There's a lot of situations when I'm on the road that I wish that I could be actually in my network
back at the office.
Now you need to be careful here.
When I'm saying in my network I'm talking about actually having an IP address that's part of my own
network.
I'm not talking about remote desktop and things like that.
Which you'll find useful from time to time.
But there are situations where I need to be literally in my own network if I copy a file from the server
onto my laptop.
I want to actually copy onto my laptop in a remote desktop situation.
I would just be copying it from my server to my computer back at the office so there are situations
where we need to be able to actually be on our local area network from far far away.
Well that's easy enough to do.
I mean if you want to let's just say this my local area network I can buy a router with dial up connections
if you want to go old school and you could literally do a dial up and connect into your router at a whopping
56 k. If you've got a bazillion dollars we could set up a high speed optical line that would run from
this router to anywhere you wanted.
Might cost you $7 billion a month but I guarantee you there are people who would be more than glad to
take your money to do exactly that.
So the challenge we have is well how do we physically connect?
Well the beautiful part is we've got the Internet.
We've already got a layer one connection between your network and your computer and it's the Internet.
So the trick here is how can we use this public tool this Internet to virtually allow us to connect
privately to our own network.
In fact that's what I'm going to call it a virtual private network or VPN. The secret to what we're trying
to achieve here folks is going to take some little laptop sitting in an airport lounge in Chicago Illinois
and we're going to through the internet connect this guy and make him a part of this network.
We're literally going to make him have an IP address
that's part of the network id of the local network.
Now there's some real challenges to that.
The first big challenges let's say here on my little network the network ID is 192 168
15.
Well those are private IP addresses so they can't even appear on the public Internet.
Now this computer over here this laptop that you're running while you're sitting in an airport lounge
I mean he can get Google and everything and he's got an IP address but it's a public IP address that's
provided by the Chicago free wireless society or whatever it might be and it doesn't have an IP address
that makes him part of this.
So we have a big challenge and what we have to do is come up with some way to allow us to have well
really two IP addresses: one public IP address to get us to our network and then another address a private
IP address that matches up. Well to do that
let's take a look at something.
So I have a highly simplified packet here and this is clearly a packet that's going between two computers.
In the 192 168 15 network.
Now a packet like this could never exist on the real Internet primarily because those are private IP
addresses.
It can't happen.
But what if I did something like this what if I took this packet and encapsulated it into a packet that
had legitimate addresses on it.
So for example this would probably be the IP address that's on my laptop that was given to me by the
Chicago free wireless society.
And this is the address to my router.
In essence what I'm trying to do is to put packets within our packets in such a way that when
the data comes from my computer and it gets into my router it strips away the public part of the IP
packet and then just leaves the private part so I can do whatever I want to do.
Equally when it's time to send it back to me I need to have something smart enough to put all that information
back on and then send it back to my computer.
And that's the beauty of VPN.
A VPN creates a tunnel between a client computer and some endpoint which is usually a router although
it doesn't always have to be.
And it takes this tunnel which may or may not be encrypted VPN does worry about encryption but we're
more worried about using a tunnel to in essence put an IP address inside an IP address type of thing
and allow that tunnel to create the connectivity between what we call the two endpoints. To appreciate
how all this works the best thing we can do right now is go through the process of setting up a VPN.
What we're going to do is we're going to set up a very simple VPN using my home router system and a
Windows 8 computer.
Let's watch.
It's pretty straightforward. Okay now most new operating systems have a built in VPN client and Windows
8 is certainly no exception to that.
I don't have to use a built in VPN client.
Most VPN solutions will also come with a third party client but the one that comes with Windows 8 is
pretty amazing so I'm going to go ahead and use it.
So connect to my workplace is my VPN option here.
And I'm going to use my internet connection because that's what a VPN is all about.
So I'm going to type in a internet address and this is a completely bogus address so don't even bother
trying to connect to it and I'll call it something so I can distinguish it from other VPN connections
I might have on the same laptop.
And then there's some window stuff. I want to use a smart card. What are my credentials? And allow other people
to use it. I'll just hit create.
Now once I've done that it's kind of boring.
So what I want to do now is let's go into the adapter settings.
Because there it is.
Microsoft will manifest your VPNs as virtual network cards and that's where you actually can apply
your network IP address to your virtual card and stuff.
It's actually a pretty cool way to think about it.
Let's go into the properties there's a lot of really fun stuff in here.
So here's the IP address that's not too exciting but options are just a few basic options not too exciting
there.
But here's really the cool part and I want to spend a few minutes on the dialog box because there's
a lot of really interesting settings in here.
First of all the type of VPN.
Now there's a lot of different people's VPN is out here. For example,
here is point to point tunneling protocol or PPTP. PPTP is a very Microsoft way of doing things.
