Skip to content
Search

Virtual Private Network

lastmod 2026-08-23created 2014-10-0232 edits

A virtual private network (engineering: VPN) is a private communication network used by a company or a few organizations to communicate over a public network without revealing the content to outsiders. In a virtual private network, messages are carried over a public network such as the Internet using standard protocols, or carried over the service provider's private network after the VPN service provider and the customer sign a service level agreement.

Virtual private networks emerged from changes in the Internet-based corporate work environment. Work moved from a base where documents were only passed around within a small area, to work using a network within a single building, and then to relationships between a head office and many branch offices, with branches expanding to domestic and overseas ones. Using traditional leased lines to build a single network for all of them has many limits, including cost, and even when a network is built on leased lines, operating it in-house and adopting new technologies can be a considerable burden for a company. In addition, existing public networks provided no security services, making them inadequate for transmitting important documents or data. These combined reasons led to the emergence of virtual private networks.

Categories

VPN types

VPNs can be divided into two types as follows.

Remote access VPN

A remote access VPN encrypts data sent from or received by your device, protecting you so that no one can snoop on you. All VPNs used by individual users are remote access VPNs.

Site-to-site VPN

A site-to-site VPN is used to extend a company's network across multiple locations. Site-to-site VPNs are divided into intranet VPNs and extranet VPNs. An intranet VPN combines multiple LANs into a single private network, while an extranet VPN extends a company's network to share it with partners or customers.

How VPN works

  • Tunneling: Installing a VPN client program creates a 'tunnel' connected to the company's Secure Gateway over the external network
  • IP allocation and packet handling:
    • With a VPN, the user is assigned an additional IP in the company's internal range on top of their existing IP.
    • When sending data, encapsulation occurs and two IP headers are attached. The inner header holds the destination toward the internal server, and the outer header holds the path to the VPN gateway
    • Data in transit is encrypted to keep it secure
  • Result: The Secure Gateway receives the packet, decrypts it, and forwards it to the internal server; the server responds as if the user were inside the company, so work can be done in a remote work environment while complying with internal security policies

Refer to tunneling in ssh.

Protocols

A VPN and a VPN protocol are different concepts. For example, NordVPN offers various VPN protocols, so users can choose the protocol they want depending on their needs and devices.

A VPN sends an online tunnel through an encrypted tunnel to a VPN server, and the VPN server assigns the device a new IP address. A VPN protocol is the program and process that determines how this tunnel is formed.

A VPN protocol is a set of rules or guidelines that determines how data is routed between a computer or other device and a VPN server. VPN providers rely on protocols to provide stable and secure Internet connections.

No VPN protocol is perfect. Each VPN protocol has different potential vulnerabilities. We will look at the pros and cons of each VPN protocol in detail below.

Internet Key Exchange, Version 2 (IKEv2)

Point-to-Point Tunneling Protocol (PPTP)

PPTP VPN stands for Point-to-Point Tunneling Protocol. As the name suggests, a PPTP VPN creates a tunnel and captures data. It is a rather long name for one of the most commonly used VPNs. A PPTP VPN is used by remote users to connect to a VPN network using their existing Internet connection. It is a useful VPN for both business and home users. To access the VPN, users must log in with an approved password. PPTP VPN is ideal for personal and business use because it requires no installation or purchase of additional hardware and usually provides its features as inexpensive add-on software. PPTP VPN is the most widely used because it is compatible with Windows, Mac, and Linux systems.

PPTP VPN may seem to have many advantages, but it also has drawbacks. The drawback of PPTP VPN is that it does not provide encryption, which is usually the reason for using a VPN. Encryption is the reason to get a VPN. Another drawback is that it relies on PPP, or Point-to-Point Protocol, to implement security measures.

Site-to-Site; Router-to-Router

A site-to-site VPN, also called a router-to-router VPN, is mainly used in corporate operations. Because many companies run offices nationwide or internationally, site-to-site VPNs are used to connect the head office's network to multiple offices. This is also known as an intranet-based VPN. A site-to-site VPN can also be used the other way around. In the same way, a company can use a site-to-site VPN to connect to another company, which is classified as an extranet-based VPN. Simply put, a site-to-site VPN builds a virtual bridge connecting networks in different locations so that secure, private communication can be maintained between them.

