How Does a VPN Work?

Several years ago, the most common way to connect computers between multiple offices was by using a leased line. Leased lines, such as ISDN (integrated services digital network, 128 Kbps), are private network connections that a telecommunications company can lease to its customers. Leased lines provide a company with a way to expand its private network beyond its immediate geographic area. These connections form a single wide-area network (WAN) for the business. Though leased lines are reliable and secure, the leases are expensive, with costs rising as the distance between offices increases.

Today, the internet is more accessible than ever before, and internet service providers (ISPs) continue to develop faster and more reliable services at lower costs than leased lines. To take advantage of this, most businesses have replaced leased lines with new technologies that use internet connections without sacrificing performance and security. Businesses started by establishing intranets, private internal networks designed for use only by company employees. Intranets enabled distant colleagues to work together through technologies such as desktop sharing. By adding a VPN server, a business can extend all its intranet's resources to employees working from remote offices or their homes.

These days, VPNs can do much more and they're not just for businesses anymore. Individuals interested in securing their communications over unsecured public WiFi networks and remaining anonymous during their online transactions have begun subscribing to paid VPN services. These services function very much like business VPNs but go through a VPN provider to reach the internet, rather than via a private business.

In other words, a VPN can keep your computer, smartphone, and any other device you connect to the internet safe from hackers and malware, while keeping all your personal data and communications safe from prying eyes. With cybercrime on the rise, it's easy to see why so many people have started using them.

Paid VPN services function very much like business VPNs but go through a VPN provider to reach the internet, rather than via a private business. These services are incredibly easy to use. All you have to do is download the software, install it on your device, and connect to the server of your choice. As long as your VPN is connected, no one (not even your internet service provider) can know who you are, where you're located, or what you're doing online.

If you use public WiFi networks, a VPN can provide a secure connection. It can even make it anonymous. If you travel, a VPN can give you access to geoblocked websites and streaming content from your home country (even your local Netflix library) while you're away. A few select VPNs can even keep you connected to all your favorite websites while you're visiting countries with strict censorship policies, like China or Russia.

Next, let's explore an analogy that describes how a VPN compares to other networking options.

Imagine that you live on an island in a huge ocean. There are thousands of other islands all around you, some very close and others farther away. The common means of travel between islands is via ferry. Traveling on the ferry means that you have almost no privacy: Other people can see everything you do.

Let's say that each island represents a private local area network (LAN) and the ocean is the internet. Traveling by ferry is like connecting to a web server or other device through the internet. You have no control over the wires and routers that make up the internet, just like you have no control over the other people on the ferry. This leaves you susceptible to security issues if you're trying to connect two private networks using a public resource.

Continuing with our analogy, your island decides to build a bridge to another island so that people have an easier, more secure and direct way to travel between the two islands. It's expensive to build and maintain the bridge, even if the islands are close together. However, the need for a reliable, secure path is so great that you do it anyway. Your island would like to connect to yet another island that is much farther away but decides that the costs are simply too much to bear.

This scenario represents having a leased line. The bridges (leased lines) are separate from the ocean (internet) yet are able to connect the islands (LANs). Companies who choose this option do so because of the need for security and reliability in connecting their remote offices. However, if the offices are very far apart, the cost can be prohibitively high — just like trying to build a bridge that spans a great distance.

So how does a VPN fit in? Using our analogy, suppose each inhabitant on your island has a small submarine. Let's assume that each submarine has these amazing properties:

Although they're traveling in the ocean along with other traffic, the people could travel between islands whenever they wanted to with privacy and security. That's essentially how a VPN works. Each remote member of your network can communicate in a secure and reliable manner using the internet as the medium to connect to the private LAN. A VPN can grow to accommodate more users and different locations much more easily than a leased line. In fact, scalability is a major advantage that VPNs have over leased lines. Moreover, the distance doesn't matter, because VPNs can easily connect multiple geographic locations worldwide.

Next, we'll look at what constitutes a good VPN, including its benefits and features.

A VPN's purpose is providing a reliable, secure and encrypted connection between computer networks over an existing public network, typically the internet.

Before looking at the technology that makes a VPN possible, let's consider all the benefits and features someone should expect in a VPN.

