Ravindra BagaleCourses & study guides मराठी Track your progress

32. Linux and Network Hardening

32.8 How a VPN Works

By Last updated:

Example first. In May 2021, Colonial Pipeline, the largest fuel pipeline in the US, shut down after a ransomware attack. Its CEO later told the US Senate how the attackers got in: through an old VPN account. The password had leaked, and the account had no MFA. Fuel shortages hit the US East Coast.

Why it matters

Staff need to reach office systems from home. Offices need to talk to each other and to the cloud. The internet is public, so anyone on the path could read the data. A VPN protects the data on the way. But the VPN gate itself becomes a big target. Chapter 32.6 told you to put admin access behind a VPN. This lesson shows how it works.

What it is

A VPN (Virtual Private Network) builds an encrypted tunnel across the internet. Data goes in one end, locked. It comes out the other end and is unlocked. People on the path see only scrambled data.

WordSimple meaning
TunnelA private path inside the public internet. Your data is wrapped inside another packet.
EncryptionScrambling data so only someone with the key can read it (Chapter 33).
VPN gatewayThe server or firewall at the office end that accepts VPN connections.
Remote-access VPNOne person's laptop connects to the company network.
Site-to-site VPNTwo networks join, like an office and AWS, always on.
Split tunnelOnly company traffic goes through the VPN. Other traffic goes straight out.
ProtocolSimple note
WireGuardNew, small and fast. Uses public and private keys.
IPsecOlder standard. Used for site-to-site, including AWS Site-to-Site VPN.
OpenVPNOpen source. Runs over TLS.
SSL VPNLogin through a web portal. Used by Fortinet, Ivanti and others.

How to set one up safely

  1. Pick the type: remote-access for people, site-to-site for networks.
  2. Use MFA on every VPN login.
  3. Patch the VPN gateway fast. Attackers scan for old versions.
  4. Allow only the networks each user needs.
  5. Delete VPN accounts when people leave.
  6. Send VPN logs to the SIEM. Watch for logins from new countries.

Worked examples

Worked example 1: Cafe Wi-Fi

  1. You use free Wi-Fi at a cafe.
  2. Without a VPN, the Wi-Fi owner can see which sites you visit.
  3. With a VPN, they see only scrambled traffic going to the VPN server.
  4. Note: a VPN hides traffic from the cafe. It does not make you invisible to the websites you log in to.

Worked example 2: Home to office

  1. An employee connects to the company VPN from home.
  2. The VPN gateway checks password and MFA.
  3. The laptop gets an office IP address range.
  4. The SSH security group allows port 22 only from that range.

Worked example 3: WireGuard in your own lab

On two of your own lab Linux machines:

# 1) Make a key pair on each side
wg genkey | tee private.key | wg pubkey > public.key
# 2) Write /etc/wireguard/wg0.conf with your private key
#    and the other side's public key and IP
# 3) Start the tunnel
sudo wg-quick up wg0
# 4) Check it
sudo wg show

Each side needs the other side's public key. Private keys never leave their machine.

Worked example 4: Office to AWS

  1. Create an AWS Site-to-Site VPN in the VPC.
  2. Set up the office router with the IPsec settings AWS gives you.
  3. Two tunnels come up, for backup.
  4. Office PCs reach private EC2 servers without public IPs.

Real incident: Colonial Pipeline – old VPN account without MFA (May 2021)

1. What happened

On 7 May 2021, Colonial Pipeline shut down its pipeline after a ransomware attack by the DarkSide group. The company paid a ransom of about 4.4 million US dollars. US officials later got part of it back.

2. How it happened

  1. Attackers found the password of an old VPN account. It was no longer in use, but still active.
  2. The VPN did not ask for MFA.
  3. They logged in through the VPN and started the ransomware attack.

3. How to stop it

  1. MFA on every VPN account.
  2. Remove unused accounts quickly.
  3. Watch VPN logins and alert on odd ones.

In short

  • A VPN builds an encrypted tunnel over the internet.
  • Remote-access joins one person. Site-to-site joins two networks.
  • WireGuard and IPsec are common protocols.
  • The VPN gate is a target: MFA, fast patches, delete old accounts.