VPNs Illustrated: Tunnels, VPNs, and IPsec
Virtual private networks (VPNs) based on the Internet instead of the traditional leased lines offer organizations of all sizes the promise of a low-cost, secure electronic network. However, using the Internet to carry sensitive information can present serious privacy and security problems. By explaining how VPNs actually work, networking expert Jon Snader shows software engineers and network administrators how to use tunneling, authentication, and encryption to create safe, effective VPNs for...
Search in google:
Virtual private networks (VPNs) based on the Internet instead of the traditional leased lines offer organizations of all sizes the promise of a low-cost, secure electronic network. However, using the Internet to carry sensitive information can present serious privacy and security problems. By explaining how VPNs actually work, networking expert Jon Snader shows software engineers and network administrators how to use tunneling, authentication, and encryption to create safe, effective VPNs for any environment.Using an example-driven approach, VPNs Illustrated explores how tunnels and VPNs function by observing their behavior "on the wire." By learning to read and interpret various network traces, such as those produced by tcpdump, readers will be able to better understand and troubleshoot VPN and network behavior.Specific topics covered include:Block and stream symmetric ciphers, such as AES and RC4; and asymmetric ciphers, such as RSA and EIGamalMessage authentication codes, including HMACsTunneling technologies based on gtunnelSSL protocol for building network-to-network VPNsSSH protocols as drop-in replacements for telnet, ftp, and the BSD r-commandsLightweight VPNs, including VTun, CIPE, tinc, and OpenVPNIPsec, including its Authentication Header (AH) protocol, Encapsulating Security Payload (ESP), and IKE (the key management protocol)Packed with details, the text can be used as a handbook describing the functions of the protocols and the message formats that they use. Source code is available for download, and an appendix covers publicly available software that can be used to build tunnels and analyze traffic flow.VPNs Illustrated gives you the knowledge of tunneling and VPN technology you need to understand existing VPN implementations and successfully create your own.
Introduction\ There is a revolution going on in enterprise networking. Until very recently, enterprises that needed to link computers in geographically dispersed locations had to build their own wide area networks (WANs). Usually this meant renting expensive and, by today's Internet standard, relatively slow frame relay circuits. A typical 56 Kb/s circuit could cost several hundred, or even over a thousand, dollars a month.\ Today, the typical home computer user enjoys a broadband Internet connection having a 5 Mb/s download speed for a cost of about $40 per month. Commercial variants of this service, offering higher speeds and other amenities, are available for between $100 and $200 per month. Obviously, this significant increase in speed and decrease in cost represent a tremendous opportunity for enterprises, but they do introduce new problems.\ The Internet is an open environment and, compared to leased lines, dreadfully insecure. Increases in bandwidth and decreases in cost are worthless if they mean that an enterprise's vital data can be intercepted by competitors, or that financial transactions are subject to manipulation by outsiders. This book discusses ways to overcome these problems by recreating the security of leased lines in a public medium such as the Internet.\ The fundamental mechanism that allows us to have secure communications in the Internet is the notion of a tunnel. As we'll see, tunnels are a way of overlaying a logical or virtual network on top of a physical network. Once we have such a tunnel, we can secure it by encrypting and authenticating the network traffic that flows through it, thus recreating the security of private leased lines.\ Of course, this simple description hides a substantial set of details and problems. We'll see that it's actually quite difficult to endow such tunnels with robust security. Much of the book is concerned with exploring solutions to these problems,and seeing why the successful solutions work and where the unsuccessful ones fail.\ Source Code and Errata Availability\ Source code discussed in the text and other supporting material are available on my Web site athttp://home.netcom.com/~jsnader. The networking libraries and skeletons from Effective TCP/IPProgramming, which I mention and use occasionally in the text, are also available on the Web site.\ My readers, it turns out, are much better at finding mistakes than I am. Although I go over the text carefully, checking that every i is dotted and every t crossed, errors still manage to evade me. Fortunately, most of these are caught by the careful and fastidious professionals at Addison-Wesley. Still, some errors will no doubt escape into the final published text. As these are discovered—usually by careful readers—I add them to an errata list for the book. This list is always available at my Web site.\ Colophon\ As with my previous book, I produced camera-ready copy for this text using James Clark's splendid Groff typesetting suite (now maintained by Ted Harding and Werner Lemberg) and Rich Stevens' modified ms macros.I used the gpic, gtbl, and geqn preprocessors for the figures, tables, and mathematical notation, respectively. Some of the figures use gpic macros from Rich Stevens and Gary Wright. Indexing tools from Jon Bentley and Brian Kernighan were a huge help in the production of the index. I included the source code for the programming examples directly from their source files with Dave Hanson's loom utility. The text is set in the Palatino typeface.\ As always, I welcome readers' comments, suggestions, and corrections. Please feel free to email me at the address below.\ Jon C. Snader\ jsnader@ix.netcom.com\ http://home.netcom.com/~jsnader\ Tampa, Florida October 2005\ 032124544XP10122005
Ch. 1Introduction3Ch. 2TCP/IP overview9Ch. 3Cryptography overview57Ch. 4Tunnels89Ch. 5Virtual private networks155Ch. 6Secure sockets layer165Ch. 7SSH207Ch. 8Lightweight VPNs267Ch. 9IPsec307Ch. 10IPsec architecture311Ch. 11AH325Ch. 12ESP341Ch. 13IKE357Ch. 14IPsec futures397
