Loading AI tools
Extension of a private network across a public one From Wikipedia, the free encyclopedia
Virtual private network (VPN) is a network architecture for virtually extending a private network (i.e. any computer network which is not the public Internet) across one or multiple other networks which are either untrusted (as they are not controlled by the entity aiming to implement the VPN) or need to be isolated (thus making the lower network invisible or not directly usable).[1]
A VPN can extend access to a private network (one that disallows or restricts public access to some of its resources) to users who do not have direct access to it, such as an office network allowing secure access from off-site over the Internet.[2] This is achieved by creating a link between computing devices and computer networks by the use of network tunneling protocols.
It is possible to make a VPN secure to use on top of insecure communication medium (such as the public internet) by choosing a tunnelling protocol which implements the necessary security features to guarantee confidentiality and integrity. This kind of VPN implementations have the benefit of reduced costs and greater flexibility, with respect to dedicated communication lines, for remote workers.[3]
The term VPN is also used to refer to commercial network proxy services which sell access to their own proxy networks by connecting their customers by means of VPN protocols.
The goal of a virtual private network is to allow network hosts (PCs, servers, etc.) to exchange network messages across another network to access private content, as if they were part of the same network. This is done in a way that makes crossing the intermediate network completely transparent from a certain communication layer upwards.[1]
Users of a network connectivity service may consider such an intermediate network to be untrusted, since it is controlled by a third-party, and might prefer a VPN implemented via protocols that protect the privacy of their communication.[2]
In the case of a Provider-provisioned VPN, the goal is not to protect against untrusted networks, but to isolate parts of the provider's own network infrastructure in virtual segments, in ways that make the contents of each segment private with respect to the others. This situation makes many other tunneling protocols suitable for building PPVPNs, even with weak or no security features (like in VLAN).[1]
The ways a VPN actually works depends on which technologies and protocols the VPN is built upon. A tunneling protocol is used to transfer the network messages from one side to the other. Their goal is to take network messages from applications (operating at OSI layer 7) on one side of the tunnel and replay them on the other side, as if they virtually substitute the lower network or link layers. Applications do not need to be modified to let their messages pass through the VPN, because the virtual network or link is made available to the OS.
Applications that do implement tunneling or proxying features for themselves without making such features available as a network interface, are not to be considered VPN implementations but may partially match same or similar end-user goal of exchanging private contents towards a remote network (like intranet browsing via an authenticated proxy).
Virtual private networks configurations can be classified depending on the purpose of the virtual extension, which makes different tunneling strategies appropriate for different topologies:
In the context of site-to-site configurations, the terms intranet and extranet are used to describe two different use cases.[4] An intranet site-to-site VPN describes a configuration where the sites connected by the VPN belong to the same organization, whereas an extranet site-to-site VPN joins sites belonging to multiple organizations.
Typically, individuals interact with remote access VPNs, whereas businesses tend to make use of site-to-site connections for business-to-business, cloud computing, and branch office scenarios. However, these technologies are not mutually exclusive and, in a significantly complex business network, may be combined to enable remote access to resources located at any given site, such as an ordering system that resides in a data center.
Apart from the general topology configuration, a VPN may also be characterized by:
A variety of VPN technics exist to adapt to the above characteristics, each providing different network tunneling capabilities and different security model coverage or interpretation.
Operating systems vendors and developers do typically offer native support to a selection of VPN protocols which is subject to change over the years, as some have been proven to be unsecure with respect to modern requirements and expectations, and some others emerged.
Desktop, smartphone and other end-user device operating systems do usually support configuring remote access VPN from their graphical or command-line tools.[5][6][7] However, due to the variety of, often non standard, VPN protocols there exists many third-party applications that implement additional protocols not yet or no more natively supported by the OS.
For instance, Android lacked native IPsec IKEv2 support until version 11,[8] and people needed to install third-party apps in order to connect that kind of VPNs, while Microsoft Windows, BlackBerry OS and others got it supported in the past.
