Module 6 · VPN Fundamentals 🔒

VPNs encrypt traffic between two endpoints. Site-to-site VPNs connect offices to cloud VPCs; remote-access VPNs connect laptops to corporate networks. This module covers the protocols, their security properties, and the modern cloud-native alternatives.

VPN protocol families

WireGuard — the modern default

# Server config (/etc/wireguard/wg0.conf)
[Interface]
PrivateKey = SERVER_PRIVATE_KEY
Address = 10.10.0.1/24
ListenPort = 51820
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 10.10.0.2/32

# Bring up
wg-quick up wg0
systemctl enable wg-quick@wg0

WireGuard advantages: ~4000 lines of code (easy to audit), modern crypto (Curve25519, ChaCha20-Poly1305), kernel module (fast), works over UDP only.

Site-to-site VPN in cloud

• AWS Site-to-Site VPN — IPsec to your office; high-availability via 2 tunnels
• AWS Transit Gateway — hub-and-spoke for multi-VPC + multi-office
• Azure VPN Gateway — similar offering
• AWS Direct Connect / Azure ExpressRoute / GCP Cloud Interconnect — dedicated private line, no public internet

VPN security pitfalls

• Split vs full tunnel — full tunnel routes all traffic through VPN (visible to corp); split routes only corp traffic via VPN. Full is stricter control but bandwidth cost.
• Pre-shared keys — avoid for site-to-site; prefer certificate-based
• No MFA on client VPN — classic failure. Require MFA for every session
• Over-broad routing — VPN client gets full access to corp network; segment and limit
• Legacy IKEv1 — deprecated; use IKEv2 for IPsec
• Unpatched VPN appliances — Pulse Connect, Fortinet FortiOS, Cisco AnyConnect all had critical CVEs in recent years, exploited in the wild

Zero-Trust Network Access (ZTNA) — the VPN replacement

Traditional VPN gives you a private network connection; you’re “inside.” Modern zero-trust approach: every application authentication separately via identity-aware proxy. You don’t need VPN to access internal tools — each tool authenticates you via SSO + device trust + policy.