VPN – Virtual Private Network explained

What is a VPN?

Virtual Private Network – each of the three words carries meaning. Private, because only authorised members take part. Network, because those members can reach one another as they would on a local network. Virtual, because there is no dedicated line for it: the VPN uses someone else's infrastructure, as a rule the public internet, and lays its own logic on top.

The principle is older than today's internet. What is new is the expectation attached to it: confidentiality on a line you do not control yourself.

How a VPN works technically

• Tunnelling: the actual network packets are wrapped completely inside a transport protocol and carried as its payload. The transport network sees only the outer envelope, not the contents.
• Encryption: the tunnel is secured cryptographically, so nobody along the way can read along or alter packets unnoticed.
• Authentication: client and gateway identify themselves to one another – using certificates, key pairs or pre-shared keys. Without this step, encryption protects only against eavesdropping, not against a substituted counterpart.
• Gateway: at the endpoint everything is unwrapped and forwarded into the target network. The gateway is therefore the place where policies, logging and access rights take effect.
• Routing: whether all traffic passes through the tunnel or only the traffic for particular destinations is decided by the configuration. The second option is called split tunnelling – it is faster, but it bypasses the central protection mechanisms for everything else.

Widely used protocols are WireGuard, OpenVPN and IPsec/IKEv2. They differ in code base, handshake and performance, not in the underlying principle.

Types of VPN

Remote access (end-to-site)

A single device connects into a company network. The classic case for home office, field service and administrative access.

Site-to-site

Two networks are permanently coupled, for example two locations, or one location and a cloud environment. The end devices notice nothing of this; the tunnel runs between the gateways.

End-to-end

Two individual systems communicate directly in encrypted form, without opening up a network in between. Typical for narrowly defined use cases with a high protection requirement.

Typical scenarios

• Home office and mobile working: access to internal applications without having to publish them on the internet.
• Administrative access: SSH, database and management interfaces stay behind the tunnel instead of on a public IP address.
• Connecting locations: branch offices, data centres and cloud networks grow together into one addressable network.
• Public Wi-Fi: in hotels, railway stations and conference centres the local network operator is unknown – the tunnel takes away their view of the traffic.
• Access from restricted networks: where free access to the internet is limited, a gateway in another country relocates the exit point.

Advantages of a VPN

• Confidentiality on someone else's lines: contents stay protected even when the route to them is not.
• Smaller attack surface: internal services no longer need to be publicly reachable.
• One point of entry instead of many: rights, logging and revocations sit together at the gateway.
• Independence of location: the same working environment in the office, at home and on the move.
• Concealed destinations: the local network sees that a connection exists, not where to.

Limits and challenges

• Anonymity is relative. A VPN relocates trust, it does not remove it: what the local network operator can no longer see is now seen by whoever runs the gateway. Anyone who genuinely wants to stay unobserved has to know who operates that gateway and what is logged there.
• The tunnel does not protect the endpoint. A compromised device stays compromised – and brings its connection into the internal network with it.
• The gateway is a rewarding target. It knows every member and by definition sits on the internet. Patch level and hardened access are therefore not a side issue.
• Rights that reach too far. A VPN quickly grants access to more than the task requires. Segmentation behind it is mandatory, not optional.
• Latency and throughput. Encryption and the detour via the gateway cost performance – noticeably so with large volumes of data and real-time applications.

VPNs and centron

centron supplies the building blocks for running a VPN under your own control – in the data centre in Hallstadt near Bamberg, certified to ISO 27001 on the basis of IT-Grundschutz. You keep control over keys, logging and policies.

Best practices

• Open only the VPN port to the outside and close everything else at the firewall.
• Use key-based authentication instead of passwords, backed by a second factor.
• Segment behind the tunnel: entering the VPN should not automatically reach everything.
• Revoke the access of departing staff and unused keys on a regular basis.
• Patch the gateway software promptly and monitor operations – failed logins are an early warning signal.
• Decide on split tunnelling deliberately and document the choice.

VPN FAQ

What is a VPN?

A VPN is a virtual private network operated over someone else's infrastructure – usually the internet. An encrypted tunnel connects its members as though they were on the same local network.

Does a VPN really make you anonymous?

Only to a limited extent. The local network and the internet provider no longer see the destinations – but whoever operates the VPN gateway does. A VPN therefore shifts the question of whom you have to trust.

How do WireGuard, OpenVPN and IPsec differ?

Not in the underlying principle. WireGuard has a very small code base and is regarded as fast, OpenVPN is long-established and flexible to configure, IPsec/IKEv2 is already built into many devices and operating systems.

Does a VPN replace a firewall?

No. The VPN governs who gets in at all; the firewall governs what is reachable afterwards. Together they make for workable access control.

Do I need a VPN if the connection already uses HTTPS?

HTTPS protects the contents of individual connections. A VPN additionally protects everything that does not run over HTTPS, and makes internal services reachable without publishing them.

A secure network from German data centres

Combine self-operated VPN access with a private network built on VPC and rule-based protection from Cloud Firewalls.