Virtual Private Networks (VPNs) use encryption over public internet connections to create secure, private communication between networks or individual users and a network. They offer a cost-effective, scalable alternative to leased physical lines for both site-to-site and remote access connectivity.
Virtual Private Networks (VPN)
At this point we have already talked a lot about tunnels, and we have talked about encrypting the traffic so that it is secure. Essentially, that is a virtual private network. It is creating a network, and it is virtually private because it is encrypted between the two. However, there are a few nuances that we need to know about VPNs and what they look like.
Originally, if they wanted to connect two of their sites together, what they would have to do is lease the lines in between. They would actually have access to the physical lines in between the two networks, and they would set it up. You can get leased lines even to this day. In fact, there is something called dark fiber, where when a company lays down fiber they will lay down a lot of strands of fiber, and then you could lease one of those fibers to have connectivity between your two sites. However, this can be very expensive.
To support remote users, what you would have is a server with a bank of modems on it, and these users would call into one of the modems and connect to the server to gain access to the network.
Over time the internet became more and more popular. Companies were connecting their businesses to the internet, and the same thing with home users, who were connecting more and more to the internet as well. So now we have this connectivity through the internet that we can get to so many more machines, but the problem is now security. Any traffic that is being sent back and forth between these different sites can cause a problem, because it can be seen by anybody who has access to the internet and can see the traffic going across the internet.
The solution for this is VPNs. VPNs allow us to use the internet and other unsecure connections but still link two networks together. So we create essentially one network here, that is the network part of this, and it is virtually private. It goes across public lines, but it is virtually private because it is encrypted.
The first benefit is just the cost. These companies and users already have access to the internet, so it is using a connection that is already there and you do not have to lease extra lines in order to create secure communication.
They are also more secure, because even if we were to lease lines, the idea is that no one else has access to those lines, but somebody could tap into the lines and start listening to conversations. So even if we lease lines nowadays, we probably still want to encrypt that traffic and create a VPN there.
It is also very scalable, because we can really quickly adapt. We can go from coffee shop to coffee shop and town to town and still have connectivity into the site no matter where we are at.
Then there is also compatibility. With leased lines you are kind of stuck with whatever leased lines are available to you, but when we have something like a VPN it does not matter what type of connectivity we have, we can create that VPN connection across it for that secure communication.
There are a couple of different VPN types. One of them is site to site. If a company has two sites here and they want to connect them together, that would be considered a site-to-site VPN connection. A remote access connection would be just an end user that needs to connect into the network, and in this case there is a client and there is a clientless type, where you can connect in to the company network.
There are actually quite a few different ways that we can set up VPNs, but really the two primary ways that we secure the communication are either through IPsec or SSL/TLS. With IPsec, as we saw in another video, we add a layer three header to what already exists, at least when we are in our tunnel mode. In tunnel mode, which is the more common of the two, we add this extra header to this and we encrypt this part of the packet.
SSL/TLS works quite a bit differently. It encrypts it at the payload area right here, so it is a transport layer security, and it does it at this upper application layer. It does not do it at this lower layer right here.
Typically what we see is that when we are creating a site-to-site VPN we will use IPsec for that. However, if we are going from a remote user to a site, then typically that would be set up as an SSL/TLS connection.
Let us get a little more into what a remote connection looks like. Let us say we have a user offsite that needs to connect into the network, and these two sites have a site-to-site VPN, but this remote user needs access. So how do we get remote access?
One way is we could set up a client on the machine. We would install a little client here, and perhaps they have to manually sign into that, so they would open up the client, they would log into the client, and then it would make a connection to the end user. A lot of times that is done through SSL/TLS.
There is also a clientless method, and that would be where you are not installing an extra client on the machine. Instead, you bring up a browser, and within the browser it would make a connection. It is very limited on what you can use with this, because everything is done through that browser, so it has to be done through the standard HTTPS protocol, which uses SSL/TLS. So if you are using the clientless method, then it is definitely the SSL/TLS method of connecting, but you do not have to install software on the machine.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →