Virtual Private Networks
A virtual private network, or VPN, creates a protected path for network traffic across an untrusted network. You use one to connect a device or network to another trusted network without leasing a private physical link.
itNetworking | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Don't Panic
Don't Panic - Virtual Private Networks
Virtual Private Networks is the subject of this course. A virtual private network, or VPN, carries selected network traffic through a protected tunnel across another network. The outer network might be the public internet.
The useful unit of work is a closed loop: clarify the goal and boundaries, gather the inputs the practice requires, make the decision or change, record evidence, and return with owners for the next cycle. Skipping any link leaves teams busy without durable results.
Tooling supports the loop; it does not replace it. Choose tools after the boundary and evidence model are clear. Comparing products without that model produces feature matrices that do not change how the work runs.
Common failure modes include undefined ownership, metrics that count activity instead of outcomes, and irreversible steps taken without a review path. Treat those as design defects in the practice, not as individual heroics to compensate later.
Operators should be able to explain which signals would change a decision this week. If no signal can change the plan, the practice has become ritual. Keep the feedback path short enough that evidence still influences the next cycle.
Name the owners for each stage of the loop before the work scales. Unowned stages become permanent exceptions. Record decisions with enough context that a future operator can tell why a tradeoff was accepted. Prefer fewer, sharper metrics that change behavior over broad dashboards that only describe activity after the fact.
Read the Intro for the core model. Use the Cheatsheet when you need the operating map. Updates tracks official guidance when this course configures an update source; otherwise the practice is settled without a live feed.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://csrc.nist.gov/pubs/sp/800/77/r1/final
Supports
- IPsec VPN definition, architecture, deployment, and operational guidance
- Remote-access and gateway-to-gateway use cases
- IPsec tunnel and transport mode distinctions
- IKE use for IPsec configuration and key establishment
- Design, implementation, monitoring, and maintenance controls
- Quiz answers on tunnel boundaries, topology, IKEv2, routing, and troubleshooting
- https://csrc.nist.gov/pubs/sp/800/113/final
Supports
- TLS-based VPN remote access
- Portal, application, and network-access models
- Full-tunnel and split-tunnel planning considerations
- Comparison of TLS-based and IPsec VPN approaches
- Quiz answer about full-tunnel and split-tunnel behavior
- https://csrc.nist.gov/glossary/term/split_tunneling
Supports
- Split tunneling as organization-specific traffic through the VPN and other traffic through the normal gateway
- Quiz answer distinguishing split and full tunnel routing
- https://www.rfc-editor.org/info/rfc4301/
Supports
- IPsec security architecture
- Security policy and traffic selector processing
- Directional security associations
- Transport and tunnel mode
- Quiz answers about tunnel mode, route selection, and selectors
- https://www.rfc-editor.org/info/rfc4303
Supports
- ESP confidentiality, data-origin authentication, connectionless integrity, anti-replay, and limited traffic-flow-confidentiality services
- ESP transport-mode and tunnel-mode packet processing
- Outer metadata and traffic-flow-confidentiality limits
- Quiz answers about ESP services and tunnel mode
- https://www.rfc-editor.org/info/rfc7296/
Supports
- IKEv2 peer authentication
- Algorithm negotiation and key derivation
- IKE and child security association establishment
- Quiz answer about IKEv2 responsibilities
- https://www.cisa.gov/news-events/alerts/2024/06/18/cisa-and-partners-release-guidance-modern-approaches-network-access-security
Supports
- Risks from traditional remote access and VPN misconfiguration
- Evaluation of zero trust, secure service edge, and secure access service edge approaches
- Need for greater visibility into network activity
- Quiz answers about separate authorization, broad access, and narrow application access
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-356a
Supports
- VPN software needs current security updates
- A VPN is only as secure as connected devices
- Quiz answer about compromised-client impact
- https://www.wireguard.com/
Supports
- WireGuard layer 3 tunnel and cryptokey routing model
- Public keys associated with allowed tunnel IP ranges
- Allowed IP behavior for outbound routing and inbound source validation
- Quiz answer about inbound allowed IP ranges
- https://github.com/sindresorhus/awesome
Supports
- Starting index used for awesome-list discovery
- Link to Awesome Selfhosted
- https://github.com/awesome-selfhosted/awesome-selfhosted
Supports
- VPN category and referral to Awesome Sysadmin's VPN section
- https://github.com/awesome-foss/awesome-sysadmin#vpn
Supports
- Discovery of WireGuard, OpenVPN, strongSwan, Headscale, and Nebula as relevant VPN ecosystem projects
- https://www.wireguard.com/quickstart/
Supports
- WireGuard interface, peer, key, endpoint, and allowed-IP setup
- Awesome Links rationale for the learner walkthrough
- https://openvpn.net/community-docs/how-to.html
Supports
- OpenVPN as a TLS-based layer 2 or layer 3 network extension
- Certificate authentication, routing, and client-server deployment
- Awesome Links rationale for OpenVPN
- https://docs.strongswan.org/docs/latest/index.html
Supports
- strongSwan as an IPsec and IKE implementation
- Modern configuration examples and swanctl tooling
- Awesome Links rationale for strongSwan
- https://headscale.net/stable/
Supports
- Headscale as a self-hosted implementation of the Tailscale control server
- Single-tailnet scope, registration, routes, policy, DNS, and relay documentation
- Awesome Links rationale for Headscale
- https://nebula.defined.net/docs/
Supports
- Nebula as a self-hosted peer-to-peer layer 3 overlay
- Certificate identity, group-aware firewall, discovery, and NAT traversal
- Awesome Links rationale for Nebula