As with PPTP VPN, a site-to-site VPN creates a secure network. However, there is no dedicated line through which the multiple sites within the company just mentioned can connect to form the VPN. Also, unlike PPTP, routing, encryption, and decryption are performed by hardware- or software-based routers.

Layer 2 Tunneling Protocol (L2TP)

L2TP stands for Layer 2 Tunneling Protocol. L2TP combines L2F (Layer 2 Forwarding Protocol) and PPTP (Point-to-Point Tunneling Protocol) and was first proposed in 1999. Because L2TP does not itself provide strong encryption or authentication, another protocol called IPsec is often used together with L2TP.

IPsec stands for Internet Protocol security. IPsec is a highly flexible protocol for end-to-end security that authenticates and encrypts each individual IP packet in a given communication. IPsec is used at the Internet layer of the Internet protocol suite for various applications.

Using L2TP and IPsec together is much more secure than PPTP (Point-to-Point Tunneling Protocol), but it is better suited to anonymization than to security.

L2TP can sometimes run into firewall issues because it uses UDP port 500, which some firewalls are known to block.

IPsec

IPsec VPN (Internet Protocol Security VPN)

  • Operating layer: Works at the network layer (OSI layer 3).
  • Security scope: Encrypts all network traffic, suitable for head office–branch connections or full access to the internal network.
  • Features: Very secure and fast, but requires a dedicated client program and complex initial setup. It also uses specific ports (UDP 500, etc.), which can limit firewall traversal.

IPsec stands for Internet Protocol Security. IPsec is a VPN protocol used to protect Internet communication across IP networks. A tunnel is set up to a remote site to allow access to the central site. IPsec protects Internet Protocol communication by verifying each session and encrypting data packets individually over the connection. IPsec VPN operates in two modes: transport mode and tunneling mode. Both modes protect data transfer between two different networks. In transport mode, the message in the data packet is encrypted; in tunneling mode, the entire data packet is encrypted. The benefit of using IPsec VPN is that additional security protocols can be used to provide a stronger security system.

IPsec is a VPN worth having, but its big drawback is that installing the client before use takes a lot of time.

SSL VPN (Secure Sockets Layer VPN)

  • Operating layer: Works at the application layer (OSI layer 7).
  • Security scope: Mainly used to access only specific applications or services through a web browser.
  • Features: Very convenient because it can be accessed with just a web browser (HTTPS/port 443) without installing separate software. It has almost no firewall configuration constraints, so it is widely used for remote work and external access.

Secure Socket Tunneling Protocol (SSTP)

Because it uses the SSL v3 specification, it has advantages similar to OpenVPN, and it is a relatively recent protocol. It was added in Microsoft's Windows Vista SP1 and can now be used on Linux and other operating systems, but because Microsoft owns SSTP, it is still focused on Windows. Also, given that Microsoft has worked with the NSA, it cannot be said to be definitely secure.

When a router is created: how to check

If the connection is not made through OS settings, as with L2TP,

use the route command.

Running ipconfig before connecting gives: 

Windows IP Configuration


Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . : .
   Link-local IPv6 Address . . . . . : fe80::c641:7757:62c1:ce7d%7
   IPv4 Address. . . . . . . . . . . : 10.0.2.15
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 10.0.2.2

Ethernet adapter Ethernet 2:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

The "Ethernet 2" adapter is not connected.

Running ROUTE.EXE print outputs the following: 

===========================================================================
Interface List
  7...08 00 27 bf 69 c4 ......Intel(R) PRO/1000 MT Desktop Adapter
 19...00 ff 82 d0 e4 41 ......tgsvpn driver 1.0
  1...........................Software Loopback Interface 1
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0         10.0.2.2        10.0.2.15     25
         10.0.2.0    255.255.255.0         On-link         10.0.2.15    281
        10.0.2.15  255.255.255.255         On-link         10.0.2.15    281
       10.0.2.255  255.255.255.255         On-link         10.0.2.15    281
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    331
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    331
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    331
        224.0.0.0        240.0.0.0         On-link         10.0.2.15    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    331
  255.255.255.255  255.255.255.255         On-link         10.0.2.15    281
===========================================================================
Persistent Routes:
  None

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
  1    331 ::1/128                  On-link
  7    281 fe80::/64                On-link
  7    281 fe80::c641:7757:62c1:ce7d/128
                                    On-link
  1    331 ff00::/8                 On-link
  7    281 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None

Running ipconfig after connecting with the VPN Client gives: 

