a trusted network to communicate
to another trusted network over un-trusted
public network.
• Used to extend an enterprise’s internal
private network.

VPN
•Definition:
Network of virtual circuits that carries
private traffic through public or shared
networks such as the Internet or those
provided by network service providers.

VPN-BENEFITS
• Extends geographical connectivity,
• Improves Security
• Reduces operational costs versus a
traditional WAN
•Improves productivity.

VPN-BENEFITS
• Simplifies network topology.
• Provides global networking opportunities.
• Reduces transit time and transportation
costs for remote users.

VPN-CHARACTERISTICS
• Traffic is encrypted
• Remote site is authenticated
• Multiple protocol support,
• Connection is point to point.

TUNNELLING
Tunnel – a means of forwarding data
across a network from one node to another,
as if two nodes were directly connected.
How it is achieved?
Encapsulation / Encapsulating the Data

Encrypted Inner Datagram
Datagram Header Outer Datagram Data Area
Original Datagram
TUNNELLING

ENCAPSULATION
• Extra header is added to the data sent
by the transmitting end of the tunnel.
• Data is forwarded by intermediate
nodes based on the outer header
without looking at the contents of the
original packet.

ENCAPSULATION
So technically…
VPN is a group of one or more secure
IP tunnel.

FOUR CRITICAL FUNCTIONS
Authentication – validates that the data
was sent from the sender.
Access control – limiting unauthorized
users from accessing the network.
Confidentiality – preventing the data to
be read or copied as the data is being
transported.
Data Integrity – ensuring that the data
has not been altered

VPN PROTOCOLS
PPTP - Point-to-Point Tunneling Protocol
L2TP - Layer 2 Tunneling Protocol
IPsec - Internet Protocol Security
SOCKS - is not used as much as the ones
above

TYPES OF VPN
• Trusted VPN
• Secure VPN
• Hybrid VPN

REQUIREMENTS – SECURE VPN
• All traffic on the secure VPN must be
encrypted and authenticated.
• The security property of the VPN must be
agreed to by all parties in the VPN.
• No one outside the VPN can affect the
security property of the VPN.

REQUIREMENTS – TRUSTED VPN
• No one other than the trusted VPN provider
can affect the creation or modification of a
path in the VPN.
•No one other than the trusted VPN provider
can change data, inject data, or delete data
on a path in the VPN.

REQUIREMENTS – TRUSTED VPN
•The routing and addressing used in a trusted
VPN must be established before the VPN is
created.

REQUIREMENTS – HYBRID VPN
• The address boundaries of the secure VPN
within the trusted VPN must be extremely
clear.
• The admin should be able to say which one
is secure VPN, when there is a Hybrid VPN
setup.

TECHNOLOGIES SUPPORTED – SVPN
• IPSec with Encryption
• Either tunnel or transport modes.
• Security association can be set up either
manually or using IKE with either
certificates or pre-shared secrets.
• IPSec inside of L2TP
•SSL 3.0 or TLS with encryption.
•TLS – RFC 3193

IPSec RFC
• IKEv1
• 2401, 2406, 2407, and 2409
•IKEv2
• 4301, 4303, 4306, 4307, and 4308

TECHNOLOGIES SUPPORTED – TVPN
• Mainly classified into:
• Layer 2 VPN, and
• Layer 3 VPN

• Layer 2 VPN
• ATM Circuits
• Frame Relay Circuits, and
• Transport of Layer 2 frames over MPLS.

• Layer 3 VPN
• MPLS with constrained distribution of
routing information through BGP. (RFC
4364).

TECHNOLOGIES SUPPORTED – HVPN
• Any supported secure VPN technologies
running over any supported trusted VPN
technology.

VPN IN LINUX
• IPSec –
• Standard developed by International
Engineering Task Force – IETF
• Linux includes IPSec support – Linux 2.6
kernel.
• Offer administrative interface – ipsec-
tools

VPN IN LINUX
•PPP over OpenSSH
• Method & not a tool.
• With the existing tools, you can configure
a PPP interface to use SSH to encrypt all
data that goes across the PPP interface.
• Poor performance when compared to
other.

VPN IN LINUX
•OpenVPN
• www.openvpn.net
• Can create a tunnel to remote systems
over public networks with encryption and
authentication features.
• yum install openvpn

VPN IN LINUX
• openswan
• www.openswan.org
• An implementation of IPSec that was
originally based on code from the
FreeS/WAN project. (www.freeswan.org).
• yum install openswan

VPN IN LINUX
• Crypto IP Encapsulation (CIPE)
• IP Packets are routed across selected IP
interfaces as encrypted UDP packets.
• Easy to setup
• Less overhead than PPP over OpenSSH
• Means better performance.
• Drawback – Since not a standard
implementation, not available on all distro

UNDERSTANDING IPSec
•IPSec consists of two primary protocols:
• Authentication Header (AH)
• Encapsulating Security Payload (ESP)

UNDERSTANDING IPSec
/etc/protocols
•AH = 51
•ESP = 50

UNDERSTANDING IPSec
•IPSec Mode
•Tunnel Mode
•Transport Mode

UNDERSTANDING IPSec
Tunnel Mode
•Entire IP datagram is encapsulated into
the new IP datagram by IPSec.
•Protects both data and the control
information.

UNDERSTANDING IPSec
Transport Mode
• Only the data (payload) is encrypted.
• To do this, IPSec inserts its own header
between the IP header and the protocol
header for the upper layer.

UNDERSTANDING IPSec
Transport Mode
AH
IP Header -> AH Header -> TCP Header + Payload
ESP
IP Header -> ESP -> TCP HEader + Payload
=================================================
Tunnel Mode
AH
IP Header -> AH Header -> Original IP Header -> TCP Header + Payload
ESP
IP Header -> ESP -> IP Header + TCP Header + Payload

UNDERSTANDING IPSec
•Review – Features of VPN
• Authentication,
• Encryption
•For authentication and exchange of
symmetric keys, IPSec uses the Internet Key
Exchange – IKE protocol.

UNDERSTANDING IPSec
•At the beginning of communication, IKE:
•Authenticates the peer computer,
•Negotiates security associations,
•Choose secret symmetric keys (using
Diffie Hellmann key exchange)

UNDERSTANDING IPSec
• Result/
•Security Association - SA
•The SA made is stored in Security
Association Database – SAD.

UNDERSTANDING IPSec
• SA consists of:
• information about the communications
endpoints – eg public IP address.
• whether AH or ESP are being used with
IPSec, and
• The secret key / algorithm being used.

UNDERSTANDING IPSec
•HMAC – Hash Message Authentication
Codes
• Send through the Protocol Header
• Message Authentication Code
• Calculated using a specific algorithm
involving cryptographic hash function in
combination with a secret key.

UNDERSTANDING IPSec
HMAC offers the following advantages:
• Data Integrity –
The HMAC created using the hash
algorithm, secret key and data in the IP
datagram can be checked at the receiver
end by reversing the order.
• Data privacy
Datagrams are encrypted using symmetric
encryption algorithms.

IPSec – DoS Attack
• Recording and replaying sequence of
packets can cause denial of service attacks.
• IPSec combats this type of attacks
• Accepts only packets that are within a
“sliding window” of sequence numbers or
higher.
• Packets using older sequence numbers are
dropped.

VPN Theory

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to VPN Theory

Similar to VPN Theory (20)

More from LJ PROJECTS

More from LJ PROJECTS (11)

Recently uploaded

Recently uploaded (20)

VPN Theory