A VPN (Virtual Private Network) is a technology that allows creating a secure and encrypted connection over a less secure network, such as the Internet.

What is a VPN?

A VPN is a private network that uses a public network infrastructure (such as the Internet) to securely connect remote sites or individual users.

Types of VPN

Remote Access VPN

  • **Individual users": Remote user connection
  • **Telework": Access from home
  • **Mobile devices": Connection from smartphones/tablets
  • **Secure connection": Communication encryption

Site-to-Site VPN

  • **Remote offices": Connection between branches
  • **Data centers": Data center interconnection
  • **Corporate networks": Enterprise network integration
  • **Backup": Backup connections

SSL VPN

  • **Web access": Browser-based connection
  • **Easy implementation": No client software required
  • **Portability": Works from any device
  • **Security": SSL/TLS encryption

VPN Protocols

OpenVPN

  • **Open source": Open source implementation
  • **Security": Strong encryption (TLS/SSL)
  • **Flexibility": Customizable configuration
  • **Platforms": Cross-platform

WireGuard

  • **Modern": Modern and efficient protocol
  • **Performance": High performance
  • **Simplicity": Minimalist code
  • **Security": Modern cryptography

IPSec

  • **Standard": Standard protocol
  • **Security": High security
  • **Compatibility": Wide compatibility
  • **Use": Primarily enterprise

L2TP/IPSec

  • **Combination": L2TP + IPSec
  • **Compatibility": Wide compatibility
  • **Security": Medium-high
  • **Use": Common on mobile devices

Implementation

VPN Server

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

# Basic OpenVPN configuration
# /etc/openvpn/server.conf
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3

VPN Client

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

# OpenVPN client configuration
# client.ovpn
client
dev tun
proto udp
remote servidor-vpn.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
cipher AES-256-CBC
verb 3

WireGuard Configuration

Server

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# /etc/wireguard/wg0.conf
[Interface]
PrivateKey = <server-private-key>
Address = 10.0.0.1/24
ListenPort = 51820
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT

[Peer]
PublicKey = <client-public-key>
AllowedIPs = 10.0.0.2/32

Client

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# /etc/wireguard/wg0.conf
[Interface]
PrivateKey = <client-private-key>
Address = 10.0.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = <server-public-key>
Endpoint = servidor-vpn.com:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Use Cases

Telework

  • **Remote access": Connection from home
  • **Corporate resources": Access to internal servers
  • **Security": Communication encryption
  • **Productivity": Maintain remote productivity

Privacy Protection

  • **Anonymous browsing": Hide IP address
  • **Avoid tracking": Protect browsing activity
  • **Geographic bypass": Access restricted content
  • **Public WiFi": Protection on public networks

Office Interconnection

  • **Branches": Connect remote offices
  • **Shared resources": Share resources between sites
  • **Backup": Backup connections
  • **Centralization": Centralize services

Advantages

Security

  • **Encryption": Encrypted communications
  • **Authentication": Identity verification
  • **Integrity": Protection against modifications
  • **Confidentiality": Sensitive data protection

Flexibility

  • **Location": Access from anywhere
  • **Devices": Multiple devices
  • **Protocols": Different protocols available
  • **Configuration": Customization according to needs

Cost-Effectiveness

  • **Infrastructure": Use of existing Internet
  • **Maintenance": Lower cost than dedicated lines
  • **Scalability": Easy scaling
  • **ROI": Positive return on investment

Disadvantages

Performance

  • **Latency": Increased latency
  • **Bandwidth": Speed reduction
  • **Overhead": Encryption overhead
  • **Dependency": Internet dependency

Complexity

  • **Configuration": Complex configuration
  • **Maintenance": Requires maintenance
  • **Troubleshooting": Problem diagnosis
  • **Training": Requires trained personnel

Best Practices

Security

  • **Strong encryption": Use modern algorithms
  • **Robust authentication": Implement 2FA
  • **Key rotation": Change keys regularly
  • **Monitoring": Monitor connections

Configuration

  • **Firewall rules": Configure firewall appropriately
  • **Secure DNS": Use encrypted DNS
  • **Kill switch": Block traffic if VPN drops
  • **Logs": Maintain connection logs

Maintenance

  • **Updates": Keep software updated
  • **Patches": Apply security patches
  • **Backup": Backup configurations
  • **Testing": Test connections regularly

Monitoring Tools

Basic Commands

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# Check WireGuard status
sudo wg show

# Check OpenVPN status
sudo systemctl status openvpn@server

# Check network interfaces
ip addr show

# Check routes
ip route show

Analysis Tools

  • **Wireshark": Packet analysis
  • **tcpdump": Traffic capture
  • **netstat": Connection status
  • **ss": Modern netstat tool

References