CYS406 · Chapter 13

The Secret Tunnel:
VPN Fundamentals

How a Virtual Private Network turns the wide-open internet into a private, encrypted corridor between a user and a company network — architecture, components, protocols, topologies, and the risks that can blow the tunnel wide open.

VPN Architecture Concentrators Site-to-Site vs Remote-Access Encapsulation & Encryption Topologies RADIUS / AAA
scroll ↓
01 / Foundations

What Is a VPN?

A Virtual Private Network (VPN) creates a private, encrypted "tunnel" through a public, insecure network (usually the internet) so that two endpoints — a remote user and a company network, or two company sites — can communicate as if they were on the same local, trusted network.

Why it exists
VPNs let organizations securely communicate with distant offices or users over an inherently insecure channel — the public internet — without leasing expensive dedicated lines.
Core promise
Confidentiality and integrity of data in transit, plus authenticated access, even though the underlying network (the internet) is not trusted.
Typical users
Telecommuters, traveling staff on laptops with a VPN client, and branch offices connecting back to a head office.

VPN Architecture — the moving parts

A typical VPN deployment links a Head Office, one or more Branch/Home Offices, and telecommuters/traveling staff. Each end has a piece of VPN hardware or software:

  • Head office: a VPN concentrator and a router with a VPN module
  • Branch office: a router with a VPN module / its own concentrator
  • Home office: a PC with VPN client software
  • Telecommuter/traveler: a laptop with VPN client, often connecting via 3G/CDMA/HSDPA mobile broadband or a broadband modem

All of these talk to each other across the Internet, which acts as the (untrusted) transport medium.

Laptop / PC + VPN Client
Broadband / Mobile Link
Internet
VPN Concentrator / Router with VPN Module
Head / Branch Office Network
🧠

Mnemonic — Why Build a VPN?

"EXTRA GLOBAL SIMPLE PRODUCTIVE SAVINGS" → the six official benefits: Extend geographic connectivity, reduce operational costs vs traditional WANs (Savings), reduce transit/travel time (Productive for remote users), Improve productivity, Simplify network topology, provide Global networking opportunities. Picture a business traveler saving money and time by tunneling in instead of flying to head office.

02 / Mechanics

How a VPN Works

Establishing a VPN connection is a sequence: connect to the internet, authenticate, then tunnel securely.

1

Client connects to the Internet

The client willing to reach the company's network first gets basic internet connectivity (ISP, Wi-Fi, mobile data, etc.).

2

Client initiates a VPN connection

The client reaches out to the company's VPN server (often sitting behind, or integrated with, a firewall).

3

Endpoints authenticate

Before the tunnel opens, both ends must be authenticated — via passwords, biometrics, personal data, or a combination.

4

Secure access is granted

Once authenticated, the client can securely access resources on the company's internal network as if physically present.

📘 What an unauthorized host sees

An authorized host runs VPN client software that handles authorization and encryption transparently. An unauthorized host attempting the same connection is stopped — usually at a firewall with VPN capability guarding the internal network — because it can't complete authentication or doesn't hold the right encryption material.

03 / Building Blocks

VPN Components

Four core pieces make up any VPN deployment:

VPN Client
Software (or hardware) on the user's end that initiates and manages the encrypted tunnel to the remote network.
Network Access Server (NAS)
Also called a media/remote-access server — it's the entry point that accepts dial-in / remote connections (often via PSTN/ISP) before handing off to the VPN.
Tunnel Terminating Device (VPN server)
The device on the corporate side that terminates the tunnel — decapsulating and delivering traffic to the corporate network.
VPN Protocol
The Layer-3 tunneling/encryption protocol both ends agree to use to move data securely through the tunnel.
04 / Hardware

VPN Concentrators

A VPN Concentrator is a dedicated network device that creates and manages secure VPN connections — essentially a specialized VPN router. It's typically deployed to support remote-access or site-to-site VPNs at scale (e.g., the classic Cisco VPN 3000 series).

