All lessons are free · No login · No trackingStart learning
uohk.comNetwork Buddies 中

Network Stories 18 · Intermediate

The Secret Tunnel: VPN (Virtual Private Network)

When you're online in a coffee shop, how can you safely connect back to your home or office network?

Starring: Pip, Rue, PangoAbout 10 min read

VPNEncryptionTunnel

Recommended first: Story 17: “HTTPS and TLS”, Story 14: “NAT and Port Forwarding”

1. The Story

Press "Next" to go through it step by step. In each step a character appears and explains what they are doing.

Prologue: A Quick Recap

Step 1 of 12

A Hole in the Front Door

Last time, I used Port Forwarding to pass 203.0.113.1:8080 on to the photo server. Mac can connect home from the coffee shop, but strangers can come and knock on this door too!

Animation text version (all steps)
  1. Prologue: A Quick Recap
  2. A Hole in the Front Door · Rue: Last time, I used Port Forwarding to pass 203.0.113.1:8080 on to the photo server. Mac can connect home from the coffee shop, but strangers can come and knock on this door too!
  3. Act 1: A Safer Way
  4. Closing the Hole · Pango: I'm Pango, the home's Firewall. You're not on the list. No entry! First we delete the Port Forwarding rule, so 8080 is no longer open to the outside. But now Mac can't use the photo server from the coffee shop either.
  5. Public Wi-Fi Can't Be Trusted Either · Pip: And there's an eavesdropper on the coffee shop's Wi-Fi. Some devices and older programs at home don't use HTTPS encryption at all. Travelling over a public network, their content is there for everyone to see.
  6. Act 2: Digging a Secret Tunnel
  7. Open Just One Small Gate · Pango: Rue turns on a VPN (Virtual Private Network) server, and I open just one small gate for it: UDP Port 51820. And only devices that hold the correct key can get through.
    • Port 51820 is the usual default Port for the VPN software WireGuard
    • Other common VPN technologies: IPsec, OpenVPN
  8. Checking Each Other's Identity · Rue: The VPN Client on Mac's computer shakes hands with me. We each show a key that was set up in advance, confirm who the other is, and then agree on an encryption key for this connection.
  9. The Tunnel Is Up · Rue: A Tunnel is now built between the coffee shop and home! Mac's computer also gets a VPN-only address set up in advance, 192.168.50.2. It's as if the home network has gained a new member.
    • VPN network: Mac 192.168.50.2, Rue at home 192.168.50.1
  10. Pip Climbs into the Crate · Pip: My original label says "from 192.168.50.2 to 192.168.1.12:8080". The VPN encrypts me, then puts me inside an outer shipping crate: "To 203.0.113.1, UDP 51820". Routers along the way only look at the outer layer to find the route.
    • Inner layer (encrypted): 192.168.50.2 → 192.168.1.12:8080
    • Outer layer (not encrypted): 192.168.0.23 → 203.0.113.1:51820
    • After the coffee shop's NAT, the outer sender becomes 198.51.100.1
  11. The Eavesdropper Only Sees a Locked Crate · Pip: All the eavesdropper picks up is a pile of encrypted data going to 203.0.113.1. He doesn't know which device at home I'm heading for, and he certainly can't see the photos.
  12. Rue Opens the Crate and Delivers · Rue: I receive the crate, strip off the outer layer, decrypt it and take out the original Pip: to 192.168.1.12:8080. I deliver him to the photo server, and the reply goes back to the coffee shop through the tunnel. It's as if Mac were sitting at home!
  13. Act 3: Different Ways to Use a Tunnel
  14. Everything Through the Tunnel? · Rue: Mac can choose a Full Tunnel: even data going to example.com first goes home through the tunnel, then out from home. That's safest on public Wi-Fi. Or a Split Tunnel: only data going home uses the tunnel.
  15. Paid VPN Services · Pango: VPN services you can buy simply put the other end of the tunnel at the provider. The coffee shop and your ISP can't see your content. But the provider can see which websites you visit, and any content without HTTPS too. You've only changed who you trust; you're not completely anonymous.
    • Remote-access VPN: one device connects back to a network
    • Site-to-site VPN: the Routers of two networks stay connected all the time
  16. Summary: The Secret Tunnel · Pip: The VPN encrypts me and puts me in an outer shipping crate addressed to home. Along the way, everyone only sees a locked crate. At home, Rue opens it, and it's as if I'd been at home all along. The front door only needs one small gate that opens for the right key!

