Remote access

Remote Work and Remote Access

In today's age, remote work is a huge part of our life. Many of us have now switched to being fully remote, and COVID only accelerated this progress of going to remote work. But somehow you do need to have remote access, a way to be able to access networks and to be able to access that network securely.

Connecting Business Sites

Businesses can exist in many different buildings, in many different cities, and even in many different countries. And so you need a way to be able to connect a business site all together — all the different sites of the business connected together so they can communicate.

So here's an example that I have right here. This is a business, and we have a couple networks down here. Let's talk about those connections first. Quite often what a business will do is they'll pay an internet service provider to provide a connection between their businesses, if it's a far enough distance where they don't have a direct connection between these two buildings, or between two cities, or whatever the case may be. And so they will pay for these connections in between, and it will act as if they are on their own network. And that's fine, and that works for a lot of cases.

But what happens is it can get spendy, and the further you go out the more expensive this setup can be. To lease a line between a couple buildings in the same city might not be that much, but to lease a line going clear across the country can be really expensive. And so we can utilize the internet, but the problem is connecting sites. So we have another site here that we want to connect, and to connect these different sites through the internet can be insecure.

What a VPN Is

Well, that's where a VPN comes in, or a virtual private network. So it is saying it's virtually private. It's not really private — you're going across public connections here — but it's virtually private, and it's virtually private because it is encrypted. And so that's what a VPN is.

And so a VPN will be able to tunnel traffic from these different networks to the main network here, so that way it's secure going across the internet. And what this does is there's some cost savings to this, because you don't have to lease lines. There's some security involved in this because the lines are encrypted. And it's scalable, because no matter how many remote sites — like we saw with COVID, then a lot of people started working from home. So this allows more and more people to do that, because they can VPN into their network and they can work remotely.

Site-to-Site VPNs

So one of the types of VPNs is a site-to-site VPN. A site-to-site VPN connects two different sites together with a VPN connection. And so what I have here is I have a site that's right here that I want to connect to another site. And perhaps this site is on the other side of the country, or perhaps it's even in another country, and I want to connect it through the internet. And so what I'm going to do is I'm going to program either the routers or firewalls — a lot of times we set up the VPN connections through a firewall — and then what we are going to do is then have that traffic get tunneled through the internet, and it creates what we call a tunnel between these two connections.

What a tunnel looks like is it's just taking the packets that need to be routed from this network to this network. It's taking those packets, it's encrypting those packets, and then it's encapsulating those packets, and then sending it along its way. And so it encrypts those packets, sends it along its way, and then this router right here will then decrypt it and send it into the network. And vice versa: when there's a reply, it will hit this router, this router will recognize that it needs to go to this site down here, will encrypt that traffic and then tunnel it to this router right here. And then that router will then unencrypt that traffic and send it to where it needs to go.

And now you have communication across internet, which it can be fairly cheap to tunnel traffic across the internet. But you're still doing it in a secure manner, because the communication that happens between these two networks is all encrypted.

Client-to-Site VPNs

Another type of connection is a client-to-site VPN. And as the name suggests, it's going to be a client machine that's going to connect into this network right here. So where a site to site would be more of like two static sites that you want to connect and tunnel the traffic, this is the same thing, but it's for your users who are remote. And so they may be at their home network, they may be at a coffee shop, they may be somewhere on the road. And so what they need to do is they need a remote into the company network. And so what they'll do is they'll do a VPN connection into the network, so that then it's like they are on the network.

So in both these cases it's like being on the network, like it's just all one continuous network. And so that happens by having a way to connect from your client machine and connect into usually a firewall, sometimes a router, so that way you can connect into this network right here.

IPsec and SSL

When we are making a client-to-site connection, there's a couple ways we can do this. One is using IPsec and the other one is using SSL.

So when we say we're using IPsec, what that means is we're using a client, and a client is then tunneling that traffic back to the main network, and it's using IPsec, a network layer protocol, to do that. And so it's encrypting that traffic at the network layer. And so what that means is that's like that client is sitting directly on the network, and it can do whatever you would be able to do, for the most part, as if you were on that network. So the application support for it is pretty extensive, and the authentication strength is strong, and the complexity is medium. It does require that client.

This other method uses SSL. Well, really what it's using is your browser, so it's using through HTTPS to make the connection. So all you need for this is you just need a browser, so the complexity to set this up is pretty low. And when I say SSL, well, technically it's actually TLS now, but you'll see this explained as SSL. So this at the connection layer, it's through the application, which makes it a little more limited. So although the setup is easy, because you don't have this extra client, there's some limitations to what you're able to do when you're on this.

But those are the two different types: this IPsec with a client, or this SSL using your browser.

Split Tunnel

When you're having clients connect, you can also choose whether you want to have split tunnel or not. What split tunnel means is that this machine right here can route all of its traffic through the VPN back to the main network, back through the main office. But the disadvantage to this is if this is trying to go out to the internet and it routes everything back to this main network, then this network has to go and grab the information, it comes back to here, and then it comes back to this computer. It's a pretty long trip, rather than this going directly there. So what split tunnel does is allows some of the internet traffic to go out to the internet, while anything that's going back to the headquarters or the main office can go back to the main office. So it's split. It splits the traffic, hence the name split tunnel.

Other Remote Connections

Another way a machine can access resources on the network is by making a remote connection. And there's several ways that it could do this. So if this machine needed to access resources, what it can do is it actually can connect to another machine and then use that machine to connect to other devices on the network.

So some ways that we can do this is through something like an RDP connection, a remote desktop protocol connection. So largely this is associated with Windows, but it can connect into this machine.

Another thing that we could do is something like VNC, or virtual network computing. It's another protocol that we can use to connect from one machine to another in order to remote into that network.

If there is a machine that maybe is a Linux machine, we could use something like SSH and SSH into that machine. So that way we can control other machines on that network as well and remote into that network.

There is also virtual desktops. So we can have servers that are running virtual desktops on, and maybe it's running a whole series of virtual desktops on the network, and you remote into one of those virtual desktops. So that way then you have access to the network. And there's some real advantages to setting up virtual desktops and being able to remote into your network via virtual desktop.