text to text

Virtual Private Networks (VPNs) can extend a local area network (LAN) over the Internet to remote networks and remote client machines. A VPN uses the Internet to route LAN traffic from one location to another by encapsulating the data inside encrypted IP packets. The encrypted packets are unreadable by intermediary Internet devices and can contain any kind of network communications - such as file and printer sharing, e-mail, remote procedure calls, and database access.

VPNs can be setup using server computers, firewalls or routers. Client access to the VPN can be made using client-side VPN software or by connecting to an ISP that supports the VPN protocol.

VPNs solve the problem of accessing private servers over the Internet through a combination of IP encapsulation, cryptographic authentication and data payload encryption.

IP Encapsulation
IP encapsulation provides a way to protect the data while in transit between the remote client and the private LAN. Computers outside the VPN should not be able to snoop on the traffic exchanged between the remote client and private server or be able to insert their own data into the communication stream. This is accomplished by creating what people refer to as a private and protected "tunnel" through the public Internet. When an IP packet contains another IP packet this is called IP encapsulation, and it provides a mechanism to refer to a host within a private network when a direct network connection may not exist. When this is combined with data encryption then we've effectively created our virtual tunnel.

Cryptographic Authentication
Cryptographic Authentication is used to securely validate the identity of the remote client so that the private LAN can determine what level of security should be applied to that user. VPNs use the authentication process to determine whether or not a remote user can participate in the encrypted tunnel, and for exchanging the public key that will subsequently be used for data encryption.

Data Payload Encryption
Data Payload Encryption uses a public key to encrypt the data field of the IP encapsulated packet. That is, data payload encryption is exactly like normal IP except that the data has been encrypted. It does not encrypt the header information, so details of the private network can be gleaned by analyzing the header information.

Advantages and Disadvantages
Compared to Wide Area Networks (WANs), VPNs offer some advantages but, also, present some disadvantages.

 Advantages - cheaper than WANs - easier to setup than WANs Disadvantages - slower than WANs - less reliable than WANs - less secure than isolated WANs 

Example
Although there are a number of ways to configure a VPN here is an example of one scenario that is fairly common -- an employee wishes to work from home and exchange data between their home machine and a private web server on the corporate network. There are two important processes here -- the process of negotiating and building a VPN session, and the process of protecting and handling the data within an existing VPN connection. Here I'll briefly describe the latter and leave the former as a potential topic for a future article.

Suppose we have the following:
(a) a VPN client with a public IP address of 66.123.77.196 and a private IP address of 192.168.0.202 (provided by the corporation's DHCP server).
(b) a VPN server on the corporate network with two interfaces -- a public interface to the Internet that uses 168.156.192.75 and an interface to the private network with an IP of 192.168.0.101
(c) a web server on the corporate network with an IP address of 192.168.0.102

Prior to creating a VPN session the client host has one interface and a connection to the Internet through an ISP. The client machine can communicate with any host on the Internet but can not access the web server on the private network 192.168.0.X. After the VPN session has been created then the client host has 2 interfaces -- the original interface to the Internet and a new VPN interface. The new VPN interface becomes the default gateway -- that is, all packets will initially travel through the new interface. However, the VPN interface is not a physical network card -- it doesn't physically connect to anything. The VPN interface is used to encrypt and encapsulate packets that are subsequently sent as the payload of a new, outer packet. It is the outer packet that is sent out over the Internet (using the original interface) to the corporate VPN server.

The inner packet will use the client's private IP of 192.168.0.202 as the source IP address and the web server's private IP of 192.168.0.102 as the destination address. The VPN client encrypts the data field of the inner packet and this inner packet then becomes the payload of an outer packet. The outer packet uses the client's public IP of 66.123.77.196 as the source IP address and the public interface of the VPN server (168.156.192.75) as the destination IP. The IP encapsulated packet is then sent to the ISP and out over the Internet.

When the IP encapsulated packet reaches the VPN server at the edge of the private network it will unwrap the inner packet and decrypt its data field. Since the VPN server also has an interface to the private network it will then be able to forward the inner packet to the destination web server. When data is sent from the web server back to the client then the process is reversed -- that is, the VPN server handles the encryption/encapsulation and the VPN client is responsible for unwrapping/decoding.

Steve Leytus is a senior software engineer and develops applications for NutsAboutNets.com. For more information about low cost, PC-based diagnostic tools for installing, optimizing and trouble-shooting 802.11 (Wi-Fi) wireless networks please visit http://www.NutsAboutNets.com

It is not always easy to find the best broadband service for you. Wading through a cyber sea of websites offering 'best' deals, now also made more confusing by the plethora of websites offering comparison deals, it is hard to make a choice about which one is the best broadband service for you. You can't believe the marketing hype from the many different ISP's (internet service providers like Virgin, Tiscali or BT), you have to look at a variety of factors. Here is the best way to find the one that is right for you.

Narrow it down!

Firstly, if you have no idea what kind of package you are looking for then you should get in and make some decisions about speed and download limit. Do that before you do anything else and you will find already that your task is much simpler. A quick guide to how to choose is that if you are a light internet user and you only browse a few pages and use it for email, then you will only need a low (say 1GB) download cap and you can choose a package with a low speed (512Kbps to 2Mbps).

If you are a medium user, and there are several people browsing and emailing every day and maybe watching streaming videos such as the ones on Youtube or on BBC, then you might want to go for bigger downloads (such as 10GB) and better speeds of around 4Mbps -10Mbps. If you want to game a lot online (for instance with World of Warcraft) or download music and movies regularly then you should look at either high download caps or unlimited caps and the highest speeds you can get (20-24Mbps). These will cost more but give you the best speeds around.

Always check comparison sites

Comparison sites will give you an overview of what broadband offers are out there for your needs and price range. This is a short cut so that you do not have to check many different sites. It will also introduce you to smaller providers offering better deals. Don't be afraid to go with people you have not heard of, often they give better deals and service than the big guns you have heard of.

Look for reviews

A lot of comparison sites will offer an average customer review but it can also be well worth looking for independent user review sites. It is defiantly good to get an idea of what kind of customer service you can expect when things go wrong, as most people do not know enough about computers to fix any technical problems. Make sure that if this happens, your provider does offer reliable technical support. The best way to find out if they do is to look at what other users are saying about them.

With this in mind you will get yourself a good deal with the right provider.

Broadband Wise Is The Premier Resource for Broadband Reviews With in-depth comparisons of ADSL Broadband in your area.