# VPNs and Tunnels

A tunnel wraps one packet inside another so it can cross a network it does not trust. Every tunnel is therefore two networks at once: the one the packet thinks it is on, and the one it is actually travelling over.

## The families

| Type | Protocol | Use | Notes |
|---|---|---|---|
| **IPsec** | ESP (IP 50), IKE (UDP 500/4500) | Site-to-site, remote access | Strong, complex, ubiquitous |
| **WireGuard** | UDP (default 51820) | Site-to-site, remote access | Small, fast, modern crypto, key-based |
| **TLS VPN** | TCP/UDP 443 | Remote access, clientless | Looks like HTTPS, easy through firewalls |
| **GRE** | IP 47 | Encapsulation without encryption | Often paired with IPsec |
| **VXLAN** | UDP 4789 | Data-centre overlay | Not a security boundary on its own |
| **SSH tunnel** | TCP 22 | Ad-hoc port forwarding | Fine for debugging, not for production |

## IPsec in one table

| Phase | Protocol | Purpose |
|---|---|---|
| **IKE phase 1** | UDP 500 | Authenticate peers, establish IKE SA |
| **IKE phase 2** | UDP 500 | Negotiate IPsec SAs (ESP) |
| **Data** | ESP (IP 50) | Encrypt and authenticate payloads |
| **NAT traversal** | UDP 4500 | Encapsulate ESP when NAT is in the path |

Two modes: **transport** (protects payload, keeps original IP header) and **tunnel** (protects the whole packet, new outer header). Site-to-site is almost always tunnel mode.

## WireGuard in one paragraph

WireGuard has no negotiation protocol: peers are configured with public keys and allowed IP ranges, and the crypto is a fixed modern suite (Curve25519, ChaCha20-Poly1305, BLAKE2s). It is stateless, silent unless there is traffic, and roams across IP changes. Configuration is 20 lines per peer, which is why it displaced a lot of OpenVPN.

## Split tunnel vs full tunnel

| Mode | Traffic | Trade-off |
|---|---|---|
| **Full tunnel** | Everything through the VPN | Consistent policy, more latency, more bandwidth cost |
| **Split tunnel** | Only corporate routes | Faster, cheaper, and the endpoint talks directly to the internet |

Split tunnel is where policy gets interesting: the same laptop is inside the corporate policy for one flow and outside for another, and the VPN concentrator only sees half the traffic.

## The MTU problem, again

Tunnels add headers. IPsec ESP tunnel mode commonly adds 50–73 bytes; WireGuard adds 60 (20 IPv4 + 8 UDP + 32 WireGuard). If the path MTU is 1,500 and ICMP fragmentation-needed is filtered, large packets vanish.

```bash
ping -M do -s 1400 10.0.0.1      # IPv4, don't fragment
ping -6 -s 1300 2001:db8::1
```

Set the tunnel interface MTU deliberately (WireGuard commonly 1,420; IPsec 1,400–1,420) and clamp MSS on the router if you must.

## Overlapping address spaces

The most common enterprise VPN failure: both ends use `192.168.1.0/24` or `10.0.0.0/8` sliced the same way. Traffic becomes ambiguous, and no amount of NAT makes routing intent clear. Fix by planning non-overlapping ranges before the first tunnel, and by using NAT only as a last resort with a documented translation.

## Where it goes wrong

- **Tunnel up, traffic not flowing.** Routing, not encryption: the crypto is fine and the interesting traffic selector does not match.
- **Asymmetric routing after a tunnel.** One direction through the tunnel, the other direct, and the stateful firewall sees half a flow.
- **MTU black hole.** Small pings work, SSH connects, then `git clone` hangs. Always test large payloads.
- **VPN as the only access model.** Every user gets network access; nobody gets application-level authorisation. This is the model zero trust replaces.
- **Key sprawl.** WireGuard keys in a wiki, IPsec PSKs shared between three teams, no rotation.
- **Concentrator as a single point of failure.** One appliance, one region; the day it fails, everyone works from home permanently.
- **Split tunnel without endpoint policy.** The laptop is on the corporate network and the coffee-shop network at the same time, and nothing stops the latter from reaching the former.

## Teaching hook

**The diplomatic pouch analogy.** The pouch (tunnel) is sealed and tamper-evident, and it travels on ordinary roads (the internet). The customs post at each end checks the seal; nobody in between can read the contents. But the pouch only carries what you put in it — the interesting-traffic selector.

Demo: two Linux hosts, WireGuard, `ping` the tunnel, then lower the tunnel MTU below the payload size and watch a large transfer fail while pings succeed.

## Related Notes

- [[Security/Network-Security-Fundamentals.md]] — trust boundaries
- [[Network-Services/NAT-And-PAT.md]] — NAT-T and overlapping ranges
- [[Foundations/Packet-Flow-Encapsulation.md]] — overhead arithmetic
- [[Cloud-Modern-Networking/Overlays-SDN-VXLAN.md]] — tunnels as a data-centre fabric