Hey everyone and welcome back. So now what I want to draw your attention to is the concept
of a virtual private network. Now no doubt at some point you have heard this term before
even by its short hand version a VPN and you may be able to infer by the name alone that
this has something to do with privacy and networking but the reality is we want to understand
the concept and the architecture of VPNs a little bit more before configuring our own
VPN connection. So let's talk a little bit about why a VPN would even be needed. So check
this out imagine that you had some type of site this could be a company. Let's imagine that this is
in the United Kingdom. This could be one big office with multiple floors whatever it may be. And
on those floors whatever it may be you may have lots and lots of people connected on machines
and all the way across at the other side of the world. Let's maybe say you have an office in the
United States and again lots of users within this building. Okay so we have these two distinct
offices and that is all very well and good. Now we know that locally if the people in the USA
wanted to connect to the public internet we could just have a connection to an ISP which would be
your internet service provider and that would allow the people in the USA to ultimately route
through this ISP and visit all of the sites on the internet that they would have to actually access
to use for their job. Similarly if we were in the United Kingdom we could do the same thing.
Connect to an ISP and suddenly all the users within this building now have internet access. The
question remains though is what if we happen to need connectivity between these two sites? Well I
suppose if they were close enough we could just connect one big cable between these two sites to
ultimately link and transit data across that particular link. But as we know the distance here
from the UK to the USA is not trivial so this is not really the solution that we can just use.
Ultimately what we're talking about here is a wide area network. This is a type of network that is
going to spread over a large expanse. It means that we're not going to be able to just you know
just like we could with a switch and a router grab some simple ethernet cable and plug in and
connect these two devices or these two sites in this case. Instead we have to be a little bit more
creative and this is why we have these whole different technologies known as WAN technologies
to handle those large geographical areas. So one thing we can do is we can rent a line. So really
what we would have here is if I just briefly draw this one more time. We have our site in the UK
and our site in the USA. Both of these sites could ultimately rent a circuit known as an MPLS
circuit. This is going to be provided by an external carrier who have massive infrastructure so
that it's not just you walking out and plugging in a cable. You're actually renting an entire
infrastructure puts in place which is going to cost millions and millions and millions of pounds
or dollars whatever it may be. So you really rent this service and what this would allow you to do
it means you can have this private connection all the way from the UK all the way to the USA
and this pipe ultimately which you have is going to be your little pipe. So inherently because
you're the only one who is using this particular circuit. There is a built-in security to that
circuit because well it's only you that is using it. Obviously there has to be some trust of the
third party whereby who you are actually renting the MPLS circuit from. But can you imagine what
may be the problem in utilizing this type of solution. You're going to this third party and
you are renting one particular line to connect these two sites. So if it isn't cleared quite just
yet the problem here is that this can be quite expensive you know and because of the expense it
really does hurt scalability. Let's say then that we happen to grow our company and we have more
sites popping up then how are we going to interconnect all of those other sites. I mean it
does become problematic. So this became a bit of an issue with companies worldwide and whilst MPLS
certainly does have its place it certainly has its place for things such as voice technology whereby
you can really control the quality of your voice packets. The reality is this is not the most
affordable solution and in the corporate world the dollar counts most so very often what happened
is that people were looking for other solutions. Now one big wide area network that we all use all
the time is the internet. Think about it if I happen to be here in Scotland in the United Kingdom
and I want to talk to my friend Trevor in the USA. Well we can actually talk to each other say for
example over Slack or over Discord whatever it may be and the way the connection is facilitated
is actually using the public internet. So that got people thinking if we can ultimately communicate
long distance over the public internet internet connections are not very expensive then why can't
we implement this in a corporate setting and this really is the type of solution what we're talking
about therefore we could then have our USA office as well as our UK office and we want to facilitate
this connection by both sites reaching out to the public internet. Now I want to be clear here what
we're not talking about is just using something like say a chat application like Slack or Discord.
