Need A VPN
Table of Contents
Why do we need a VPN?
A VPN (Virtual Private Network) is needed to create a secure and encrypted connection over the internet. It protects sensitive data, enables secure remote access to private networks, and keeps communications confidential while using public or untrusted networks.
A VPN allows employees to securely access office resources such as file servers, ERP applications, databases, printers, IP cameras, and Remote Desktop services from anywhere in the world. After connecting to the VPN, users can work as if they were physically connected to the office network.
A VPN encrypts all network traffic between the user’s device and the VPN server. Even if someone intercepts the data while it is traveling across the internet, they cannot easily read or modify the information because it is encrypted.
A VPN also reduces the need to expose internal services directly to the internet. Instead of opening ports for services such as RDP, file sharing, or CCTV, users first authenticate to the VPN and then securely access those resources through the encrypted tunnel.
Real Example:
A company has:
- File Server: 192.168.1.10
- ERP Server: 192.168.1.20
- CCTV NVR: 192.168.1.30
An employee is working from home. The employee connects to the company’s VPN server using a laptop. After successful authentication, the VPN assigns a secure IP address (for example, 10.10.10.2). The employee can now securely access the file server, ERP system, and CCTV exactly as if they were in the office, while all communication is encrypted and protected from interception.
Why Do Hackers Use VPNs?
Hackers may use VPNs to hide their real IP address, making it more difficult for websites and online services to identify the original source of their connection. Instead of seeing the attacker’s actual IP address, the destination sees the VPN server’s IP address.
Some attackers use VPNs to make it harder to trace their activities. However, a VPN does not make someone anonymous or immune from investigation. Investigators can often combine evidence from multiple sources, and some VPN providers keep logs that may be available through legal processes.
Hackers may also use VPNs to change their apparent geographic location or obtain a different IP address if one has been blocked by a website or service. This can help them avoid simple IP-based restrictions, though it does not bypass other security controls.
Problems Without a VPN?
Without a VPN, data travels over the internet without the additional encrypted tunnel that a VPN provides. Although many websites already use HTTPS encryption, a VPN adds another layer of protection and securely connects you to private networks.
Without a VPN, remote employees cannot securely access private office resources such as file servers, ERP systems, databases, printers, and CCTV unless those services are exposed to the internet or another secure remote-access method is used. Exposing internal services directly to the internet increases security risks.
Without a VPN, users on public Wi-Fi networks have less protection. A VPN encrypts all traffic between the device and the VPN server, helping protect against certain network-based attacks and reducing the risk of others on the same network observing unprotected traffic.
Without a VPN, your public IP address is visible to the websites and services you connect to. This can reveal your approximate location and network provider, though it does not reveal your exact physical address.
Real Example:
A company has an internal file server at 192.168.1.10.
Without a VPN:
- An employee working from home cannot directly access 192.168.1.10 because it is a private IP address.
- If the company exposes services like Remote Desktop (RDP) directly to the internet instead of using a VPN, attackers may attempt password guessing or exploit software vulnerabilities if the system is not properly secured.
With a VPN:
- The employee first connects to the company’s VPN.
- After authentication, they receive a VPN IP (for example, 10.10.10.2).
- They can securely access 192.168.1.10 through the encrypted VPN tunnel without exposing the internal server directly to the internet.
There are two primary reasons why organizations need to utilize Virtual Private Network (VPN) technology. Let’s examine each one.
Security:
Modern networks rely heavily on the public Internet. Employees work from home over the Internet, partners connect to internal apps over the Internet, and branches access the DC over the Internet. Why, you may wonder? Because the Internet is everywhere now. It is fast, cheap, and reliable.
However, there is one problem – the Internet is not safe by default. Packets travel over the public network. They can be intercepted, modified, or spoofed, as shown in the diagram below. Attackers can watch unencrypted traffic and learn usernames, cookies, and database queries
At this point, you may ask – well, what if we use HTTPS? Even if an application uses HTTPS, small gaps remain: metadata still leaks, certificates are exposed, and there is another problem…
Routing and Private Addressing:
- Another reason organizations need a VPN is that private IPs are not routable across the Internet. Corporate networks usually use private address spaces, such as 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16. These ranges are filtered by Internet providers.
- Let’s see the following example. Suppose a remote user connected to the Internet wants to access a corporate printer with the IP address 10.0.7.5. The user sends the packets with the source IP set to its own IP address and the destination IP set to 10.0.7.5 (the address of the printer). What do you think will happen? Of course, the remote user cannot reach any internal resource with a private IP address, because RFC1918 addresses are not routable over the Internet, as shown in the diagram below.
- Devices with private IP addresses are invisible outside the organization’s network. Someone may say, ‘Don’t we have NAT for this case?‘ Can’t we translate the printer’s address to a public IP address and access it over the Internet?
- Techniallly, we can, but NAT is not meant to be used to translate EVERY corporate IP to a public one. It is typically used for internal web servers and other applications that are publicly exposed. If remote users need to access every corporate internal IP from the outside, you cannot NAT the entire organization’s internal IP space…
What is a VPN?
- A Virtual Private Network (VPN) solves these two problems that we saw above. It lets you build a private, encrypted path across an untrusted network, typically the Internet.