Well-designed VPN service providers will offer the following benefits:

A company might not require all these benefits from its business VPN, but it should demand the following essential VPN features:

Public VPN providers are often evaluated on whether they capture information about their users and the number of countries in which they have remote servers. Because a VPN privatizes information about the user, he or she can use a VPN connection to mask the location they're connecting from, which may permit access to geographically restricted information, such as a TV service limited to access from a certain country.

One interesting thing to note about VPNs is that there are no standards about how to set them up. This article covers network, authentication and security protocols that provide the features and benefits listed above. It also describes how a VPN's components work together. If you're establishing your own VPN, though, it's up to you to decide which VPN protocols and components to use and to understand how they work together.

The next two pages describe two common types of VPN. We'll start with the type that's most synonymous with the term VPN.

A remote-access VPN allows individual users to establish secure connections with a remote computer network. Those users can access the secure resources on that network as if they were directly plugged in to the network's servers. An example of a company that needs a remote-access VPN is a large firm with hundreds of salespeople in the field. Another name for this type of VPN is virtual private dial-up network (VPDN), acknowledging that in its earliest form, a remote-access VPN required dialing in to a server using an analog telephone system.

There are two components required in a remote-access VPN. The first is a network access server (NAS, usually pronounced "nazz" conversationally), also called a media gateway or a remote-access server (RAS). (Note: IT professionals also use NAS to mean network-attached storage.) A NAS might be a dedicated server, or it might be one of multiple software applications running on a shared server. It's a NAS that a user connects to from the internet in order to use a VPN. The NAS requires that user to provide valid credentials to sign in to the VPN. To authenticate the user's credentials, the NAS uses either its own authentication process or a separate authentication server running on the network.

The other required component of remote-access VPNs is client software. In other words, employees who want to use the VPN from their computers require software on those computers that can establish and maintain a connection to the VPN. Most operating systems today have built-in software that can connect to remote-access VPNs, though some VPNs might require users to install a specific application instead. The client software sets up the tunneled connection to a NAS, which the user indicates by its internet address. The software also manages the encryption required to keep the connection secure. You can read more about tunneling and encryption later in this article.

Large corporations or businesses with knowledgeable IT staff typically purchase, deploy and maintain their own remote-access VPNs. Businesses can also choose to outsource their remote-access VPN services through an enterprise service provider (ESP). The ESP sets up a NAS for the business and keeps that NAS running smoothly.

A remote-access VPN is great for individual employees, but what about entire branch offices with dozens or even hundreds of employees? Next, we'll look at another type of VPN used to keep businesses connected LAN-to-LAN.

A site-to-site VPN allows offices in multiple fixed locations to establish secure connections with each other over a public network such as the internet. Site-to-site VPN extends the company's network, making computer resources from one location available to employees at other locations.

An example of a company that needs a site-to-site VPN is a growing corporation with dozens of branch offices around the world.

There are two types of site-to-site VPNs:

Even though the purpose of a site-to-site VPN is different from that of a remote-access VPN, it could use some of the same software and equipment. Ideally, though, a site-to-site VPN should eliminate the need for each computer to run VPN client software as if it were on a remote-access VPN. Dedicated VPN client equipment, described later in this article, can accomplish this goal in a site-to-site VPN.

Now that you know the two types of VPNs, let's look at how your data is kept secure as it travels across a VPN.

Most VPNs rely on tunneling to create a private network that reaches across the internet. In our article "How does the internet work?" we describe how each data file is broken into a series of packets to be sent and received by computers connected to the internet. Tunneling is the process of placing an entire packet within another packet before it's transported over the internet. That outer packet protects the contents from public view and ensures that the packet moves within a virtual tunnel.

This layering of packets is called encapsulation. Computers or other network devices at both ends of the tunnel, called tunnel interfaces, can encapsulate outgoing packets and reopen incoming packets. Users (at one end of the tunnel) and IT personnel (at one or both ends of the tunnel) configure the tunnel interfaces they're responsible for to use a tunneling protocol. Also called an encapsulation protocol, a tunneling protocol is a standardized way to encapsulate packets [source: Microsoft]. Later in this article, you can read about the different tunneling protocols used by VPNs.

