Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
I read wikipedia page ;but it says that we can extend over private resources publically. and user can send - receive data using public network to remote resources in perspective that it is connected to it privately.
Then, We can use ssh to transfer the data, how is different from ssh? basically, I am not getting core idea behind VPN.
traditionally ssh is used to connect from one host onto another host securely.
a vpn connects a host to another network securely. This lets your native host access resources that might be restricted to the other network via firewall, etc. Things like printers, private databases, etc. A typical use would be to put your work laptop on the office network even when you aren't in the office.
There are lots of protocols that are used to do this tunneling - SOCKS is one of them and indeed most ssh implementations can establish a SOCKS tunnel for you, but that's not generally what people are thinking of when they ask about VPN.
Lets say you have a head office. You build a network in your office, and connect it to the Internet via a firewall, most likely the firewall is also doing NAT. Within your network you deploy some servers. You also subscribe to various Internet services which identify your network through an IP whitelist.
But not all your users are at head office. Some are working from home, some are working from small branch offices, some are working on the road. They still need to access your companies services, how do they do it?
You could just have them access the services directly over the Internet but this has several problems.
You could buy private circuits from a telco but again this has problems.
A VPN solves this dilemma by creating a private network on top of a public one.
The VPN endpoint usually presents itself to the operating system as a virtual network interface. When packets are sent to this interface they are passed to the VPN software. Typically the VPN software will encrypt the packet, add it's own headers and then pass the packet back to the network stack as a payload to be sent to the other endpoint of the VPN.
The packet then passes over a network (usually the public internet) to the other end of the VPN.
When the packet reaches the other endpoint of the VPN the process is reversed. The OS receives the packet and passes it to the VPN software as a payload. The VPN software will typically validate that the packet is legitimate, decrypt it and remove the extra headers. It will then pass it back to the network stack via the virtual network interface.
Thus we effectively have a private network between the two endpoints of the VPN but the data is physically carried between the endpoints by a public network.
In addition to the simple encapsulation and deencapsulation VPN software will frequently provide other features. It will usually provide a mechanism for clients to authenticate to a server and establish a VPN session. It may provide some level of bridge or router functionality to allow a single virtual network interface on the server to serve multiple clients. It will most likely have functionality for pushing IP adresses and routing configuration to clients.
Routing on the clients may be configured to send virtually all the client's traffic down the VPN or it may be configured to only send particular traffic down the VPN. There are pros and cons to both approaches.
VPNs can operate at various network layers on both the "inside" and the "outside". On the inside a VPN may carry IP packets or it may carry Ethernet frames. On the outside a VPN may operate over a transport protocol like TCP or UDP or it may operate directly over IP,
Put all of this together we have a method of brining our remote sites and users onto our private network without needing to buy private network connections between them.
socks is a protocol for talking to proxies. It can achive some of the same goals as a VPN but operates at a higher level. Your client application makes a TCP connection to the socks proxy and then asks it to make an onward connection to the server. Once established the socks proxy passes data back and forth between the two TCP connections. If the socks proxy has access to network resources that the client can't acess directly then the client can use the proxy to access those resources.
Unlike with a VPN the client application needs to be aware of socks (though there are hacks for this). Socks does provide optional authentication but as far as I can tell unlike most VPN tools it does not provide encryption.
the fact that the client has to be aware of socks can be a pro and a con, on the one hand it limits the applicability. On the other hand it means that you can point only certain application at the socks proxy. In some cases you can even configure an application to use the socks proxy for only some connections (look up the firefox extension "foxyproxy").
ssh is primerally a tool for remote shell access to servers. It provides encryption and authentication and is generally considered to be sufficiently secure for use directly over the public internet.
While primerally intended for remote console access ssh can carry other things. It can carry application data directly between a program running on the client and a program running on the server.
One feature of ssh is port forwarding, there are three different modes, all forward connections at a TCP level. By default only connections from localhost are forwarded.
"local" the ssh client listens for TCP connections on a predetermined port. When it receives one it asks the server to connect to a predetermiend IP/port. Data is then forwarded between the two TCP connections over the ssh connection.
"remote" the ssh server listens for connections on a predetermined port. When it receives one it askes the client to connect to a predetermined IP/port. Data is then forwarded between the two TCP connections over the ssh connection.
"dynamic" the ssh client acts as a socks proxy server. When the socks client requests a connection to a particular IP/port the ssh client requests the ssh server to make a connection to that IP/port. Again data is forwarded over the ssh connection. This essentially gives you the features of socks with the encryption and authentication of ssh.
You can also use ssh to carry ppp (or possiblly slip) and make an actual VPN.
