TweetFollow Us on Twitter

Virtual Private Networks

Volume Number: 21 (2005)
Issue Number: 3
Column Tag: Programming

Virtual Private Networks

by Brad Belyeu

Secure E-commuting

How to securely get to the office on the information super-highway

Introduction

Let's say your working on a big project at the office. Of course, the project is saved on the fileserver for security and accessibility reasons. The big deadline is Friday at five, and you or one of your team-members becomes deathly ill a couple days before. Or what if there was a blizzard? How in the world are you going to work on this project for your biggest client when you can't make it to the office? Create a virtual office! Using a virtual private network, you could access the network file, application, & print servers just as if you were there. When you connect to a VPN, it appears as though your computer sits right on the local network. Access is not as fast as physically being on the LAN, but when you can't be there it's the next best thing.

Defining VPN

VPNs (or Virtual Private Networks) come in many shapes and sizes. It has been a buzzword that is fairly ambiguous and has taken on different meanings over time. VPNs provide secure remote access to internal (private) networks over public networks, usually the Internet. The problem in defining VPNs has to do with its ambiguity. Virtually all networks are virtual in some sense of the word. I don't have a direct cable connection to all the Internet resources I use on a daily basis. But I get to those resources through a public network, and they are often located on someone else's private network. Besides, what one person considers private is often not private enough for someone else. VPNs can't be defined by any specific software protocols because there are several different common protocols that work effectively.

Virtual private networks can be hardware or software based. Using Mac OS X Server or a software application like VPN Tracker Server allows you to create a software VPN server, but most VPN servers are pieces of hardware external to your computer. VPN hardware is often included inside a firewall or router. For example, I use the Linksys WRV54G, which is an Internet connection-sharing router, wireless access point, VPN endpoint, & firewall all wrapped up in a single box. Cisco makes some very powerful VPN hardware for large networks. Most software servers are created for a one to one connection using client-server based technology.

There are two main types of VPNs and I will define them by the endpoints they connect. The first is the client to LAN (local area network) connection. A local area network is your private internal network. You normally use this connection for remote users to connect to a single office from anywhere with Internet access. This is useful for telecommuting. If you have employees that work in the field but need access to office databases, this is the type of VPN that you need. The other VPN type is LAN to LAN. This VPN type is usually used to connect the resources at two office locations so they look like a single LAN. This is often used when a company has a corporate location and other locations that need access to the corporate resources, or when resources are distributed across a couple of locations.

But Why?

When companies wanted to connect different office locations together before the Internet was widespread, they normally had to lease lines from a cable company to connect the locations. This kind of a network is referred to as a trusted VPN. This was a secure way to build a network since no one outside the buildings had access to the network as long as the cable company protected their switches, but it was also a very expensive way to share resources. With the advancement of the Internet, it became clear that using public lines instead of privately leased lines could connect offices much less expensively. But could a network over public lines be trusted for private (secure) communication? Because of the need to protect data, secure VPNs were developed. Secure VPNs use network protocols to encrypt data as it leaves the originating network and then decrypt it when it arrives at its destination. If you are using a combination of both trusted and secure VPN technology, it is referred to as a hybrid VPN.