2. Where Is the Problem

In Story 14, Rue used Port Forwarding to pass 203.0.113.1:8080 on to the photo server on the home desktop computer, 192.168.1.12:8080. Port Forwarding means the Router hands anything that arrives at a certain Port (a numbered door for data) straight to one device inside the home. Mac could finally see the photos from the coffee shop, but two problems were left behind:

  1. There's a hole in the front door. The whole world can come and knock on 8080. A stranger at 192.0.2.66 could keep trying to guess the password, or break in through a bug in the software. (Note: an address starting with 192 is not always Private. Only addresses starting with 192.168 are. 192.0.2.66 is a public address on the Internet.)
  2. There's no protection on the road. Some devices and older programs at home don't use HTTPS (Hypertext Transfer Protocol Secure). Travelling over the coffee shop's public Wi-Fi (wireless network), their content is there for everyone to see.

Deleting the Port Forwarding rule fills the hole, but then Mac can no longer use the services at home while he's out.

3. How the Network Solves It

Dig a secret tunnel between the coffee shop and home that only your own people can enter.

That is a VPN (Virtual Private Network): a technology that builds an encrypted channel across the public Internet, connecting a faraway device back to a private network. Pip is encrypted and then climbs into a shipping crate labelled "To Rue at home". Everyone along the way only sees a locked crate. Only when it reaches home does Rue open it.

The home's front door only needs one small gate. Pango, the guard, is the Firewall (a guard that decides which traffic may pass) built into the home Router (the device that connects the home to the Internet). He opens only UDP (User Datagram Protocol) Port 51820 for the VPN, and only lets through devices that hold the correct key.

4. A Closer Look

Three roles

Role Where What it does
VPN Client Mac's computer Encrypts Pip and puts him in the shipping crate
VPN Server Rue at home, 203.0.113.1 UDP 51820 Opens the crate, decrypts, then sends him into the home network
Tunnel Between the two An encrypted channel all the way across the public Internet

Port 51820 in the story is the usual default Port for the VPN software WireGuard, which sends its data over UDP. Other common VPN technologies include IPsec and OpenVPN. They work on much the same idea.

The handshake: proving who you are first

Before connecting, the VPN Client and VPN Server first shake hands. They each show a key that was set up in advance, confirm that the other side is one of their own, and then agree on an encryption key for this connection. This is very similar to the TLS (Transport Layer Security) handshake in Story 17.

Anyone without the correct key, such as the stranger at 192.0.2.66, can't even get through the handshake.

Packing inside the tunnel: one packet wrapped inside another

Once the tunnel is up, Mac's computer uses a VPN-only address set up in advance, 192.168.50.2. Rue at home is 192.168.50.1 on the VPN network. It's as if Mac has become a member of the home network.

When Pip sets off, he actually has two layers:

Outer layer (not encrypted, so Routers along the way can find the route)
  Sender:    192.168.0.23  → becomes 198.51.100.1 after the coffee shop's NAT
  Recipient: 203.0.113.1   UDP 51820
  ┌─────────────────────────────────────────┐
  │ Inner layer (fully encrypted)           │
  │   Sender:    192.168.50.2               │
  │   Recipient: 192.168.1.12   TCP 8080    │
  │   Content:   photos                     │
  └─────────────────────────────────────────┘

This is another use of Encapsulation: treating a whole packet as the Payload (the data being carried) of another packet.

