English
Menu

What is VPN (virtual private network)?

A mechanism that builds an encrypted virtual private channel (a tunnel) over a shared network such as the internet, so that distant sites and outside devices communicate as if they were connected directly to the internal network. Methods include IPsec, TLS (SSL-VPN) and WireGuard.

Japanese name: VPN

VPN (virtual private network) appears in 6 practice questions across 3 topics, including Cyber Attacks and Defense in Practice, Computer Networking Basics, System Architecture and Reliability.

Field: Computer Networking Basics

Tunnels and encapsulation

A VPN device or program encrypts the whole IP packet to be sent, adds a code for tamper detection and sends the result as the payload of a new IP packet addressed between the two VPN endpoints (encapsulation). The receiving endpoint takes it out, decrypts it and passes the original packet into the internal network. The internet in between sees neither the content nor the original addresses, and private internal addresses can be used as they are. Because the extra headers leave less room for the inner packet, the MTU sometimes has to be adjusted.

Site-to-site and remote-access VPNs

A site-to-site VPN places a VPN device at each location, such as head office and branches, and links their LANs; users are not aware of it. A remote-access VPN lets a PC at home or on a trip connect to the company's VPN device with client software. Methods include IPsec, which encrypts at the network layer and exchanges keys with IKE; SSL-VPN, which uses TLS; and the newer WireGuard, which runs over UDP. Some VPNs do not cross the internet at all, such as IP-VPN services that run over a carrier's closed network.

What a VPN protects, and its limits

A VPN protects traffic between the device and the VPN endpoint, so even on easily eavesdropped networks such as public Wi-Fi the content of that stretch cannot be read. Traffic beyond the endpoint is ordinary traffic, and a VPN cannot help if the device itself is infected with malware. Because VPN devices are exposed to the internet, their vulnerabilities can be exploited as a way in, so prompt updates and multi-factor authentication are essential. The weakness of the idea that a connected user can reach anything inside has also encouraged zero trust, which verifies every access.

Try it: questions about VPN (virtual private network)

Which correctly describes an internet VPN?

  1. AIt switches the communication path to a dedicated physical line so that traffic does not cross the internet
  2. BWith a VPN you can communicate safely even if the server or device you connect to is infected with malware
  3. CIt creates a virtual private channel (tunnel) with encryption and authentication over the internet, so that remote sites or home devices are treated as if connected to the internal network
Show answer and explanation

Answer: C. It creates a virtual private channel (tunnel) with encryption and authentication over the internet, so that remote sites or home devices are treated as if connected to the internal network

In a VPN (virtual private network), original packets are encrypted and placed inside other packets (encapsulated), then extracted by the VPN device on the other side. The contents and internal addresses cannot be seen along the path, and tampering can be detected. Protocols used include IPsec, TLS-based ones and WireGuard. Physically, it differs from a leased line in that it travels over the shared internet. Only the tunnel section is protected, so the security of the destination itself and of traffic beyond the VPN exit must be considered separately.

Which of the following correctly compares a traditional remote-access VPN with ZTNA (zero trust network access) as ways for remote employees to use internal systems?

  1. AZTNA connects a device to the whole internal network once it connects, so it gives free access to more systems than a VPN, without any checks
  2. BWith a VPN a connected device can often reach a wide range of the internal network, whereas ZTNA checks the user and device and connects them only to the applications allowed
  3. CBoth VPN and ZTNA merely encrypt traffic, and there is no difference at all in the range of systems a connected user can access
Show answer and explanation

Answer: B. With a VPN a connected device can often reach a wide range of the internal network, whereas ZTNA checks the user and device and connects them only to the applications allowed

A remote-access VPN makes an outside device part of the internal network; after connecting, it can often reach widely whatever the network settings allow, and stolen credentials become a foothold for intrusion. ZTNA checks the user's authentication and the device state and then brokers connections only to individual allowed applications, without exposing the applications directly to the internet. This reduces how far an attacker can reach after a compromise. VPN appliances themselves are also exposed to the internet, and their vulnerabilities often become the path of intrusion, which is one reason for the migration.

FAQ

Does a VPN make me anonymous?

Not completely. Websites see the VPN's exit address instead of yours, but whoever runs the VPN can see whom you communicate with. Logins and cookies can still identify you.

What is the difference between IPsec and SSL-VPN?

IPsec encrypts IP packets themselves at the network layer, so it can carry traffic from any application and is common for site-to-site VPNs. SSL-VPN uses TLS, so it is easy to use from a web browser or dedicated software and passes through firewalls easily, which makes it common for remote access.

VPN (virtual private network) in the explanations

Questions that mention VPN (virtual private network) (6)

  1. Which correctly describes an internet VPN?
  2. Which of the following correctly compares a traditional remote-access VPN with ZTNA (zero trust network access) as ways for remote employees to use internal systems?
  3. Which describes a CDN (content delivery network)?
  4. Which correctly describes the basic function of a (packet-filtering) firewall?
  5. Which of the following is an "initial access" method, by which an attacker first gets into an organization's network?
  6. In the same week, fixes were released for three vulnerabilities. The operations staff can apply only one fix per day. Which of the following is the most appropriate combination of the fix to apply first and the reason?

Books on Computer Networking Basics Ad

As an Amazon Associate I earn from qualifying purchases.

Related terms

Packet TLS Zero trust CDN (content delivery network) Firewall WAF (web application firewall) Phishing Ransomware Multi-factor authentication ARP

Back to the glossary