VPN Protocols

PPP (point-to-point protocol) is a protocol that allows users to dial-up a connection to access the Internet. This connection is basically a VPN. You're using public telephone lines to access the Internet, but the access is insecure. Point-to-point tunneling protocol (PPTP) is a protocol developed by several companies but usually associated with Microsoft. Microsoft added it into every OS release since Windows 98. PPTP was built on PPP technology to create a "tunnel" allowing secure passage of information. PPP is the parent technology of PPTP, and PPTP couldn't exist without PPP. PPTP sends data in encapsulated PPP packets, which are then encapsulated within IP packets. Encapsulation allows you to send different protocols over IP. That means you can send more than just IP packets over the VPN. It's like wrapping presents. You normally use different kinds of wrapping paper for different occasions, Christmas paper, birthday paper, etc. PPTP can only deliver IP packets over the Internet, which would be like demanding a present be wrapped in Christmas paper to be delivered. But if it's really a birthday present, PPTP allows you to wrap the present in birthday paper, then wrap it in Christmas paper for delivery. After the packet is delivered, the packet header knows that it is really a birthday present and takes off the Christmas wrapping paper at its final destination. That is how you can send IPX or NetBEUI packets over IP with PPTP. The trick of PPTP being able to send other packets over IP lies in the fact that it runs at the OSI (open systems interconnection) layer 2, or link layer. PPTP relies on PPP for its authentication and encryption methods. PPTP can be used to create a 'tunnel' between two locations using TCP port 1723. Once the TCP connection is established, both control messages and data packets are sent from one endpoint to the other. These control messages do everything from initializing the VPN, to keeping it alive, and closing the VPN session. Control messages also serve other maintenance functions for the VPN. The weaknesses of PPTP are that it does not provide strong encryption for protecting data nor does it support any token-based methods of authenticating users.

L2TP (layer 2 tunneling protocol) combines the best features of PPTP and L2F from Cisco Systems into one protocol. The Internet Engineering Task Force (IETF) standardized L2TP for tunneling PPP across a public network. The main two components of L2TP are the Access Controller (LAC) and the Network Server (LNS). L2TP is similar to PPTP and runs over the OSI layer 2 so it can also route other protocols through IP packets. Data is forwarded from the LAC, which can be your own computer or your ISPs, to the LNS. If you're inside a private network, L2TP may be fine by itself. Because L2TP can't prevent packets from being changed, stolen, or faked, it is usually combined with IPSec when used across the Internet.

IPSec is the most secure way to connect to a VPN network. There are two components to IPSec: the authentication header (AH) and the Encapsulating Security Payload (ESP). The AH creates a special hashing algorithm and a specific key known only to the source and destination, which is used to check for packet integrity. A security association is setup between the devices and the AH stores the output of the special computation. Then the receiving device does the same computations, it checks the AH to make sure the computations are the same. This verifies that the packet has not been altered from its original state. It is a checksum type of authentication. The AH provides authentication but not privacy; the ESP does that by encrypting the data. The ESP encryption algorithm is a key known only to the source and destination so no one in-between can decrypt the transmitted data.

IPSec can run in two different modes. These modes relate to how IPSec is set up. If two routers are creating a VPN connection, it uses tunnel mode; but if the VPN is host to host, it uses transport mode. In transport mode, only the data portion of the packet is encrypted. To obtain maximum security, one should use tunneling mode where the entire IP packet is encrypted and authenticated. The only downfall of IPSec is that it runs on OSI layer 3 and only supports IP packets. There is a way to overcome this however. Bundling L2TP with IPSec allows a VPN with maximum security and multiple protocols. Because IPSec by itself has no way of tunneling, it is normally only used with L2TP. L2TP creates the tunnel and IPSec allows it to be secure. This is the most secure way to create a private network and is being adopted as the best standard. RFC 3193 describes the standard for bundling L2TP & IPSec. (http://www.faqs.org/rfcs/rfc3193.html)

OS 10.3 & VPNS

OS 10.3 Panther has built in VPN client support through the Internet Connect application (see figure 1). It currently allows for two different kinds of VPN connections: PPTP or L2TP over IPSec in transport mode.


Figure 1. VPN Connections

Apple doesn't allow for plain IPSec connections because, "Pure IPSec only provides user authentication or configuration of the client machine through protocols which are either proprietary or defined by the long-expired IETF drafts, which are not standards. Using PPP/L2TP over IPSec is the only "standard" way of doing remote access with user authentication and IP address assignment over IPSec at this time." (http://docs.info.apple.com/article.html?artnum=108088) What Apple means by "Pure IPSec" is using IPSec without the internal encapsulation. The built-in functionality of the VPN client for OS X is very limited, but there are good applications for expanding that functionality. VPN Tracker (http://www.apple.com/downloads/macosx/networking_security/vpntracker.html) is an excellent application for customizing your VPN connection. VPN Tracker is one of many products developed by equinux for VPNs. VPN Tracker allows you to customize every option of the connection (see figure 2). It also has built in support for a large number of VPNs from major vendors. If you choose the option for that specific VPN server, it will automatically set all the necessary options for you.