Routers along the way only look at the outer layer and deliver the crate to 203.0.113.1. The coffee shop's NAT (Network Address Translation) also only changes the sender on the outer layer. When Rue receives it, he strips off the outer layer, decrypts it, takes out the original Pip, and then sends him on to 192.168.1.12 TCP (Transmission Control Protocol) Port 8080, following the address on the inner layer. The reply goes back to the coffee shop through the same tunnel.

Full Tunnel or Split Tunnel?

Full Tunnel Split Tunnel
Which data goes through the tunnel All of it, including data to example.com Only data going to the home network
Route to example.com Home first, then out to the Internet from home Straight out through the coffee shop
Pros Safest on public Wi-Fi Faster, doesn't use up the home's bandwidth
Cons Takes the long way round, slower Other data still travels over public Wi-Fi

Two common uses

  • Remote-access VPN: one device connects back to a network, for example Mac connecting home from the coffee shop, or an employee connecting to the office from home.
  • Site-to-site VPN: the Routers of two networks stay connected all the time, for example a head office and a branch. Staff don't need to open any software at all.

Paid VPN services simply put the other end of the tunnel at the service provider. The coffee shop and your ISP (Internet Service Provider) can't see your content. But the provider can see which websites you visit, and it can also see any content that isn't protected by HTTPS.

5. Try It Yourself

Mission: find your VPN settings

  1. Search for "VPN" in your phone's "Settings".
  2. See whether there are any VPN settings installed, or a VPN app your company or school asked you to install.
  3. If there is one, check whether it is a Full Tunnel: after connecting, open any website. The Public IP (public address) the website sees will change to the address of the other end of the VPN.
  4. Think about it: do you trust whoever is at the other end of this VPN?

Mini game

Outer layer or inner layer?

Is each piece of information below written on the outer shipping crate, or on the encrypted inner layer?

  1. 1Recipient 192.168.1.12

  2. 2Recipient 203.0.113.1

  3. 3UDP Port 51820

  4. 4Port 8080

  5. 5Sender 192.168.50.2

  6. 6Sender 198.51.100.1 after the coffee shop's NAT

6. Where the Analogy Breaks

  • The tunnel isn't a real private line. The outer packets are still forwarded stop by stop across the public Internet, together with everyone else's packets. "Tunnel" just means they are wrapped up with encryption so nobody can see inside.
  • Eavesdroppers can still see the shipping crate. They know Mac is connecting to 203.0.113.1, and they can see how much data is sent and when. They just can't see the content or the real destination.
  • A VPN is not an invisibility cloak. A paid VPN provider is in a position to see your traffic. You have only changed who you trust; you are not completely anonymous.
  • Being inside the tunnel doesn't mean you're totally safe. A VPN won't stop your computer from catching a virus. The photo server at home still needs a strong password and up-to-date software.
  • An extra layer has a cost. The outer header takes up space, and the detour takes time, so going online through a VPN is usually a little slower.

7. Quiz

Question 1 of 3What is the recipient on the "outer layer" of a VPN tunnel?
Question 2 of 3Compared with Port Forwarding, what is the advantage of using a VPN to connect back home?
Question 3 of 3When you use a paid VPN service, which of these is correct?

8. Key Notes

  • A VPN (Virtual Private Network) builds an encrypted Tunnel across the public Internet, so a faraway device behaves as if it were plugged into the home or office network.
  • Packets in the tunnel have two layers: the outer layer carries the public address of the VPN Server (for example 203.0.113.1 UDP 51820), and the encrypted inner layer carries the real destination (for example 192.168.1.12:8080).
  • Compared with Port Forwarding, a VPN opens only one small gate and only lets in devices that hold the correct key.
  • A Full Tunnel sends all data through the tunnel; a Split Tunnel only sends data for the home network through it.
  • A VPN doesn't make you anonymous: whoever is at the other end of the tunnel can see your traffic.

Further reading

The VPN gets Mac safely home from the coffee shop, thanks to Pango opening a small gate just for UDP 51820. But how does Pango know which packets may come in and which must be stopped? In the next story, Pango opens up his list and introduces Firewalls and ACLs (Access Control Lists).