What it does with tunnels

It uses tunneling protocols to negotiate security parameters, create and manage tunnels, encapsulate and transmit/receive packets through the tunnel, and de-encapsulate them on arrival. Functionally, it's a bi-directional tunnel endpoint.

# Function of a VPN Concentrator
01 Encrypts and decrypts data
02 Authenticates users
03 Manages data transfer across the tunnel
04 Negotiates tunnel parameters
05 Manages security keys
06 Establishes tunnels
07 Assigns user addresses
08 Manages inbound/outbound data transfers as a tunnel endpoint or router
💡

Where it sits

In a typical network diagram, the concentrator sits between the Internet-facing router/firewall (public/untrusted segment) and the private, trusted segment holding file servers, mail servers, intranet servers, and the authentication server.

05 / Categories

VPN Types & Categories

The two headline categories students must distinguish: Client-to-Site (Remote-Access) and Site-to-Site VPNs.

Remote-Access (Client-to-Site) VPN

Lets individual hosts — telecommuters, mobile users — establish a secure connection to a company network over the internet. Each host runs VPN client software (or a web-based client). The VPN encrypts packets sent to the VPN gateway at the network edge. The gateway receives packets and closes the VPN connection once the transfer completes.

Site-to-Site VPN

Extends a company's network so different physical locations can access shared resources — it connects a branch/remote office network to headquarters. Also called LAN-to-LAN or L2L VPN. Split into two sub-types: Intranet-based (between sites of one organization) and Extranet-based (between different organizations, e.g., business partners/clients).

🧠

Mnemonic — Remote-Access vs Site-to-Site

"ONE PERSON vs TWO PLACES" — Remote-Access = one person's device reaching into the network (traveler, telecommuter). Site-to-Site = two whole networks talking to each other permanently (branch ↔ HQ), like two houses connected by a permanent secret hallway instead of one visitor using a doorbell.

Hardware VPNs vs Software VPNs

Hardware VPNs

A dedicated hardware VPN appliance connects routers/gateways to communicate securely over an insecure channel. Designed purely as a VPN endpoint and can link multiple LANs. Products: Cisco VPN 3000 series concentrators / 3002 hardware clients / 7600 routers, SonicWALL PRO series, Juniper NetScreen, WatchGuard Firebox X.

Software VPNs

VPN software installed/configured on routers, servers, firewalls, or as a gateway. Advantages: no extra devices, low-cost, easy to deploy, doesn't change the target network. Disadvantages: extra processing burden on the host device, generally less secure and more attack-prone. Products: CheckPoint VPN-1, NETGEAR ProSafe VPN, Cisco AnyConnect.

Selecting an Appropriate VPN

Choose a VPN solution by weighing: Compatibility, Vendor Support, Scalability and Capacity, organizational Need, Security requirements, and Cost.

06 / Core Mechanics

VPN Core Functionality

Three functions make a VPN a VPN: encapsulation, encryption, and authentication.

1. Encapsulation

Packets sent over a VPN are wrapped ("encapsulated") inside another packet carrying a different source/destination IP. This hides the original source and destination, protecting data integrity. Common encapsulation protocols:

  • Point-to-Point Tunneling Protocol (PPTP)
  • Layer 2 Tunneling Protocol (L2TP)
  • Secure Shell (SSH)
  • Socket Secure (SOCKS)
📘 Example

Originating computer 10.0.50.3 sends a packet. The VPN router encapsulates it, giving the outer packet its own address (192.168.50.1). Anyone sniffing the internal LAN sees only the router's IP as the encapsulated packet's source — the true origin (10.0.50.3) is concealed inside.

2. Encryption

Packets are encrypted to preserve confidentiality; only the holder of the correct decryption key can read them. Certificates, managed by a Certificate Authority (CA)/certificate server, are commonly used to distribute keys to VPN users at branch/home offices.

