English
Русский
In this article, we explain what VPN tunnels are, how they work, and what types of tunneling exist.
In this article, we explain what VPN tunnels are, how they work, and what types of tunneling exist.
In our technologically advancing era, where more and more information is transmitted over networks, the threat of data leaks is increasingly common. Therefore, it is crucial to ensure secure data transmission between two or more network nodes.
A working solution is to use VPN tunneling technology, which allows you to establish an encapsulated network connection between two network nodes. In this article, we will explore what VPN tunnels are, how they work, and the different types of tunneling.
A VPN tunnel is a network connection for secure data transmission between two or more remote nodes over the internet.
When a user connects to a VPN tunnel, all network communication occurs within it, creating a secure channel for data exchange between remote nodes.
Inside a VPN tunnel, data is packed into special packets and transmitted over a secure channel, as if it were moving through a physical connection, such as Ethernet. This makes it impossible to view or alter the data during transmission between devices. That is, during the process, packets are encrypted to exclude unauthorized access by malicious actors.
Take the test and receive a selection of useful materials for further study.
There are several tunneling protocols (e.g., GRE, ICMP, or IP in IP) that can be used to set up VPN tunnels. The choice depends on your goals, encryption strength requirements, and computational complexity.
Additionally, a VPN tunnel can operate in several modes — "data transmission between two networks" and "securing remote access to internal network resources".
This mode is used to connect local area networks over the internet. This approach can be useful for organizing connectivity between company branches. In this case, each end of the tunnel must be configured to connect to a specific network.
This mode is suitable for creating a secure and encrypted channel between a single device — typically a computer or smartphone — and an internal network that is usually not directly accessible. This approach is useful for remote work when employees need access to internal company resources, or for connecting to a home network from different locations. In this mode, the remote client must be configured to connect to the network via a VPN tunnel.
There are several types of VPN tunneling, each performing specific functions in data protection and connection setup:
The choice between split and full tunneling depends on several factors, including the required security level, the need to manage network bandwidth, and overall network performance. If data security is a priority, full tunneling is preferable. If it is necessary to preserve network bandwidth while ensuring the security of certain connections, split tunneling is the better choice.
When it comes to encryption in VPNs, it is important to distinguish between encryption algorithms and cipher types. In fact, the former refers to the methods of data transmission within the VPN tunnel. The cipher itself can be one of the encryption algorithms, but not vice versa. Let's take a closer look at each of these entities.
One of the main requirements of VPN technology is high-quality data encryption to protect user information during transmission over the internet. Traditional standards include symmetric and asymmetric encryption.
Symmetric encryption uses the same key for both encrypting and decrypting information. In the case of VPN technologies, the client and server exchange a single encryption key, so all transmitted data can be encrypted and decrypted using it. Symmetric encryption provides fast and efficient data encryption, making it the most common method.
However, symmetric encryption is less secure than asymmetric encryption because it uses the same key. If a malicious actor gains access to it, all data can be easily read.
Asymmetric encryption, on the other hand, uses two keys — a public key and a private key. The former can be distributed freely and is used for encryption, while the latter is used for decryption and remains confidential.
Asymmetric encryption provides a higher level of security than symmetric encryption. However, it is less efficient and often requires more resources for encrypting and decrypting data.
The choice of algorithm depends on the company's needs and the level of security it wants to provide for its users. Often, VPN services combine both methods.
AES (Advanced Encryption Standard). This is one of the most common and reliable symmetric encryption methods. It uses the same key for encrypting and decrypting data and encrypts data in 128-bit blocks. AES also has other key length variants — AES-128, AES-192, and AES-256. The latter is considered the most reliable and is often used in VPN services.
ChaCha20 and Poly1305. ChaCha20 is a relatively new stream cipher method developed to provide higher performance and tunneling security. Combined with the Poly1305 MAC function, this method provides a high-speed and reliable way to encrypt data. ChaCha20 and Poly1305 use a 256-bit key.
Blowfish and Twofish. Blowfish is a symmetric block cipher developed in 1993. Twofish is its successor, focused on security and performance. Both methods use encryption with variable key lengths, 64-bit blocks, and various block cipher modes.
3DES (Triple Data Encryption Standard). This is a symmetric encryption method that uses three keys. It is no longer considered secure and is outdated, but it is still used in some VPN services.
