VPNs

IB Standards

3.1.4 Technologies required to provide a VPN
3.1.5 Evaluate the use of a VPN

VPNs help make a “tunneled” network connection through the internet or any other kind of network. In this problem set you will be creating a VPN tunnel by using the ngrok service. Your computer will host a server at a port and you will allow ngrok to create a tunnel to that port. This will let your client app be able to connect to your server. Anyone else from anywhere in the world will be able to connect to your server!

A VPN lets any device exchange data across the internet. The devices don’t know where the network is, as far as they know they could be within the network they are connecting to or they could be across the world. Technically, a VPN could let any device access all of your files and information, if there are no security measures in place.

Secure VPN

For secure VPNs all traffic must be encrypted, authenticated and then sent along virtual tunnels. By default, ngrok creates tunnels that are unsecured. This is not a huge problem while we do our problem set but in a real application you would want to use secure tunnels.

Two types of secure VPN technologies are:

• Internet protocol security (IPSec) which functions in both transport and tunnel mode:
  • allows the secure transmission of data over public IP-based networks
  • uses a standard encryption algorithm to provide confidentiality (AES)
• Secure Sockets Layer (SSL) 3.0 or Transport Layer Security (TLS) with encryption.
  • These are much simpled than IPSec. They use technology that doesn’t require special client software.
  • The tunnel itself is encrypted rather than have to use special software to encrypt information and send over a tunnel(IPSec).

To create a secure tunnel with ngrok you can specify TLS as the encryption method:

ngrok tls -hostname=app.example.com 443

Trusted VPN and Hybrid VPN

Some connections use private circuits leased from a trusted communications provider: alone, this is called a trusted VPN. Other connections send encrypted traffic over the public Internet: alone, this is called a secure VPN. Using a secure VPN over a trusted VPN is called a hybrid VPN.

Trusted VPNs can be separated into two “layer2” and “layer 3” VPNs.

There are some technologies needed for layer 2 VPNs, which cause applications to think that they are in the same physical location:

• Asynchronous Transfer Mode (ATM) circuits
• Frame relay circuits
• Transport of layer 2 frames over Multiprotocol Label Switching (MPLS)

There are other technologies needed for layer 3 VPNs (ngrok), which route information over a “tunnel” to another location:

• MPLS with a constrained distribution of routing information through Border Gateway Protocol (BGP).

Finally, all VPNs need to be able to have the same software and hardware requirements:

1. Internet access
2. VPN software
3. VPN routers
4. VPN appliances (software for VPN hardware)
5. VPN concentrators, a single device to handle a large number of incoming VPN tunnels.