In this lesson,
we will learn about Virtual Private Network,
or VPN architecture.
VPN architecture extends access controls
beyond traditional network boundaries.
There are a variety of VPN models such as a client-server,
site-to-site, and always-on VPN.
A client-server VPN establishes a secure tunnel
between an individual device known as a client
and a central server.
This ensures encrypted communication
and network access for remote users.
Next, a site-to-site VPN connects entire network securely,
which allows branch offices or remote sites
to communicate with a central network
as part of the same logical network.
Finally, an always-on VPN is a VPN connection
that is always active,
so it provides continuous, secure access
and enforces access policies consistently,
regardless of the user's location.
Let's learn more about client-server, site-to-site,
and always-on virtual private network configurations.
Then let's analyze a virtual private network
configuration file.
First, we have client-server
virtual private networks, or VPNs.
A client-server VPN connects
an individual client device to a central server
through an encrypted tunnel.
This type of VPN is ideal for remote access,
ensuring that the client can securely connect
to the organization's logical internal network
from any location.
The encryption used in client server VPNs
typically involves protocols
like internet protocol security, or IPsec,
or transport layer security, or TLS.
For example, when a remote employee connects
to an organization's internal network using a VPN
from their laptop, the connection is encrypted,
meaning all data sent between the laptop
and the server is protected from unauthorized access.
The VPN server verifies the identity of the client
through authentication methods
like username-password combinations,
or digital certificates.
Once authenticated, the client has access
to internal network resources such as files, applications,
and databases, just as if they were physically connected
to the corporate network.
Second, we have site-to-site
virtual private networks, or VPNs.
A site-to-site VPN connects two
or more entire networks together such as the network
of a company's headquarters and its branch offices.
This type of VPN operates at the router level,
meaning that the VPN connection is established
between the routers of two networks, not individual devices.
Site-to-site VPNs are typically used
to connect a geographically dispersed offices
over the internet.
The most common protocol used for site-to-site VPNs
is the internet protocol security, or IPsec.
IPsec encrypts and authenticates the data packets
traveling between the sites.
With a site-to-site VPN,
all devices in one network can communicate securely
with devices in the other network,
making it appear logically as if both networks
are part of the same local area network.
This is particularly useful for companies
with multiple office locations that need
to securely share resources such as file servers,
intranet applications, and internal services.
Third and last, we have always-on
virtual private networks, or VPNs.
An always-on VPN is designed
to provide a continuous, uninterrupted connection
between a device and the organization's network.
This type of VPN is typically configured
to automatically establish the VPN connection
whenever the device is turned on,
regardless of where the user is located
or what network they are connected to.
Always-on VPNs are often used in environments
where security is critical such as government
or healthcare organizations.
The continuous connection ensures
that any traffic between the user's device
and the corporate network is always encrypted.
This can be accomplished using technologies
like the internet protocol security, or IPsec,
and transport layer security, or TLS.
Always-on VPN connections can also integrate
with multifactor authentication
to verify the user's identity
each time the connection is made.
For example, an employee who moves between the office,
home or a public wifi network
will always have a secure connection
to the company's resources
without having to manually reconnect
or worry about unprotected data transmission.
Always-on VPNs also often include network access control
to verify the security posture of the device
before allowing full access to network resources.
Now, let's look at and analyze
an always-on open VPN virtual private network
configuration file for an organization
called ConnectUSCorp.
Open on the screen in a notepad is our configuration file.
Let's analyze some of its main parts.
The first line specifies that this configuration file
is for a VPN client.
In a VPN setup, the client is the device
that connects to the VPN server.
By designating the configuration as client,
the open VPN software knows that this is for connecting
to a VPN server, not setting one up.
The second line, dev tun indicates
that the VPN will create a virtual network interface
of type tun, which is a tunnel interface.
A tunnel interface is a virtual network layer device
that operates at the network layer
and routes IP packets through the VPN tunnel.
The third line defines the address, protocol,
and port number used to connect
to the ConnectUSCorp VPN server.
Line five, resolve-retry infinite specifies
that the client should keep retrying
to resolve the server's domain name indefinitely
in case the connection fails, or there is a DNS issue.
This helps attempt to always make a connection.
Line six, nobind tells the client to not bind
to a specific local port when making the connection.
This allows open VPN to use any available port,
which is useful in client scenarios
because the client typically does not need to listen
for incoming connections.
Now, let's scan through the rest of the configuration file
and highlight just a few other things.
Persist-key and persist-tun help maintain the VPN connection
in case of network disruptions or changes.
Specifically, persist-key
keeps the VPN clients encryption keys intact
and persist-tun keeps the network interface active.
Next, ping-restart, and ping-timer-rem
automatically reconnect if the VPN connection drops.
Finally, the user nobody and group, nogroup
drop privileges after connecting to the VPN server.
Dropping privileges after a VPN connection is established
minimizes the risk of exploits.
Running the VPN client with lower privileges
limits the potential damage if the client is compromised,
following the principle of least privilege.
This approach isolates the VPN process
from critical system functions, reducing the attach surface.
So remember, virtual private network, or VPN architecture
extends access controls
beyond traditional network boundaries.
There are different types of VPNs such as client-server,
site-to-site, and always-on VPNs.
A client-server VPN connects a device to a central server
through an encrypted tunnel, allowing secure remote access.
Next, a site-to-site VPN connects entire networks together,
enabling secure communication
between offices over the internet.
And finally, always-on VPNs maintain continuous,
encrypted communications to a network,
providing uninterrupted access
and enforcing security policies at all times.