Figure 2. VPN Tracker

Equinux also makes a VPN Tracker Server in case you want to setup a VPN connection to a specific computer on your network. If you decide to setup a software VPN and you are behind a NAT (Network Address Translation) router, you need to make sure it has VPN pass-through enabled or the proper TCP/UDP ports are being forwarded.

Conclusion

Setting up a VPN can be complicated; but with the proper hardware & software, the average Macintosh user can do it. With all the different protocols, setup needs to be thought out before hand. If you choose a hardware router/VPN, research the manufacturers products first to see which protocols they work with. I've had no problem with my Linksys router, and I've setup other common brands that have worked as well (D-Link, Netgear, etc.) I would suggest viewing equinux's website at http://www.equinux.com/us/products/vpntracker/interoperability.html for a list of products that work with VPN Tracker. If you're going to use Internet Connect, it is very compatible with a large range of products; but doesn't offer near as much customization as VPN Tracker. I strongly suggest downloading and trying out equinux's VPN Tracker to keep those private networks secure!


Brad Belyeu is the President of ABConsulting based out of Oklahoma City, OK. He is an Apple Certified Technician and a member of the Apple Consultant Network.

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

The best video player on mobile
We all know the stock video player on iOS is not particularly convenient, primarily because it asks us to hook a device up to iTunes to sync video in a world that has things like Netflix. [Read more] | Read more »
Four apps to help improve your Super Bow...
Super Bowl Sunday is upon us, and whether you’re a Panthers or a Broncos fan you’re no doubt gearing up for it. [Read more] | Read more »
LooperSonic (Music)
LooperSonic 1.0 Device: iOS Universal Category: Music Price: $4.99, Version: 1.0 (iTunes) Description: LooperSonic is a multi-track audio looper and recorder that will take your loops to the next level. Use it like a loop pedal to... | Read more »
Space Grunts guide - How to survive
Space Grunts is a fast-paced roguelike from popular iOS developer, Orange Pixel. While it taps into many of the typical roguelike sensibilities, you might still find yourself caught out by a few things. We delved further to find you some helpful... | Read more »
Dreii guide - How to play well with othe...
Dreii is a rather stylish and wonderful puzzle game that’s reminiscent of cooperative games like Journey. If that sounds immensely appealing, then you should immediately get cracking and give it a whirl. We can offer you some tips and tricks on... | Read more »
Kill the Plumber World guide - How to ou...
You already know how to hop around like Mario, but do you know how to defeat him? Those are your marching orders in Kill the Plumber, and it's not always as easy as it looks. Here are some tips to get you started. This is not a seasoned platform... | Read more »
Planar Conquest (Games)
Planar Conquest 1.0 Device: iOS Universal Category: Games Price: $12.99, Version: 1.0 (iTunes) Description: IMPORTANT: Planar Conquest is compatible only with iPad 3 & newer devices, iPhone 5 & newer. It’s NOT compatible with... | Read more »
We talk to Cheetah Mobile about its plan...
Piano Tiles 2 is a fast-paced rhythm action high score chaser out now on iOS and Android. You have to tap a series of black tiles that appear on the screen in time to the music, being careful not to accidentally hit anywhere else. Do that and it's... | Read more »
Ultimate Briefcase guide - How to dodge...
Ultimate Briefcase is a simple but tricky game that’s highly dependent on how fast you can react. We can still offer you a few tips and tricks on how to survive though. Guess what? That’s exactly what we’re going to do now. Take it easy [Read more... | Read more »
SoundPrism Link Edition (Music)
SoundPrism Link Edition 1.0 Device: iOS Universal Category: Music Price: $4.99, Version: 1.0 (iTunes) Description: ***Introductory price for a the first few days after launch - if you're reading this, get it while it's fresh out of... | Read more »