Windows IP Configuration


Ethernet adapter Ethernet 2:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::90f8:23c0:6ec2:ce73%19
   IPv4 Address. . . . . . . . . . . : 172.17.1.15
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . :

Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . : .
   Link-local IPv6 Address . . . . . : fe80::c641:7757:62c1:ce7d%7
   IPv4 Address. . . . . . . . . . . : 10.0.2.15
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 10.0.2.2

You can see that an address has been assigned to the "Ethernet 2" adapter. Running ROUTE.EXE print outputs the following: 

===========================================================================
Interface List
 19...00 ff 82 d0 e4 41 ......tgsvpn driver 1.0
  7...08 00 27 bf 69 c4 ......Intel(R) PRO/1000 MT Desktop Adapter
  1...........................Software Loopback Interface 1
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0         10.0.2.2        10.0.2.15     25
         10.0.2.0    255.255.255.0         On-link         10.0.2.15    281
        10.0.2.15  255.255.255.255         On-link         10.0.2.15    281
       10.0.2.255  255.255.255.255         On-link         10.0.2.15    281
        10.0.50.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.36.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.37.0    255.255.255.0       172.17.1.1      172.17.1.15      3
     10.10.37.208  255.255.255.255       172.17.1.1      172.17.1.15      3
       10.10.38.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.39.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.40.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.41.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.42.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.43.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.44.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.45.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.47.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.48.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.49.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.60.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.61.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.62.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.64.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.65.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.66.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.67.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.68.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.69.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.70.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.73.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.78.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.80.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.81.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.82.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.83.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.84.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.85.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.86.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.87.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.90.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.92.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.93.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.94.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.95.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.10.97.0    255.255.255.0       172.17.1.1      172.17.1.15      3
      10.10.100.0    255.255.255.0       172.17.1.1      172.17.1.15      3
      10.10.111.0    255.255.255.0       172.17.1.1      172.17.1.15      3
      10.10.112.0    255.255.255.0       172.17.1.1      172.17.1.15      3
      10.10.113.0    255.255.255.0       172.17.1.1      172.17.1.15      3
      10.10.114.0    255.255.255.0       172.17.1.1      172.17.1.15      3
      10.10.116.0    255.255.255.0       172.17.1.1      172.17.1.15      3
      10.10.117.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.20.12.0    255.255.252.0       172.17.1.1      172.17.1.15      3
       10.20.16.0    255.255.252.0       172.17.1.1      172.17.1.15      3
       10.30.11.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.30.12.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.30.16.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.30.17.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.30.20.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.30.24.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.30.28.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.30.32.0    255.255.255.0       172.17.1.1      172.17.1.15      3
      10.30.100.0    255.255.255.0       172.17.1.1      172.17.1.15      3
      10.30.102.0    255.255.255.0       172.17.1.1      172.17.1.15      3
      10.30.104.0    255.255.255.0       172.17.1.1      172.17.1.15      3
      10.30.107.0    255.255.255.0       172.17.1.1      172.17.1.15      3
      10.30.108.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.40.12.0    255.255.252.0       172.17.1.1      172.17.1.15      3
       10.40.16.0    255.255.252.0       172.17.1.1      172.17.1.15      3
      10.40.100.0    255.255.255.0       172.17.1.1      172.17.1.15      3
      10.40.101.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.60.12.0    255.255.255.0       172.17.1.1      172.17.1.15      3
       10.60.16.0    255.255.255.0       172.17.1.1      172.17.1.15      3
      10.60.100.0    255.255.255.0       172.17.1.1      172.17.1.15      3
     10.120.100.0    255.255.252.0       172.17.1.1      172.17.1.15      3
       10.130.0.0      255.255.0.0       172.17.1.1      172.17.1.15      3
     125.60.95.57  255.255.255.255         10.0.2.2        10.0.2.15     26
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    331
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    331
       172.17.1.0    255.255.255.0         On-link       172.17.1.15    259
      172.17.1.15  255.255.255.255         On-link       172.17.1.15    259
     172.17.1.255  255.255.255.255         On-link       172.17.1.15    259
       172.31.1.7  255.255.255.255       172.17.1.1      172.17.1.15      3
       172.31.1.8  255.255.255.255       172.17.1.1      172.17.1.15      3
      172.40.85.0    255.255.255.0       172.17.1.1      172.17.1.15      3
      192.0.2.193  255.255.255.255       172.17.1.1      172.17.1.15      3
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    331
        224.0.0.0        240.0.0.0         On-link         10.0.2.15    281
        224.0.0.0        240.0.0.0         On-link       172.17.1.15    259
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    331
  255.255.255.255  255.255.255.255         On-link         10.0.2.15    281
  255.255.255.255  255.255.255.255         On-link       172.17.1.15    259
===========================================================================
Persistent Routes:
  None