I'm not going to say that Microsoft invented PPTP but they certainly use it quite a bit.
Then there is L2TP/IPsec.
If you look right here L2TP or Layer 2 tunneling protocol with IPsec or IP security is really a Cisco
type of solution.
It's a little bit dated now but it's still out there.
Probably the most hip one we use today is SSL tunneling protocol and this really started off years ago
as a more simplistic one but it's now really become very much a common type of VPN.
The important thing here is you choose this based on whatever you're told by the people who set up the
other end of the VPN.
And if you're unsure just select automatic because the built in VPN client that comes with Windows
will query the VPN server and set itself up automatically, so it's actually pretty cool here.
Now next is data encryption. Of course we want data encryption.
So that's not a big deal but here's kind of the fun one here we can set up things like EAP for authentication
side of things.
So I can say use PPTP but I want to use EAP for authentication. Now
there's lots of different types of authentications under EAP and Microsoft only has a small list of
them here.
So for example EAP-TTLS.
Now if you've been watching other episodes you know EAP-TTLS requires certificates. I'll bet under properties
there's going to be,
here we go, is going to be all kinds of information in terms of what certificates we would be using to
make the server connection. Bail out of that for a moment.
And then of course if we just want to do something simple like a password then we can set that up and
just use my Windows login name if I want or something like that.
So all the different versions of EAP for authentication can be used here.
Now if you don't want to use something newer like EAP you can go old school if you want and just use unencrypted
or regular CHAP, or Microsoft CHAP. These are the old school ones to do it.
If you want to do that they're there for you although for the most part you're probably going to be
using some form of EAP.
So let's take a look here one more time so we can do PPTP, L2TP, SSL, what they call
SSTP here, and just for the record you see IKEv2. That is a pure IPsec VPN.
This is L2TP with IPsec.
IKEv2
is just basically it's a pure IPsec
VPN.
OK so setting up a client's fairly easy but we need to appreciate that there's a lot more to a VPN than
just setting up a client.
So keep in mind the whole idea of a VPN is that I want my far away computer to be a part of this network.
So what I do and this is what we would call a client to site VPN.
We set up a VPN client on a little laptop and then we go about setting up a VPN endpoint on our network
itself.
Now this can be done in a lot of different ways.
One of the more common ways to do it is we can buy a little router that is also a VPN concentrator.
It basically acts as the other VPN endpoint.
In that case he just takes care of whatever he needs to do to be the other end of the VPN and there's
going to be a whole menu in here for setting this guy up.
Now that's not the only way to do it.
We can also do VPN concentrators which are actually outside.
Well let me go out and set this up. We can have another box that is a pure VPN concentrator and the
only thing that this guy does for a living is act as a VPN endpoint.
In this case we just have a regular router that doesn't have any VPN capabilities,
and then he will go ahead and let this guy be the endpoint.
So the only thing that we have to watch out for for more than anything else is that from time to time these
guys have a setting that's called VPN pass through and that so that outgoing stuff can get through this
router and he won't try to eat it up in any way shape or form.
So that's what a VPN passthrough is for is
so that guys inside the network can get out and do whatever they need to do.
So a VPN concentrator's simply a dedicated box that acts as an endpoint for the entire network.
So now keep in mind what we're talking about here is what we call client to site.
But there's another way to do it. Let's say we have another network far away and these guys are separated
by a whole bunch of internet.
What we can do is we can set up VPN concentrators on each end of the network so that these two networks
are always part of the same network. Isn't that cool?
So you can have a network far far away
that's a part of your network really close by.
And this is what we would call a site to site VPN.
Now if I've done anything at this point I hope I've confused you a little bit because we've got all these
VPN technologies.
We've got PPTP, L2TP with IPsec we've got SSL VPNs.
So which one am I going to use.
Well you can use almost any of them.
Most of the time the VPN that you're going to choose to use is based on the equipment you buy. If you're
buying a lot of Cisco boxes here.
There's a good chance if they're older ones you're going to be using L2TP. If they're more modern
you're going to be using SSL because that's what Cisco has for you. If you're going to be using Microsoft
remote access tools which is going to manifest itself as some software you put on a server you're probably
going to be using PPTP.
It really just depends on the solution you choose
at that point in time. We rarely go in saying: oh I'm going to use a PPTP VPN or I'm going to be using an SSL
VPN.
We usually say things like hey we need like to get a Cisco box or something and then the between the
clients and your endpoints it's all pretty much set up for you.
And that's the magic about VPN is. We're not expecting you within the network plus to become some VPN
expert.
What is important is that you appreciate why we use VPN and some of the different technologies that
you can choose from.
Trust me you're going to see PPTP and L2TP and SSL all on the network plus.