Tunneling Models

## Two shapes of tunnel A **virtual private network** carries private traffic across a network it shares with others, usually the public internet, inside a tunnel whose ends are authenticated and whose contents are usually encrypted. RFC 4110 defines a VPN as a set of sites whose communication with outsiders is restricted while their own traffic crosses infrastructure that others also use. Two architectures cover most deployments, and they differ in **who terminates the tunnel** and **what sits behind each end**. | | Site-to-site | Remote access | |---|---|---| | Ends of the tunnel | gateway to gateway | client device to gateway | | What each end stands for | a whole network, a set of prefixes | one device and the person using it | | Who runs VPN software | only the two gateways | every laptop or phone, plus the gateway | | What is authenticated | the two gateways | the gateway, and the user or device | | Inner addresses | the sites' own subnets, routed | one address the gateway assigns for the session | | Lifetime | usually up continuously | comes and goes with the user's session | ## Site-to-site: two networks joined by gateways RFC 7296, the IKEv2 specification, draws this as its first usage scenario, a **security gateway to security gateway** tunnel: - **Neither host implements the VPN.** A point-of-sale terminal sends to its ordinary default router; routing at the store's gateway steers packets for the data-centre prefixes into the tunnel. - **Each gateway announces the addresses behind it**, so one tunnel carries traffic for many hosts at once. - **Protection covers part of the way**, between the gateways. On each site's LAN the traffic is ordinary, unencrypted traffic. - **The sites route to each other**, so their address ranges must not collide; two sites that both use the same private range cannot simply be joined. ## Remote access: one device joined to a network The same RFC's third scenario is an **endpoint to security gateway** tunnel, typically a roaming laptop connecting back to its corporate network: - The device runs **VPN client software**, and the gateway authenticates a user or device rather than a site. - The client needs an address that belongs to the corporate side, so that replies come back to the gateway and are tunnelled to it. The gateway hands one out for the session, from its own pool or from a DHCP server; in IKEv2 this is done with the **configuration payload**. - Each packet therefore carries two source addresses: the **outer** header holds the address of wherever the laptop is right now, the **inner** header the address the gateway assigned. - The tunnel exists only while the user is connected, so the gateway serves many short-lived sessions rather than a few permanent tunnels. ## One retailer, both models A retailer with 300 stores, two data centres and 2,000 remote staff uses both architectures side by side: 1. Each store's gateway builds site-to-site tunnels to the data centres; every till, scanner and camera reaches the data centres without any VPN setting of its own. 2. The two data centres join each other with a site-to-site tunnel of their own, or a private circuit. 3. The 2,000 staff run a remote-access client that lands on a gateway in either data centre and receives an inner address from that gateway's pool. 4. One gateway platform can serve both roles. What differs is the peer at the far end and whether the tunnel stands for a network or for a person. ## Not the same thing as a provider's VPN service Both models above are tunnels the company builds itself across the internet. RFC 4026, an Informational terminology document, names the other family, **provider-provisioned VPNs**. In a **CE-based** VPN the customer's edge devices do all the VPN work and the provider does not know the traffic is VPN traffic; in a **PE-based** VPN the provider's edge devices keep per-VPN state. A provider service is either a **layer 3 VPN**, which forwards on the customer's IP addresses, or a **layer 2 VPN**, such as a point-to-point virtual wire (VPWS) or an emulated LAN (VPLS). In that vocabulary a company-built site-to-site tunnel is a CE-based layer 3 design in which the company acts as its own provider. ## Common confusions - **A VPN is not end-to-end encryption.** In both models protection ends at the gateway; the hop from the gateway to the server is protected only if something else protects it. - **A remote-access client is not just a site with one host.** The gateway assigns its inner address and authenticates a person, which changes how addresses are planned and how sessions are logged. - **Site-to-site does not need matching subnets.** It needs non-overlapping ones, because the two sides route to each other. - **The two models are not tied to one protocol.** IPsec, TLS-based designs and others can build either; the architecture is a choice about the ends of the tunnel, not about the cipher.