RSA (Rivest-Shamir-Adleman). This is an asymmetric encryption method that uses two keys — a public key and a private key. It is used to create encrypted tunnels for secure data exchange. RSA is more secure but slower compared to symmetric methods. This is especially noticeable when using longer keys.
MPPE (Microsoft Point-to-Point Encryption). This is a symmetric encryption method developed to work with PPTP (Point-to-Point Tunneling Protocol) connections. It uses a 40-bit or 128-bit key to encrypt data.
Camellia. This is a symmetric encryption method often considered an alternative to AES. It uses a key length from 128 to 256 bits and encrypts data in 128-bit blocks. Camellia is considered one of the most secure encryption methods.
Most modern VPN services combine several encryption methods to ensure maximum data protection while maintaining high performance.
VPN works by using various tunneling protocols that encode all data sent over the internet and ensure its security. These tunneling protocols can use different encryption and connection establishment methods, as well as support different security levels.
PPTP is one of the oldest and most common protocols for creating VPN tunnels. It is supported by many operating systems, including Windows, macOS, and Linux. It is a symmetric protocol that uses MPPE encryption to protect data transmitted through the tunnel.
PPTP can be faster than some other protocols, but it is not considered the most secure, as it has been compromised in the past. PPTP should only be used when other protocols are unavailable or unsuitable for specific needs.
L2TP is more secure than PPTP. It is supported by almost all operating systems. It uses asymmetric RSA encryption and 256-bit key encryption. L2TP provides a high level of security, but it can be slower than other protocols.
IPSec is a tunneling protocol that can work with both symmetric and asymmetric encryption. It can ensure a high level of security: IPSec encrypts data with a key of up to 256 bits. However, it can be complex to configure and have low performance on some devices.
It combines the advantages of PPTP, L2TP, and IPSec, providing a high level of security and performance. OpenVPN can use AES-256 for data encryption with support for both symmetric and asymmetric encryption. It also supports data compression.
This is one of the fastest and most secure protocols for creating VPN tunnels. IKEv2 is particularly well-suited for mobile devices, as it supports fast reconnection between network interfaces — for example, between Wi-Fi and mobile data. The protocol can be customized — for instance, by choosing the appropriate encryption algorithm.
This is a relatively new tunneling protocol that has already established itself as a fast and lightweight option. WireGuard uses symmetric encryption and supports various authentication and encryption methods, including ChaCha20 and Poly1305. This protocol can run on most modern operating systems, including Windows, macOS, Linux, Android, and iOS.
This protocol was developed specifically for Windows and uses SSL encryption to create a secure tunnel. SSTP can be used to connect to VPN servers via an HTTP proxy, making it an ideal option for the office. Despite its security, this protocol is quite slow.
The choice of protocol depends on security, performance, and availability requirements. In most cases, OpenVPN and IKEv2 are sufficient, as they provide high security and fast connections. PPTP and L2TP can be slightly faster but are less secure, while IPSec and SSTP have more configuration requirements. WireGuard can also be called a good option for creating mobile VPN tunnels due to its speed.
A VPN can be used in both personal and corporate environments. Let's consider the most popular use cases.
Essentially, the personal sphere includes all the scenarios we discussed earlier: from organizing a secure connection to Wi-Fi networks and bypassing restrictions to ensuring privacy on the internet.
However, a VPN can also be used, for example, to securely connect to a home network from anywhere in the world. This is especially useful if you have your own cloud for file storage.
In the corporate sphere, a VPN can be used for remote access — for example, to internal resources. Employees working from home can connect to the office network via a secure connection.
Also, with the help of a VPN, you can set up connectivity between company branches and ensure access to foreign SaaS services. The latter is especially relevant when it is important to protect the personal data of employees.
To protect network traffic or ensure the security of personal data, let's consider the main ways to organize a VPN.
There are two options — using your own server or renting a solution from a provider. Each has its own advantages and disadvantages, and the choice depends on the specific needs and capabilities of the user.
Creating a tunnel on your own server is a more flexible and cost-effective option in the long run for organizing a VPN. This requires installing special software on the server. If the server is your own, you can customize access policies, choose encryption protocols, and more according to your needs.
An accessible and simple way to organize a VPN is to rent a server from a provider. When choosing a VPN provider, it is necessary to consider:
VPN providers offer a simple way to organize a VPN. You don't necessarily need to understand infrastructure equipment — everything is already configured for you.