Common VPN encryption technologies:

  • Triple Data Encryption Standard (3DES)
  • Secure Sockets Layer (SSL)
  • OpenVPN

3. Authentication

Users must authenticate before accessing VPN resources; digital certificates are a common mechanism. Common authentication techniques: IPSec, MS-CHAP, Kerberos.

1

Packet sent unencrypted

From the source network toward the destination VPN router.

2

Packet encrypted & encapsulated

The originating VPN router wraps and secures it before sending over the internet.

3

Authorization requested

The receiving VPN router requests authorization for the incoming tunnel/session.

4

Database check decides success

If successful, the packet is delivered to Network 2. If not, it's refused and an error is returned to the sender.

🧠

Mnemonic — The 3 Core VPN Functions

"WRAP IT, LOCK IT, PROVE IT"Wrap it = Encapsulation (hide the real source/destination inside another packet). Lock it = Encryption (scramble contents so only the key-holder can read it). Prove it = Authentication (confirm you're really who you say you are before you're let in).

07 / Trust Models

VPN Technologies: Trusted, Secure, Hybrid

This is a different axis of classification — not by architecture, but by how trust and encryption are handled.

Trusted VPNs

Predate the universal internet. Companies leased dedicated circuits from a communications provider and used them just like private physical cables. The organization knows and controls the transmission pathway. The provider maintains integrity/security of the path — but there is no encryption. Built using ATM circuits, frame-relay circuits, or MPLS.

Secure VPNs

Emerged once the internet became the standard corporate communications medium. A vendor protocol encrypts traffic at the origin and decrypts at the destination. Even if an attacker intercepts the traffic, they cannot read it. Secure VPNs protect confidentiality/integrity of data, but — unlike trusted VPNs — they do not guarantee/control the transmission path.

Hybrid VPNs

A Secure VPN is run as a segment inside a larger Trusted VPN, forming a Hybrid VPN. The secure portion can be administered either by the customer or by the provider that supplies the trusted portion. Think of it as "encrypted island inside a leased-line ocean."

🧠

Mnemonic — Trusted vs Secure

"TRUSTED = PATH, SECURE = PACKET" — Trusted VPN cares about controlling the path (leased circuit, no encryption). Secure VPN cares about protecting the packet itself (encryption, but no control over the path it travels). Hybrid = both combined.

08 / Topologies

VPN Topologies

A VPN topology defines how peers/networks within the VPN connect to one another. Four topologies appear in the slides: Hub-and-Spoke, Point-to-Point, Full Mesh, and Star.

Hub-and-Spoke
Each branch office (spoke) has its own secure tunnel to a central device (hub) at the main office. A persistent connection links main office and branches via the internet/third-party network. Optional secondary hubs add resilience.
Point-to-Point
Two endpoints (Site 1, Site 2) act as peer devices and can communicate directly, without IPsec failover concerns of hub-and-spoke. Only regular IPsec or IPsec/GRE is assigned to the tunnel — either peer can initiate.
Full Mesh
Suitable for complex networks where every peer talks to every other peer, each pairing over its own unique IPsec tunnel. Avoids bottlenecking at a single VPN gateway; reliable with built-in redundancy, at the cost of more tunnels to manage.
Star
Remote branches securely reach corporate HQ, but branches cannot talk directly to each other. Commonly used in banking so one compromised branch can't reach another — an attacker must first breach the central network. Easy to add new sites, but if the central site fails, all connections go down.
🧠

Mnemonic — Four Topologies

"HUB, POINT, MESH, STAR" → think of a bicycle wheel (Hub-and-spoke: everything to the center), two friends texting directly (Point-to-point: peer to peer), a spider web (Mesh: everyone to everyone), and bank branches that can't gossip with each other (Star: only to HQ, never sideways).

09 / Risks

VPN Security Risks

Even a well-designed VPN can be undermined by these eight weaknesses:

# Risk
01 VPN Fingerprinting
02 Insecure Storage of Authentication Credentials
03 Username Enumeration Vulnerabilities
04 Offline Password Cracking
05 Man-in-the-Middle Attacks
06 Lack of Account Lockout
07 Poor Default Configurations
08 Poor Guidance and Documentation
⚠️

Exam angle

Notice these risks are mostly about authentication weaknesses (storage, enumeration, cracking, lockout) rather than the tunnel's cryptography itself — attackers usually go after the login, not the encrypted pipe.

10 / Hardening

Securing the VPN: Firewalls, IPsec, AAA, RADIUS

Firewalls

Firewalls establish a protective barrier between the VPN and the internet. Before deploying a VPN, a good firewall must already be in place. It should be configured to restrict open ports and the types of packets/protocols allowed to reach the VPN.

IPsec Server — Tunnel vs Transport Mode

The IPsec server strengthens VPN security via strong encryption and authentication algorithms. It supports two encryption modes:

Tunnel Mode

Both the header and payload of each packet are encrypted. Used site-to-site, protects the whole original packet.

Transport Mode

Only the payload of each packet is encrypted; the header stays visible. Typically used end-to-end between two hosts.

AAA Server

The AAA server establishes secure access in a remote-access VPN environment and performs three checks:

Authentication
"Who are you?"
Authorization
"What are you allowed to do?"
Accounting
"What did you actually do?"
🧠

Mnemonic — AAA

"WHO, WHAT, DID" — Authentication = Who are you. Authorization = What can you do. Accounting = what you Did. Same order as a security guard checking your ID, checking your clearance level, then logging your visit in the book.

RADIUS (Remote Access Dial-In User Service)

RADIUS is the simplest way to centralize authentication in VPNs. It's a software application running on a server with access to all users in the domain. In a VPN environment, RADIUS manages both authentication and authorization, cutting total cost of ownership by managing credentials from one central location.

1

User attempts VPN connection

The VPN server contacts the RADIUS server.

2

RADIUS authenticates via a Windows domain

Using both a username and password, typically checked against a Windows domain controller.

3

Dial-in access is checked

If credentials are correct and dial-in access is granted, the user is allowed onto the VPN.

4

VPN equipment verifies conditions

The VPN gear must securely talk to the RADIUS server and confirm the user meets any additional conditions before granting network access.

📘 Example architecture

VPN Client → Internet → VPN Gateway → DualShield RADIUS Server + DualShield Authentication Server → Corporate Network (Active Directory, HTTP resources).

11 / Connection Protocols

Connecting to a VPN: SSH+PPP, SSL+PPP, and Concentrators

SSH and PPP

PPP and SSH are integrated into kernels that use VPNs, and both work well with dynamic IP addresses. While configuring multiple tunnels to a computer, every tunnel's IP address must be unique. Client and server maintain PPP processes to communicate, and PPP processes exchange data over the SSH connection.

SSL and PPP

PPP running over an SSL connection. SSL provides built-in support for host authentication via digital certificates. Establishing the connection involves an initial handshake for secure communication: "Hello" messages establish SSL version, supported cipher suites, and some random data; the key is determined separately from the handshake; then data is transferred over the link.

Connecting via a Concentrator

The concentrator is an expert mechanism that allows connections from VPN peers, validates its clients, and insists on the VPN's security policies. It reduces the operating cost of VPN administration and encryption from gateways/local hosts.

Configuring the connection: configure the concentrator, set up the client software, and require the client to use that software to use the VPN.

12 / Exam Prep

Exam Tips & Tricks

💡

Site-to-Site = LAN-to-LAN / L2L

Remember these are all the same thing — an exam question might use any of the three names.

Tunnel mode encrypts everything

Tunnel mode = header + payload encrypted. Transport mode = payload only. Tunnel mode is the "fuller" protection.

Trusted VPN ≠ encrypted

A classic trick question: Trusted VPNs (leased circuits, MPLS, ATM, frame-relay) do NOT inherently encrypt data — that's the Secure VPN's job.

