A virtual private network (VPN) extends a private network and the resources contained in the network across public networks like the internet. It enables a host computer to send and receive data across shared or public networks by emulating the properties of the private network such as shares, server access, and printers by establishing and maintaining the security and management policies of the private network. This is done by establishing a virtual point-to-point connection through the use of either a dedicated connection or through encryption, or a combination of both.

The VPN connection across the Internet logically operates as a wide area network (WAN) link between the sites. The secure connection across the internetwork appears to the user as a private network communication—despite the fact that this communication occurs over a public internetwork—hence the name virtual private network.

Types of VPN

VPNs can be either remote-access (connecting an individual computer to a network) or site-to-site (connecting two networks together). In a corporate setting, remote-access VPNs allow employees to access their company's intranet from home or while traveling outside the office, and site-to-site VPNs allow employees in geographically separated offices to share one cohesive virtual network. A VPN can also be used to interconnect two similar networks over a dissimilar middle network; for example, two IPv6 networks over an IPv4 network.

VPN systems can be classified by:

• the protocols used to tunnel the traffic
• the tunnel's termination point, i.e., customer edge or network-provider edge
• whether they offer site-to-site or remote-access connectivity
• the levels of security provided
• the OSI layer they present to the connecting network, such as Layer 2 circuits or Layer 3 network connectivity

Security mechanisms

VPNs typically require remote access to be authenticated and make use of encryption techniques to prevent disclosure of private information.

VPNs provide security through tunneling protocols and security procedures such as encryption. Their security model provides:

• Confidentiality such that even if traffic is sniffed, an attacker would only see encrypted data which he/she cannot understand
• Allowing sender authentication to prevent unauthorized users from accessing the VPN
• Message integrity to detect any instances of transmitted messages having been tampered with

Secure VPN protocols include the following:

• IPSec (Internet Protocol Security) was developed by the Internet Engineering Task Force (IETF), and was initially developed for IPv6, which requires it. This standards-based security protocol is also widely used with IPv4. Layer 2 Tunneling Protocol frequently runs over IPSec. Its design meets most security goals: authentication, integrity, and confidentiality. IPSec functions through encrypting and encapsulating an IP packet inside an IPSec packet. De-encapsulation happens at the end of the tunnel, where the original IP packet is decrypted and forwarded to its intended destination.
• Transport Layer Security (SSL/TLS) can tunnel an entire network's traffic, as it does in the OpenVPN project, or secure an individual connection. A number of vendors provide remote access VPN capabilities through SSL. An SSL VPN can connect from locations where IPsec runs into trouble with Network Address Translation and firewall rules.
• Datagram Transport Layer Security (DTLS), is used in Cisco AnyConnect VPN, to solve the issues SSL/TLS has with tunneling over UDP.
• Microsoft Point-to-Point Encryption (MPPE) works with the Point-to-Point Tunneling Protocol and in several compatible implementations on other platforms.
• Microsoft's Secure Socket Tunneling Protocol (SSTP), introduced in Windows Server 2008 and in Windows Vista Service Pack 1. SSTP tunnels Point-to-Point Protocol (PPP) or Layer 2 Tunneling Protocol traffic through an SSL 3.0 channel.
• MPVPN (Multi Path Virtual Private Network). Ragula Systems Development Company owns the registered trademark "MPVPN".
• Secure Shell (SSH) VPN - OpenSSH offers VPN tunneling (distinct from port forwarding) to secure remote connections to a network or inter-network links. OpenSSH server provides a limited number of concurrent tunnels and the VPN feature itself does not support personal authentication.

Authentication

Tunnel endpoints must authenticate before secure VPN tunnels can be established.

User-created remote access VPNs may use passwords, biometrics, two-factor authentication or other cryptographic methods.

Network-to-network tunnels often use passwords or digital certificates, as they permanently store the key to allow the tunnel to establish automatically and without intervention from the user.

Example use of a VPN Tunnel

The following steps  illustrate the principles of a VPN client-server interaction in simple terms.

Assume a remote host with public IP address 1.2.3.4 wishes to connect to a server found inside a company network. The server has internal address 192.168.1.10 and is not reachable publicly. Before the client can reach this server, it needs to go through a VPN server / firewall device that has public IP address 5.6.7.8 and an internal address of 192.168.1.1. All data between the client and the server will need to be kept confidential, hence a secure VPN is used.

1. The VPN client connects to a VPN server via an external network interface.
2. The VPN server assigns an IP address to the VPN client from the VPN server's subnet. The client gets internal IP address 192.168.1.50, for example, and creates a virtual network interface through which it will send encrypted packets to the other tunnel endpoint (the device at the other end of the tunnel). (This interface also gets the address 192.168.1.50.)
3. When the VPN client wishes to communicate with the company server, it prepares a packet addressed to 192.168.1.10, encrypts it and encapsulates it in an outer VPN packet, say an IPSec packet. This packet is then sent to the VPN server at IP address 5.6.7.8 over the public Internet. The inner packet is encrypted so that even if someone intercepts the packet over the Internet, they cannot get any information from it. They can see that the remote host is communicating with a server/firewall, but none of the contents of the communication. The inner encrypted packet has source address 192.168.1.50 and destination address 192.168.1.10. The outer packet has source address 1.2.3.4 and destination address 5.6.7.8.
4. When the packet reaches the VPN server from the Internet, the VPN server decapsulates the inner packet, decrypts it, finds the destination address to be 192.168.1.10, and forwards it to the intended server at 192.168.1.10.
5. After some time, the VPN server receives a reply packet from 192.168.1.10, intended for 192.168.1.50. The VPN server consults its routing table, and sees this packet is intended for a remote host that must go through VPN.
6. The VPN server encrypts this reply packet, encapsulates it in a VPN packet and sends it out over the Internet. The inner encrypted packet has source address 192.168.1.10 and destination address 192.168.1.50. The outer VPN packet has source address 5.6.7.8 and destination address 1.2.3.4.
7. The remote host receives the packet. The VPN client unencapsulates the inner packet, decrypts it, and passes it to the appropriate software at upper layers.

Overall, it is as if the remote computer and company server are on the same 192.168.1.0/24 network.

An image of VPN

WiMAX and VPN

WiMax VPN Service is a broadband connection providing a VPN network delivered wirelessly from the service provider to a location. WiMax VPN access is used by businesses to provide reliable, dedicated service for VPN as well as other applications including Internet, email, file sharing, web hosting, data backup, video, or voice access. WiMax VPN connections are typically used in locations where there isn’t dedicated Internet access available. All WiMax VPN services come with a Service Level Agreement with guarantees on speed, performance, uptime, and repair. A WiMax VPN connection can also be configured to carry Internet, video, or other data services. WiMax VPN service is also known as WiMax Broadband, WiMax Internet, WiMax VOIP, Fixed Wireless Data, Fixed Wireless Broadband, or Fixed Wireless Internet.

WiMax VPN Applications

• Internet Access
• Email
• File Sharing
• Data Backup
• Video
• VOIP
• VPN Access

WiMax VPN Features

• Service Level Agreement - SLA
• Guaranteed Speed
• Static IP’s
• Optional Voice, Video, Data Services

WiMax VPN Service Information

• WiMax VPN
• WiMax Broadband
• WiMax Internet
• WiMax VOIP
• Fixed Wireless Data
• Fixed Wireless Internet
• Fixed Wireless Broadband