Conversely, Windows does not support plain IPsec IKEv1 remote access native VPN configuration (commonly used by Cisco and Fritz!Box VPN solutions) which makes the use of third-party applications mandatory for people and companies relying on such VPN protocol.
Network appliances, such as firewalls, do often include VPN gateway functionality for either remote access or site-to-site configurations. Their administration interfaces do often facilitate setting up virtual private networks with a selection of supported protocols which have been integrated for an easy out-of-box setup.
In some cases, like in the open source operating systems devoted to firewalls and network devices (like OpenWrt, IPFire, PfSense or OPNsense) it is possible to add support for additional VPN protocols by installing missing software components or third-party apps.
Similarly, it is possible to get additional VPN configurations working, even if the OS does not facilitate the setup of that particular configuration, by manually editing internal configurations of by modifying the open source code of the OS itself. For instance, pfSense does not support remote access VPN configurations through its user interface where the OS runs on the remote host, while provides comprehensive support for configuring it as the central VPN gateway of such remote-access configuration scenario.
Otherwise, commercial appliances with VPN features based on proprietary hardware/software platforms, usually support a consistent VPN protocol across their products but do not open up for customizations outside the use cases they intended to implement. This is often the case for appliances that rely on hardware acceleration of VPNs to provide higher throughput or support a larger amount of simultaneously connected users.
Whenever a VPN is intended to virtually extend a private network over a third-party untrusted medium, it is desirable that the chosen protocols match the following security model:
VPN are not intended to make connecting users neither anonymous nor unidentifiable from the untrusted medium network provider perspective. If the VPN makes use of protocols that do provide the above confidentiality features, their usage can increase user privacy by making the untrusted medium owner unable to access the private data exchanged across the VPN.
In order to prevent unauthorized users from accessing the VPN, most protocols can be implemented in ways that also enable authentication of connecting parties. This secures the joined remote network confidentiality, integrity and availability.
Tunnel endpoints can be authenticated in various ways during the VPN access initiation. Authentication can happen immediately on VPN initiation (e.g. by simple whitelisting of endpoint IP address), or very lately after actual tunnels are already active (e.g. with a web captive portal).
Remote-access VPNs, which are typically user-initiated, may use passwords, biometrics, two-factor authentication, or other cryptographic methods. People initiating this kind of VPN from unknown arbitrary network locations are also called "road-warriors". In such cases, it is not possible to use originating network properties (e.g. IP addresses) as secure authentication factors, and stronger methods are needed.
Site-to-site VPNs often use passwords (pre-shared keys) or digital certificates. Depending on the VPN protocol, they may store the key to allow the VPN tunnel to establish automatically, without intervention from the administrator.
A virtual private network is based on a tunneling protocol, and may be possibly combined with other network or application protocols providing extra capabilities and different security model coverage.
Trusted VPNs do not use cryptographic tunneling; instead, they rely on the security of a single provider's network to protect the traffic.[24]
From a security standpoint, a VPN must either trust the underlying delivery network or enforce security with a mechanism in the VPN itself. Unless the trusted delivery network runs among physically secure sites only, both trusted and secure models need an authentication mechanism for users to gain access to the VPN.[citation needed]
Mobile virtual private networks are used in settings where an endpoint of the VPN is not fixed to a single IP address, but instead roams across various networks such as data networks from cellular carriers or between multiple Wi-Fi access points without dropping the secure VPN session or losing application sessions.[28] Mobile VPNs are widely used in public safety where they give law-enforcement officers access to applications such as computer-assisted dispatch and criminal databases,[29] and in other organizations with similar requirements such as field service management and healthcare.[30][need quotation to verify]
A limitation of traditional VPNs is that they are point-to-point connections and do not tend to support broadcast domains; therefore, communication, software, and networking, which are based on layer 2 and broadcast packets, such as NetBIOS used in Windows networking, may not be fully supported as on a local area network. Variants on VPN such as Virtual Private LAN Service (VPLS) and layer 2 tunneling protocols are designed to overcome this limitation.[31]