TechKnowSurge
CompTIA Security+ 3.2 ISC2 CISSP 4.3 NIST 800-53 SC-8 NIST CSF PR.DS-02 CompTIA SecurityX 2.3 NIST 800-53 AC-17
TechKnowSurge Catalog Videos VPN
VideoSecurityFree

VPN

A VPN (virtual private network) uses encryption to secure traffic traveling across public networks, making data unreadable to anyone who intercepts it. This content covers how site-to-site and client-to-site VPNs work, along with the protocols that support them.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

A virtual private network (VPN) is a method of securing communications over public internet infrastructure by encrypting traffic so that intercepted data cannot be read or interpreted. While the raw bits traveling across a network remain visible to outside parties, encryption renders the actual content meaningless without the proper decryption keys, making the connection virtually private even though it traverses shared public infrastructure. This concept is foundational to how modern organizations protect sensitive data in transit. Two core VPN architectures address different connectivity needs. A site-to-site VPN links separate physical locations, such as a headquarters and a satellite campus, by encrypting traffic at one network edge device and decrypting it at the other, effectively extending a private network across a public connection. A client-to-site VPN serves remote users who lack dedicated networking equipment, relying instead on software installed on individual machines to establish an encrypted connection back to a corporate firewall or router. The protocols underlying these architectures are also examined. IPsec (Internet Protocol Security) creates an encrypted tunnel by encapsulating packets between two endpoints, and it is commonly used in both site-to-site and client-to-site deployments. Transport Layer Security (TLS) VPNs represent a client-focused alternative but see limited adoption in practice due to their narrower applicability compared to IPsec-based solutions.

What you'll learn

What's covered

Virtual Private Networks (VPN)

Aligned to

CompTIA Security+
3.2 Given a scenario, apply security principles to secure enterprise infrastructure.
ISC2 CISSP
4.3 Implement secure communication channels according to design
NIST 800-53
SC-8 Transmission Confidentiality and Integrity
AC-17 Remote Access
NIST CSF
PR.DS-02 The confidentiality, integrity, and availability of data-in-transit are protected.
CompTIA SecurityX
2.3 Given a scenario, implement appropriate cryptographic protocols and algorithms.

Key terms

Virtual Private Network
VPN
A technology that creates a secure, encrypted tunnel over a public network to protect data in transit.
Encryption
The process of converting readable data into an unreadable format using an algorithm and key to prevent unauthorized access.
Confidentiality
The principle that information is accessible only to those authorized to access it.
IPsec
A suite of protocols that authenticates and encrypts IP packets to provide secure communication over a network.
Transport Layer Security
TLS
A cryptographic protocol that provides secure communication over a network, successor to SSL.
Site-to-Site VPN
A VPN configuration that connects two fixed network locations through an encrypted tunnel over the internet, allowing them to communicate as a single network.
Client-to-Site VPN
A VPN configuration that allows individual client devices using software to securely connect to a remote private network.
Encapsulation
The process of wrapping data with protocol headers as it passes down the layers of the OSI model.

Topics

Vpn Ipsec Tls Encryption Site To Site Vpn Client To Site Vpn Network Security

Transcript

It's great now that we have the internet where we can make cheap and fast connections from site to site or site to user, but we still need to protect that traffic that goes across those public networks. Well, that's where a virtual private network comes into play, or VPN.

What Makes It Virtually Private

Here we have a headquarters for a certain business. What we want to do is we want to connect another site, and we want to also have remote users, so they need to connect into this network. So how can they be a part of that network? We can do that, but how specifically do we make it secure so that way no one else sees that?

Well, the answer to that is encryption. If we encrypt the traffic across here, people still see those bits. They still see the ones and zeros, but what they can't see is what actual data is behind those ones and zeros. That's what makes it virtually private. It's not private. They can see the data, they can see the ones and zeros, but it's virtually private because they can't interpret what those ones and zeros actually mean.

Site-to-Site VPNs

We have a couple main types of VPNs. There's lots of different types of VPNs, but one of the main ones here is a site-to-site VPN. So here we have our headquarters office, and maybe we have some sort of satellite campus right here. But what we need to do is we need to connect those. Users from this side need to access resources over here, and users on this side need to access resources over here. In order to do that, we create a site-to-site VPN. What happens is, as it leaves this router or firewall that we have on this side, it encrypts the traffic, and then it decrypts it when it gets to the other side and then sends it into this network, making it virtually private.

Client-to-Site VPNs

Now, site-to-site VPNs are great if you have some sort of satellite campus, but often we have users that are connecting in from coffee shops or homes, and they don't have the equipment, like a router that can connect to a router, or a firewall that can connect to a firewall, and create that VPN. So in those cases, we might use some sort of client-to-site VPN.

A client-to-site VPN allows a client machine to have software inside of it that encrypts traffic going to this end device here, which is probably a firewall. Actually, I have it represented as routers, which it could be a router, but a lot of times those are firewalls. So this would be a client-to-site VPN.

IPsec Tunnels

One of the ways to do this is with an Internet Protocol Security, or IPsec, tunnel. So we create a tunnel between two devices. For instance, our site to site, what happens is it creates this virtual tunnel, and really that just means it gets encapsulated with this IPsec. So what happens is, as it gets to here, it gets encrypted and gets encapsulated with this IPsec, gets sent over, and then decrypted and sent into this network. So it is a protocol that's used to secure this by encrypting it.

TLS VPNs

There's also a transport layer security, or TLS, VPN. A TLS VPN I don't see near as common out there. It is for clients really. You wouldn't really do it for a site-to-site VPN. So it's on the clients, and it's very limited, which is one of the reasons why I have not seen a lot of this TLS VPN.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →