VPN ~ Nexwrx, LLP

Virtual Private Network

VPNs, Virtual Private Networks, are commonly requested by all types of different companies. Applications to be used by a particular company simply don’t require any specific QoS (Quality of Service) or the latencies demanded don’t need to be extremely low. In some occasions they may be looking to backup their primary MPLS (Short for Multiprotocol Label Switching) network through IPsec, which will transmit over the public internet but always keeping the data safe and secure, key demands for all businesses. In all situations it may be interesting to implement a VPN.

As a VNO, we are constantly requested to provide internet access in hundreds of countries around the globe. Most of these international connection requests are meant to be used with an IPsec (Internet Protocol Security) router laying behind with the idea of creating a VPN between two or more international delegations. The concept VPN is therefore extremely important to comprehend.

A Virtual Private Networks extends a private network and the resources contained in the network across public networks like the Internet. It enables a host computer to send and receive data across shared or public networks as if it were a private network with all the functionality, security and management policies of the private network.

This is done by establishing a virtual point-to-point connection through the use of dedicated connections, encryption, or a combination of the two. The VPN connection across the Internet is technically a wide area network (WAN) link between the sites but appears to the user as a private network link—hence the name "virtual private network".

Nexwrx can setup VPN access for your business and connect you through access points for home or mobile connection so that you can access your business computer and files, regardless of where you are.

Types of VPNs

VPNs can be either remote-access (connecting an individual computer to a network) or site-to-site (connecting two networks together). In a corporate setting, remote-access VPNs allow employees to access their company's intranet from home or while traveling outside the office, and site-to-site VPNs allow employees in geographically separated offices to share one cohesive virtual network. A VPN can also be used to interconnect two similar networks over a dissimilar middle network; for example, two IPv6 networks over an IPv4 network.

VPN systems can be classified by

the protocols used to tunnel the traffic

the tunnel's termination point, i.e., customer edge or network-provider edge

whether they offer site-to-site or remote-access connectivity

the levels of security provided

the OSI layer they present to the connecting network, such as Layer 2 circuits or Layer 3 network connectivity

Security Mechanisms

VPNs typically require remote access to be authenticated and make use of encryption techniques to prevent disclosure of private information. VPNs provide security through tunneling protocols and security procedures such as encryption. Their security model provides:

Confidentiality such that even if traffic is sniffed, an attacker would only see encrypted data which they cannot understand

Allowing sender authentication to prevent unauthorized users from accessing the VPN

Message integrity to detect any instances of transmitted messages having been tampered with

Secure VPN protocols include the following

IPSec (Internet Protocol Security) was developed by the Internet Engineering Task Force (IETF), and was initially developed for IPv6, which requires it. This standards-based security protocol is also widely used with IPv4. Layer 2 Tunneling Protocol frequently runs over IPSec. Its design meets most security goals: authentication, integrity, and confidentiality. IPSec functions through encrypting and encapsulating an IP packet inside an IPSec packet. De-encapsulation happens at the end of the tunnel, where the original IP packet is decrypted and forwarded to its intended destination.

Transport Layer Security (SSL/TLS) can tunnel an entire network's traffic, as it does in the OpenVPN project, or secure an individual connection. A number of vendors provide remote access VPN capabilities through SSL. An SSL VPN can connect from locations where IPsec runs into trouble with Network Address Translation and firewall rules.

Datagram Transport Layer Security (DTLS), is used in Cisco AnyConnect VPN, to solve the issues SSL/TLS has with tunneling over UDP.

Microsoft Point-to-Point Encryption (MPPE) works with the Point-to-Point Tunneling Protocol and in several compatible implementations on other platforms.

Microsoft's Secure Socket Tunneling Protocol (SSTP), introduced in Windows Server 2008 and in Windows Vista Service Pack 1. SSTP tunnels Point-to-Point Protocol (PPP) or Layer 2 Tunneling Protocol traffic through an SSL 3.0 channel.

MPVPN (Multi Path Virtual Private Network). Ragula Systems Development Company owns the registered trademark "MPVPN".

Secure Shell (SSH) VPN - OpenSSH offers VPN tunneling (distinct from port forwarding) to secure remote connections to a network or inter-network links. OpenSSH server provides a limited number of concurrent tunnels and the VPN feature itself does not support personal authentication.

Authentication

Tunnel endpoints must authenticate before secure VPN tunnels can be established.

User-created remote access VPNs may use passwords, biometrics, two-factor authentication or other cryptographic methods.

Network-to-network tunnels often use passwords or digital certificates, as they permanently store the key to allow the tunnel to establish automatically and without intervention from the user.

VPNs in Mobile Environments

Mobile VPNs are used in a setting where an endpoint of the VPN is not fixed to a single IP address, but instead roams across various networks such as data networks from cellular carriers or between multiple Wi-Fi access points. Mobile VPNs have been widely used in public safety, where they give law enforcement officers access to mission-critical applications, such as computer-assisted dispatch and criminal databases, while they travel between different subnets of a mobile network.

They are also used in field service management and by healthcare organizations, among other industries. Increasingly, mobile VPNs are being adopted by mobile professionals and white-collar workers who need reliable connections. They are used for roaming seamlessly across networks and in and out of wireless-coverage areas without losing application sessions or dropping the secure VPN session. A conventional VPN cannot survive such events because the network tunnel is disrupted, causing applications to disconnect, time out, or fail, or even cause the computing device itself to crash.

Instead of logically tying the endpoint of the network tunnel to the physical IP address, each tunnel is bound to a permanently associated IP address at the device. The mobile VPN software handles the necessary network authentication and maintains the network sessions in a manner transparent to the application and the user.