The purpose of the tunneling protocol is to add a layer of security that protects each packet on its journey over the internet. The packet is traveling with the same transport protocol it would have used without the tunnel; this protocol defines how each computer sends and receives data over its ISP. Each inner packet still maintains the passenger protocol, such as internet protocol (IP), which defines how it travels on the LANs at each end of the tunnel. (See the sidebar for more about how computers use common network protocols to communicate.) The tunneling protocol used for encapsulation adds a layer of security to protect the packet on its journey over the internet.

To better understand the relationships between protocols, think of tunneling as having a computer delivered to you by a shipping company. The vendor who is sending you the computer packs the computer (passenger protocol) in a box (tunneling protocol). Shippers then place that box on a shipping truck (transport protocol) at the vendor's warehouse (one tunnel interface). The truck (transport protocol) travels over the highways (internet) to your home (the other tunnel interface) and delivers the computer. You open the box (tunneling protocol) and remove the computer (passenger protocol).

Some VPNs, such as ExpressVPN have a split tunneling feature. This means you can choose which apps send data through the VPN and which use your regular, local connection.

Now that we've examined data in the tunnel, let's look at the equipment behind each interface.

While a VPN can be configured on generic computer equipment such as standard servers, most businesses opt for dedicated equipment optimized for the VPN and general network security. A small company might have all of its VPN equipment on site or, as mentioned earlier, might outsource its VPN services to an enterprise service provider. A larger company with branch offices might choose to co-locate some of its VPN equipment, meaning that it will set up that equipment in a co-location facility (or colo). A colo is a large data center that rents space to businesses that need to set up servers and other network equipment on a very fast, highly reliable internet connection.

As mentioned earlier, there is no standard that all VPNs follow in terms of their setup. When planning or extending a VPN, though, you should consider the following equipment:

One widely used standard for AAA servers is Remote Authentication Dial-in User Service (RADIUS). Despite its name, RADIUS isn't just for dial-up users. When a RADIUS server is part of a VPN, it handles authentication for all connections coming through through the VPN's NAS.

VPN components can run alongside other software on a shared server, but this is not typical, and it could put the security and reliability of the VPN at risk. A small business that isn't outsourcing its VPN services might deploy firewall and RADIUS software on generic servers. However, as a business's VPN needs increase, so does its need for equipment that's optimized for the VPN. The following are dedicated VPN devices a business can add to its network. You can purchase these devices from companies that produce network equipment:

So far, we've looked at the types of VPNs and the equipment they can use. Next, let's take a closer look at the encryption and protocols that VPN components use.

Sponsored link: Click here to learn more about VPN hardware and installing a VPN on a router.

Encryption is the process of encoding data so that only a computer with the right decoder will be able to read and use it. You could use encryption to protect files on your computer or e-mails you send to friends or colleagues. An encryption key tells the computer what computations to perform on data in order to encrypt or decrypt it. The most common forms of encryption are symmetric-key encryption or public-key encryption:

In a VPN, the computers at each end of the tunnel encrypt the data entering the tunnel and decrypt it at the other end. However, a VPN needs more than just a pair of keys to apply encryption. That's where protocols come in. A site-to-site VPN could use either internet protocol security protocol (IPSec) or generic routing encapsulation (GRE). GRE provides the framework for how to package the passenger protocol for transport over the internet protocol (IP). This framework includes information on what type of packet you're encapsulating and the connection between sender and receiver.

IPSec is a widely used protocol for securing traffic on IP networks, including the internet. IPSec can encrypt data between various devices, including router to router, firewall to router, desktop to router, and desktop to server. IPSec consists of two sub-protocols which provide the instructions a VPN needs to secure its packets:

Networked devices can use IPSec in one of two encryption modes. In transport mode, devices encrypt the data traveling between them. In tunnel mode, the devices build a virtual tunnel between two networks. As you might guess, VPNs use IPSec in tunnel mode with IPSec ESP and IPSec AH working together [source: Friedl].

In a remote- access VPN, tunneling typically relies on Point-to-point Protocol (PPP) which is part of the native protocols used by the internet. More accurately, though, remote-access VPNs use one of three protocols based on PPP:

Throughout this article, we've looked at the types of VPNs and the components and protocols that they use. Over time, people have developed new and better technologies to use in networks, which improves the features of existing VPNs. VPN-specific technologies, though, such as tunneling protocols, haven't changed much in that time, perhaps because current VPNs do such a good job at to keep businesses connected around the world. Tunnel on to the next page for lots more information about virtual private networks.