- With a VPN, two endpoints act as if they are directly connected. The tunnel uses cryptographic mathematical algorithms that protect confidentiality, integrity, and authenticity.
- There are two primary types of VPNs: Remote access VPN (also called SSL VPN) and Site-to-site VPN. Let’s see each one in more detail.
Remote Access VPN:
When a remote user connects with a remote-access VPN, their device becomes an extension of the corporate network. The VPN tunnel acts like a secure virtual cable between the user and the office, as shown in the diagram below.
The user’s device receives an IP address from the company’s internal range. This makes the device appear as if it is inside the LAN. As a result, the user can access private corporate subnets, servers, and applications that would normally be unreachable from the internet.
Site-to-Site VPN:
- A site-to-site VPN links two distant networks so they act like one private network. It is often used to connect branch offices to a headquarters.
- Each site has a VPN device, usually a router or firewall. These devices build an encrypted tunnel over the internet. Inside that tunnel, they exchange traffic between the two LANs. Users on one side can reach servers and hosts on the other side as if they were on the same internal network.
The key point is that the connection is always between networks, not individual users. Once the tunnel is up, the two sites stay connected automatically.
How does a Remote Access VPN work
Now, let’s see a high-level overview of how a remote access VPN works. Let’s use the same example as above. Suppose a remote user wants to access a corporate printer with IP address 10.0.7.5 over the Internet. To do so, the user establishes a remote access VPN, such as Cisco AnyConnect, to connect to the corporate network. Behind the scenes, we can break down the process into five simplified steps, as shown in the diagram below.
Step 1: When the VPN connects for the first time, it creates a virtual NIC on the client device. The device gets a private corporate IP address 10.4.4.4 and routing rules for the corporate networks – 10.1.0.0/16 via 10.4.4.4.
Step 2: When the client sends traffic to corporate IPs (for example, to the corporate printer at 10.0.7.5), the traffic matches the VPN route. The client builds a packet with its private IP 10.4.4.4 as the source and the printer IP 10.0.7.5 as the destination, then wraps it in an outer header.
Step 3: The ISP sees only the outer header (in blue), showing traffic from the user device’s public IP address (37.5.5.5) to the VPN gateway’s public IP address (1.2.3.4).
Step 4: The VPN gateway removes the outer header (in blue) and forwards the inner packet (in yellow) into the corporate network.
Step 5: The destination host (the printer) receives the packet from the client’s assigned private IP, just like any other internal device.
Ultimately, from a logical perspective, it appears that the remote user is directly connected to the corporate network, as illustrated in the diagram below.
Of course, the example is overly simplified, but it highlights the main idea of Virtual Private Networks (VPNs).
Key Takeaways:
- VPN protects data across untrusted networks.
- Main needs: security and routing private IPs.
- The Internet is not safe; traffic can be intercepted, malformed, or spoofed.
- Private IPs (RFC1918) are not routable on the Internet.
- VPN creates encrypted tunnels for confidentiality and integrity.
- Two main types: Remote-access and Site-to-site VPN.
- Remote access extends the user device into the LAN.
- Site-to-site links two networks over the Internet.
- Remote-access workflow: virtual NIC, corporate IP, routes, encrypted tunnel.
How Does a Site To Site VPN work
Different Between Site-to-Site VPN and Remote Access VPN
Site-to-Site VPN and Remote Access VPN Chart Table
| Feature | Site-to-Site VPN | Remote Access VPN |
|---|---|---|
| Definition | Connects entire networks (office to office) | Connects individual users to a network |
| Connection Type | Network-to-Network | User-to-Network |
| User Involvement | No manual login required | User must log in using VPN client |
| Devices Used | Routers / Firewalls at both sites | User devices (laptop, mobile) with VPN software |
| Common Protocol | IPsec | SSL / IPsec |
| Connection Status | Always ON (permanent tunnel) | On-demand (connect when needed) |
| Use Case | Head Office ↔ Branch Office | Work From Home / Remote employees |
| Example | Office in one city connected to branch in another | Employee connecting from home to office network |
| Scalability | Add new branches by configuring tunnels | Add new users by installing VPN client |
| Management | Managed centrally by network admins | Managed per user/device |
| Security Level | High (fixed endpoints, controlled devices) | High but depends on user device security |
| Feature | Site-to-Site VPN | Remote Access VPN |
|---|---|---|
| Definition | Connects two or more office networks securely over the internet | Connects individual users to a company network remotely |
| Connection Type | Network-to-Network | User-to-Network |
| User Requirement | No user login required (automatic connection) | User must log in using VPN client software |
| Devices Used | Routers / Firewalls at each site | Laptop, mobile, or PC with VPN client |
| Protocols Used | Mainly IPsec | SSL and IPsec |
| Connection Status | Always ON (permanent tunnel) | On-demand (connect when needed) |
| Usage Scenario | Head Office ↔ Branch Office connection | Work From Home / traveling employees |
| Access Scope | Full network access between sites | Limited access based on user permissions |
| Management | Centrally managed by IT/network team | Managed per user/device |
| Example | Office in one city connected to another office | Employee connecting from home to office network |