What we actually want here is we want a connection that is going to use the public internet but over
that public internet we're going to create a very specific tunnel. Now that tunnel is going to do
something pretty cool so let's imagine that we had some type of internal IP address like say let's
say 192.168 and this could be 1.0 slash 24 that would be the private IP addressing within
this corporation remember we talked about that we can have private IP addresses and then at the
edge we could have a public facing IP address which would be translated using network address
translation we talked about this earlier on within this course but crucially internally
we have this internal private IP addressing. Now if you recall when we talked about NAT,
NAT is ultimately going to hide away this private IP address and from anyone who is external say
for example people here in the USA if we want to communicate they would ultimately talk to our
public global IP address which would then be translated by the default gateway and facilitate
that connection into the private network but the site here could not actually see this internal
addressing. Now here is the difference let's imagine that this site here is going to have a
private addressing of 192.168 and let's just say this was 2.0 slash 24 so whilst we are building
the connection over the internet the net effect is it's going to feel like there is just one big
cable directly connecting these two sites that is how it is logically going to be implemented even
if not the physical architecture and that would mean that what we could do here is we would have a
tunnel interface created let's just call this ton zero and on this side here we would call this
ton zero again this interface does not physically exist it's just a logical construct so what I
could do is I can make the tunnel IP address here 10 let's just say 20 30.1 and that would be a slash
24 and this one could be 10 20 32 and these two IP addresses would be on the same network so that
this site here can talk to this site here over this network and if we have private IP addressing
on other interfaces say for example these two here we can ultimately advertise them via routing
protocols if we so wish meaning that the USA site over the internet ultimately can see the private IP
addressing advertised by the UK site and vice versa now this is not just the benefit of using VPNs of
course for the regular end user been able to see internal IP addressing is not very useful but the
reality is for sharing local and private resources say for example a server or a printer that is on
this particular network in the UK it can feel like that server or printer physically resides in the
USA sites to an end user even though its physical location is on the other side of the world because
like I say we are constructing this tunnel interface over the public internet so really what we're
doing is that we are allowing remote sites and their resources to appear as if they are actually
local to us so things which are otherwise hidden behind firewalls things which are otherwise
addressed internally servers suddenly become accessible to remote systems and again we can do
this in an inexpensive way by utilizing a simple cheap internet connection so no more big expense
and because we're going to utilize cryptography we're also going to have a fully encrypted
connection which is secure as well as you guessed it as in the name private so when we have a solution
which is private secure as well as inexpensive you can clearly see why VPNs are very very popular
in the enterprise world now one thing to note about VPNs is that we can have different types of
VPNs we could have a site to site VPN and that is the architecture which I just described we have
one location say for example like I say in the UK we could have another one in the USA
two separate sites however we can also just set up a remote access VPN and this is very very popular
this would mean that again you could have one main headquarters let's just say your headquarters
were located in New York City and within these headquarters you had lots of important servers
which maybe be internal databases whatever it may be and you happen to have some type of remote
user so this could be an employee with a laptop what if that employee wants to access the internal
resources of the headquarters but like I say this happens to be a remote worker meaning that this
employee he or she could take their laptop on a train and one day let's say they're in a conference
in London and then the next day they have to get a flight to go to Berlin so even if this remote
worker is continually on planes trains and automobiles it doesn't actually matter because via the
software on their laptop they can ultimately still utilize an internet connection and build that tunnel
from their wi-fi connection whatever it may be in London into the headquarters so that they can
access the internal sites or the internal resources should I say on the site or like I say they shut
down the connection they go to Berlin they then re-establish their VPN connection they can then
VPN back into the headquarters this time via Berlin ultimately the net effect is the same we have
the privacy and the security of the connection itself because it's going to be encrypted and
it's not going to be expensive at all and in fact the remote worker may just be using a public wi-fi
connection that is costing them nothing so you can see the advantages of that but ultimately
realistically what we're talking about with the VPN is just a secure cheap way to connect sites or
people over a relatively large area and make them appear as if they're working within the same office
side by side so that really is the general gist of what a VPN is going to give us we still have
more components to look at within the VPN and that's what we'll be doing in the very next nugget
so I hope it's been informative for you and I'd like to thank you for viewing