Price Scanner via MacPrices.net

12-inch 1.2GHz Silver Retina MacBook on sale...
B&H Photo has the 12″ 1.2GHz Silver Retina MacBook on sale for $1399 including free shipping plus NY sales tax only. Their price is $200 off MSRP, and it’s the lowest price for this model from... Read more
iPads on sale at Target: $100 off iPad Air 2,...
Target has WiFi iPad Air 2s and iPad mini 4s on sale for up to $100 off MSRP on their online store for a limited time. Choose free shipping or free local store pickup (if available). Sale prices for... Read more
Target offers Apple Watch for $100 off MSRP
Target has Apple Watches on sale for $100 for a limited time. Choose free shipping or free local store pickup (if available). Sale prices for online orders only, in-store prices may vary: - Apple... Read more
Apple refurbished 2014 13-inch Retina MacBook...
Apple has Certified Refurbished 2014 13″ Retina MacBook Pros available for up to $400 off original MSRP, starting at $979. An Apple one-year warranty is included with each model, and shipping is free... Read more
Macs available for up to $300 off MSRP, $20 o...
Purchase a new Mac or iPad using Apple’s Education Store and take up to $300 off MSRP. All teachers, students, and staff of any educational institution qualify for the discount. Shipping is free, and... Read more
Watch Super Bowl 50 Live On Your iPad For Fre...
Watch Super Bowl 50 LIVE on the CBS Sports app for iPad and Apple TV. Get the app and then tune in Sunday, February 7, 2016 at 6:30 PM ET to catch every moment of the big game. The CBS Sports app is... Read more
Two-thirds Of All Smart Watches Shipped In 20...
Apple dominated the smart watch market in 2015, accounting for over 12 million units and two-thirds of all shipments according to Canalys market research analysts’ estimates. Samsung returned to... Read more
12-inch 1.2GHz Retina MacBooks on sale for up...
B&H Photo has 12″ 1.2GHz Retina MacBooks on sale for $180 off MSRP. Shipping is free, and B&H charges NY tax only: - 12″ 1.2GHz Gray Retina MacBook: $1499 $100 off MSRP - 12″ 1.2GHz Silver... Read more
12-inch 1.1GHz Gray Retina MacBook on sale fo...
B&H Photo has the 12″ 1.1GHz Gray Retina MacBook on sale for $1199 including free shipping plus NY sales tax only. Their price is $100 off MSRP, and it’s the lowest price available for this model... Read more
Apple now offering full line of Certified Ref...
Apple now has a full line of Certified Refurbished 2015 21″ & 27″ iMacs available for up to $350 off MSRP. Apple’s one-year warranty is standard, and shipping is free. The following models are... Read more

Jobs Board

*Apple* Retail - Multiple Positions (US) - A...
Job Description: Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
*Apple* Subject Matter Expert - Experis (Uni...
This position is for an Apple Subject Matter Expert to assist in developing the architecture, support and services for integration of Apple devices into the domain. Read more
*Apple* Macintosh OSX - Net2Source Inc. (Uni...
…: * Work Authorization : * Contact Number(Best time to reach you) : Skills : Apple Macintosh OSX Location : New York, New York. Duartion : 6+ Months The associate would Read more
Computer Operations Technician ll - *Apple*...
# Web Announcement** Apple Technical Liaison**The George Mason University, Information Technology Services (ITS), Technology Support Services, Desktop Support Read more
Restaurant Manager - Apple Gilroy Inc./Apple...
…in every aspect of daily operation. WHY YOU'LL LIKE IT: You'll be the Big Apple . You'll solve problems. You'll get to show your ability to handle the stress and Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.