3

I don't think this question has been asked here before because I've searched for an answer but couldn't find it:

Assuming we have a VPN connection (site-to-site or client-to-site) from site A to site B - if a machine in site A connects to site B, is it necessary that it becomes a part of the site B network, e.g. can it access the same local resources like shared drives, printers, etc that local machines in site B can?

If so, how does this work? Nothing that I know about VPN covers this aspect of it. VPN is supposed to provide you a safe/secure route from site A to site B through the Internet, so that you don't need to use a leased line to transfer data securely. Where does the idea of local machines in Site A having the same network level access as local machines in Site B come in?

I don't see any VPN protocols having anything in their specifications/implementation to support this. How does this happen?

Also, do local machines in Site A get a site B IP address assigned to them like site B local machines do?

Improve this question

1 Answer 1

Reset to default
1

This question is really broad, and much depends on the products used, and the specific implementation.

In general, a VPN is a tunnel, which looks like a point-to-point link. A network-to-network VPN can certainly be made to look like the networks are connected with a simple point-to-point cable. Also, a host-to-network VPN can be made to look like the host is a host on the network where it is connected via VPN.

A tunnel, such a a VPN, merely encapsulates packets inside other packets, hiding the complexity of the actual path from the endpoint networks/devices. The inner packets are usually addressed as if they were on the target network.

Addressing can be handled in a few ways, and security depends on the security applied. NAT could be applied to packets leaving and/or coming into a VPN. Traffic coming into a network via VPN may be restricted by various security features on the target VPN.

Improve this answer
7
  • "The inner packets are usually addressed as if they were on the target network." This is exactly what I'm interested in. I haven't seen anything in the specs of typical VPN protocols like PPTP, L2TP, IPSec, etc that would let you achieve this. Is this feature added on top by different products as this doesn't seem like it's a part of the protocol specification.
    – Jerry Meakin
    Commented Apr 6, 2016 at 17:54
  • The protocol specifications really deal with the outer packet headers of the tunnel. What's carried in the tunnel is normal network traffic. Functionally, a tunnel is just like connecting an ethernet cable between two networks, or a host and a network. The ethernet standard doesn't specify what ethernet carries, e.g. IPv4, IPX, IPv6, etc.
    – Ron Maupin ♦
    Commented Apr 6, 2016 at 17:57
  • Ah. That makes a bit more sense. So you're saying the inner packets resemble traffic that would normally be doing the rounds in the target network. Meaning if the remote client sends "ping 10.100.50.50" via the VPN tunnel where 10.0.0.0 is the target network, the VPN gateway would execute this ping on behalf of remote client and send back the response? Thereby making the remote client think that it's part of the target network?
    – Jerry Meakin
    Commented Apr 6, 2016 at 18:02
  • The host initiating the ping would ping the address on the target network. The VPN tunnel would take the ping packets, encapsulate them in the tunnel packet header, and send them to be routed normally. the receiving network would strip off the tunnel headers, and drop the inner packets onto its network. Then, usual network functions, e.g. security, QoS, etc., can be applied to the packets.
    – Ron Maupin ♦
    Commented Apr 6, 2016 at 18:06
  • Making a lot more sense now. Just a few more gaps in understanding. So far what I've got is: Once a VPN connection is established, a network interface will be setup on the client machine that will be dedicated to carrying over traffic destined for the target network IP range. When traffic needs to be sent via the VPN, the network interface will be used and the VPN tunnel will tunnel the traffic to the target network's VPN gateway. Once it reaches there, how does the VPN gateway decide what needs to be done with the traffic next?
    – Jerry Meakin
    Commented Apr 6, 2016 at 18:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.