⚠️

Star topology's single point of failure

Star topology stops lateral attacks between branches, but if the central hub goes down, ALL branches lose connectivity — a classic trade-off question.

💡

RADIUS handles both AA

RADIUS in a VPN context does Authentication AND Authorization — remember it's not just a password checker.

VPN's 3 core functions

If asked "what makes a VPN a VPN" — the answer is always Encapsulation + Encryption + Authentication, not just encryption alone.

13 / Cheat Sheet

Quick Reference — Everything at a Glance

Topic Key Point
VPN Encrypted tunnel over an insecure network (internet) linking hosts/networks securely.
VPN Architecture Head office concentrator/router ↔ Internet ↔ branch/home office router or PC/laptop with VPN client.
How VPN Works Connect to internet → initiate VPN → authenticate endpoints → gain secure access.
Why build a VPN Extend geographic reach, cut WAN costs, reduce travel time, boost productivity, simplify topology, enable global networking.
VPN Components VPN client, Network Access Server (NAS), Tunnel Terminating Device/VPN server, VPN protocol.
VPN Concentrator Dedicated device/bi-directional tunnel endpoint; encrypts/decrypts, authenticates, manages keys/tunnels/addresses.
Remote-Access (Client-to-Site) VPN Individual hosts (telecommuters) connect to the company network via client software and a VPN gateway.
Site-to-Site VPN Connects whole networks (branch ↔ HQ); AKA LAN-to-LAN/L2L; Intranet-based or Extranet-based.
Hardware VPN Dedicated appliance endpoint connecting multiple LANs (Cisco, SonicWALL, Juniper, WatchGuard).
Software VPN Installed on routers/servers/firewalls; cheap & easy but adds processing load and is less secure.
Selecting a VPN Base decision on compatibility, vendor support, scalability/capacity, need, security, cost.
Encapsulation Wraps the original packet in a new one with a different IP to hide source/destination (PPTP, L2TP, SSH, SOCKS).
Encryption Scrambles packet contents for confidentiality (3DES, SSL, OpenVPN); keys distributed via CA/certificate server.
Authentication Confirms identity before granting access (IPSec, MS-CHAP, Kerberos); failed auth = packet refused + error to sender.
Trusted VPN Leased circuits (ATM/frame-relay/MPLS); controls the path, but not encrypted.
Secure VPN Encrypts traffic end-to-end; protects confidentiality/integrity but doesn't control the transmission path.
Hybrid VPN A Secure VPN segment running inside a larger Trusted VPN.
Hub-and-Spoke Topology Each spoke (branch) tunnels to a central hub (main office); optional secondary hubs for resilience.
Point-to-Point Topology Two peer sites connect directly; only IPsec or IPsec/GRE; either peer can initiate.
Full Mesh Topology Every peer has a unique tunnel to every other peer; redundant, no single bottleneck.
Star Topology Branches connect only to HQ, never to each other; contains breaches but HQ is a single point of failure.
VPN Security Risks Fingerprinting, insecure credential storage, username enumeration, offline cracking, MITM, no account lockout, poor defaults, poor documentation.
Firewalls + VPN Firewall sits between VPN and internet, restricting ports/protocols before implementing a VPN.
IPsec Tunnel Mode Encrypts header + payload (whole packet).
IPsec Transport Mode Encrypts payload only, header stays visible.
AAA Server Authentication (who), Authorization (what allowed), Accounting (what done) — used in remote-access VPNs.
RADIUS Centralized VPN authentication + authorization; VPN server queries RADIUS, which checks against a domain controller/AD.
SSH + PPP PPP processes communicate over an SSH connection; works well with dynamic IPs; each tunnel needs a unique IP.
SSL + PPP PPP over SSL; handshake negotiates version/cipher suite; certificate-based host authentication.
Concentrator connection Configure the concentrator + set up matching client software on the user's machine.