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
  1    331 ::1/128                  On-link
  7    281 fe80::/64                On-link
 19    259 fe80::/64                On-link
 19    259 fe80::90f8:23c0:6ec2:ce73/128
                                    On-link
  7    281 fe80::c641:7757:62c1:ce7d/128
                                    On-link
  1    331 ff00::/8                 On-link
  7    281 ff00::/8                 On-link
 19    259 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None

You can see that the routing table has been updated.

You can check the routing path with tracert. Entering something like TRACERT.EXE 10.130.2.60 gives: 

Tracing route to 10.130.2.60 over a maximum of 30 hops

  1    16 ms     8 ms     7 ms  172.17.1.1
  2     5 ms     5 ms     4 ms  125.60.95.60
  3    10 ms     8 ms     9 ms  172.30.7.1
  4     6 ms     6 ms     4 ms  112.76.154.129
  5     *        *        *     Request timed out.
  6     *        *        *     Request timed out.
  7     *        *        *     Request timed out.
  8    13 ms     8 ms    10 ms  112.76.154.169
  9    16 ms    12 ms    13 ms  112.76.154.170
 10     *        *        *     Request timed out.
 11    13 ms    11 ms    13 ms  10.10.46.34
 12     *        *        *     Request timed out.
 13     *        *        *     Request timed out.
 14     *        *        *     Request timed out.
 15     *        *        *     Request timed out.
 16     *        *        *     Request timed out.
 17     *        *        *     Request timed out.
 18     *        *        *     Request timed out.
 19     *        *        *     Request timed out.
 20     *        *        *     Request timed out.
 21     *        *        *     Request timed out.
 22     *        *        *     Request timed out.
 23     *        *        *     Request timed out.
 24     *        *        *     Request timed out.
 25     *        *        *     Request timed out.
 26     *        *        *     Request timed out.
 27     *        *        *     Request timed out.
 28     *        *        *     Request timed out.
 29     *        *        *     Request timed out.
 30     *        *        *     Request timed out.

Trace complete.

Troubleshooting

Windows VPN error

When a VPN connection fails on Windows 10, the settings are stored as a single file at the following path. 

%userprofile%\AppData\Roaming\Microsoft\Network\Connections\Pbk\

So I compared the settings of a PC where it worked and one where it didn't. It was this value. 

# VPN 연결이 안되는 경우
DataEncryption=8

# VPN 연결이 되는 경우
DataEncryption=256

To uncheck the "Use default gateway on remote network"1 option, change the following settings in the pbk file containing the VPN settings to 0 (from the existing value 1). 

IpPrioritizeRemote=0
Ipv6PrioritizeRemote=0

Fixing L2TP VPN connection failures on Windows

Then, in the left pane, go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent, select [Edit]-[New]-[DWORD (32-bit) Value] from the top menu, create a value named AssumeUDPEncapsulationContextOnSendRule, and set it to 2.

The values mean the following.

  • 0: A value of 0 (zero) configures Windows so that it can establish security associations with servers located behind NAT devices. This is the default.
  • 1: A value of 1 configures Windows so that it can establish security associations with servers located behind NAT devices.
  • 2: 2 configures Windows so that it can establish security associations when both the server and the VPN client computer are behind Windows Vista or Windows Server 2008-based NAT devices.

Connected, but cannot reach the PC

Here are some checkpoints:

See also

  • SSL
  • stunnel - Encrypts and forwards other protocols over HTTPS traffic.
  • SoftEther VPN - VPN solution using the HTTPS port.
  • wstunnel (websocket)
  • squid - Configure a proxy server over HTTPS.
  • iodine - Open-source tool for DNS tunneling.
  • Cloudflare Tunnel -Configure access from networks that allow only HTTP(S).

Favorite site

References

  1. http://www.sysnet.pe.kr/0/0/233 ↩

  2. PpTp-Very_Frequently_Asked_Questions.pdf ↩

  3. Aws-hyoh_-_Easily_understand_VPN.pdf ↩

author Zer0 sitemap