0

Am trying to understand how IPSEC in tunnel mode achieves the VPN functionality. I understand that the IP header and payload along with TCP/UDP headers are encrypted. But, if the src and dst addresses of the outer un-encrypted IP header is same as the IP addresses (SRC and DST) in the inner original encrypted IP header, then anyone who sniffs the packet will know which two end-points are communicating.

so, my question is what are the IP addresses used in outer un-encrypted IP HDR in a typical implementation? Is there any guide-lines specified in the RFC ?

Improve this question
1
  • What you are referring to with the term "VPN functionnality" clearer (encryption and authenticity) is the use of both IPsec protocols ESP and AH in addition to the tunnel mode.
    – Brahim Gaabab
    Commented May 16, 2022 at 22:09

2 Answers 2

Reset to default
2

They are not the same in tunnel mode. The outer addresses are the VPN endpoints (the devices doing the encryption). The inner (encrypted) addresses are the hosts that are communicating -- the host traffic being encrypted.

Improve this answer
2
  • In my case, the VPN endpoints are the source and destination of the actual traffic also. IPSEC-EP1------------IPSEC-EP2. Here, IPSEC-EP1 generates the traffic and IPSEC-EP2 consumes the traffic. So, here does it make sense to have a IPSEC in tunnel mode ? Because, here I will have to use the same IP address in inner and outer IP header , right ?
    – Hemanth
    Commented May 17, 2022 at 8:16
  • Perhaps not. Transport mode may make more sense, although practically speaking many devices don’t support it.
    – Ron Trunk
    Commented May 17, 2022 at 10:38
1

The main point is that the tunneled packets are encapsulated and encrypted on the tunnel entrance (using ESP), and decrypted and decapsulated in their original form on exit.

The outer packet is used to send the encapsulated, encrypted payload between the tunnel terminators = VPN gateways. The inner and outer IP addresses have no relation whatsoever, and there's no translation either. The inner addresses belong to the (usually private) hosts and the outer ones to the VPN gateways (usually on the public Internet).

Improve this answer
4
  • plz check by comment above.
    – Hemanth
    Commented May 17, 2022 at 8:17
  • I'm not really understanding your scenario, but usually you route traffic to be encrypted into the tunnel. For that you require different addresses, even if virtual. If you route traffic directly to the (public) address of the tunnel partner it won't get encrypted.
    – Zac67 ♦
    Commented May 17, 2022 at 8:24
  • Lets take a hypothetical example. Lets say, User1 and User2 host machines wants to communicate over the internet. But, this communication has to be protected for CIA( Confidentiality, Integrity and Authentication). What if both users run a IPSEC software on their host itself. Here, the endpoints which generate/consume traffic are the IPSEC end-points. For, simplicity, lets consider that both end-points have public IP addresses.
    – Hemanth
    Commented May 17, 2022 at 8:57
  • I agree we can use, TLS for protecting the application data alone. But, here I want to protect the IP and TCP headers also.
    – Hemanth
    Commented May 17, 2022 at 8:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.