VPN: putting your car inside a truck

Welcome back to the Packet Highway! After the oversized truck and the low bridge, the transport manager has announced another revolution. This time it isn't about vehicle size. It's about secrecy.

— Gentlemen! No more publicly displaying our deliveries!
— But we use public roads.
— EXACTLY! Everybody can see our cars!
— Maybe we should buy a closed trailer?
— BRILLIANT! ORDER ONE!

The next morning, a huge sealed truck arrived at the warehouse. The workers opened the trailer.

— Shall we load the cargo?
— No! Load the car!
— WHICH CAR?!
— The one that normally drives to our other office.
— Why put a car inside a truck?
— So nobody on the motorway can see which car it is!
— Couldn't we just tint the windows?
— NO ARGUMENTS! LOAD IT!

🤣

VPN: a private journey on a public road

VPN (Virtual Private Network) is a way to create a logical private connection across another network, often the public Internet. Imagine company offices in Warsaw and Kraków, each with its own computers and local network. We want them to exchange data as if a private road linked them, even though the route between them uses the public motorway.

The original car is our packet. The large truck is an outer transport: it carries the car across the public road and releases it at the destination. In networking, this is tunnelling or encapsulation — wrapping the original data inside another packet for transport.

— Boss, the car made it to Kraków!
— And nobody saw it?!
— No.
— EXCELLENT!
— But everybody saw the truck.
— WHAT?!
— Well, it was driving along the motorway.
— WHAT SORT OF SECRET TRANSPORT IS THAT?!
— The cargo can be secret. The truck's existence isn't.

A VPN does not make a connection invisible. Observers may still see the VPN endpoints, timing, volume and traffic patterns. With a properly secured tunnel, however, they generally cannot directly read the protected original traffic.

Tunnelling and encryption are not the same thing

The manager inspects the truck.

— Is it secure?
— It has an enclosed trailer.
— But can anyone open it?
— Unless we secure the doors, yes.
— THEN WHAT'S THE POINT OF ALL THIS SECRECY?!
— We need a proper lock.

Tunnelling wraps and transports data across another network. Encryption protects its contents so that people without the right keys cannot read them. These are different things. Simply putting a packet inside another packet does not ensure confidentiality; some tunnels aren't encrypted at all.

Depending on the technology and configuration, secure VPN solutions can protect confidentiality, integrity and authenticity. Preventing unauthorised changes matters just as much as preventing eavesdropping.

— Does the motorway officer have a key?
— No.
— The car park owner?
— No.
— The fellow at the petrol station?
— Also no.
— Then how will they know what we're carrying?
— They won't.
— FINALLY, SOMEONE UNDERSTANDS THE CONCEPT!

Who receives the truck? Keys, certificates and identity

The truck arrives at the Kraków office gate. A guard steps out of his booth.

— Who goes there?
— Secret truck.
— Please verify your identity.
— Very secret truck.
— That doesn't verify anything.
— Most secret truck in the entire world?!
— Sir, I need proper credentials, not increasingly dramatic adjectives.

🤣

Devices and users connecting to a VPN need to know who is really at the other end. Keys, certificates and other authentication methods help establish that trust. Encrypting data for an unverified destination is not enough: you can deliver a parcel to a fraudster with excellent security.

— But it's wearing our company sticker!
— Boss, anybody can print a sticker.
— Damn. Check the papers, then.

Two offices, or one person with a laptop

The company has two kinds of work. First, connect the whole Warsaw office to the whole Kraków office. Second, let an employee with a laptop access company resources while away from the office.

The first is usually called site-to-site VPN: gateways or routers connect two networks. Cars from entire neighbourhoods share the transport. The second is remote-access VPN: one computer or phone establishes its own secure connection to the company.

— Boss, an employee is calling from a hotel.
— Which branch?
— A seaside hotel. He wants to reach the office server from his laptop.
— Then ship his laptop to Kraków in the truck!
— Or he could simply start the VPN client.
— You people always ruin my brilliant ideas!

A VPN doesn't automatically grant access to everything. Permissions, firewalls and security policies still apply. A private road isn't a master key to every room in a building.

Routes: how does the car know which truck to take?

One morning a Warsaw car drove down the ordinary road instead of taking the VPN.

— WHY DIDN'T IT USE THE TUNNEL?!
— Its route instructions don't send it there.
— BUT WE BOUGHT A TRUCK!
— A truck doesn't update your maps all by itself.

In networking, routing and network policies select the path. We must specify which addresses and networks are reachable through the tunnel. A connection between offices needs correct routes on both sides and the appropriate traffic rules. Establishing a tunnel doesn't automatically send every packet through it.

— Can I send cars into the tunnel but make the replies return over the ordinary road?
— You can try. Just don't be surprised if some conversations fall apart.
— So I need to check the return route too?
— Well done, boss.

Full tunnel versus split tunnel: twelve-hundred-zloty bread rolls

The manager announces a new rule.

— FROM TODAY, EVERY CAR GOES IN THE SECRET TRUCK!
— Even the one collecting bread rolls?
— EVERY CAR!
— But the bakery is across the street.
— I DON'T CARE!

A car from Warsaw enters the truck. The truck goes to Kraków. The car drives out, buys bread rolls and returns by the same route.

— Boss, the bread rolls arrived!
— Excellent! How much were they?
— Eight złoty.
— And transport?
— Twelve hundred.
— ...
— But nobody along the way saw which bread rolls we bought!

🤣🤣🤣

With a typical remote-access full tunnel, Internet-bound traffic also goes through the VPN. With a split tunnel, only selected destinations use the VPN; other traffic can leave directly via the local connection. The actual behaviour comes from routes and policies, not magic attached to those labels.

Neither option is always better. Full tunnel can give a company more control, but also increase load and latency. Split tunnel saves resources and makes local access easier, but requires careful security policies.

Then there's DNS, our Internet address book. The route followed by name lookups depends on configuration too. Turning on a VPN does not automatically guarantee that every DNS query goes through it.

— Boss, why are we sending bread rolls to Kraków?
— Because I wrote it in the rulebook.
— And who wrote the rulebook?
— I DID!
— That explains it, then.

Who can see what? VPN isn't an invisibility cloak

The manager orders an even bigger sticker reading “ANONYMOUS TRANSPORT”.

— Now nobody will know where I'm going!
— Your local provider may still see a connection to the VPN gateway.
— But not the contents of the locked trailer?
— Not if they're properly encrypted.
— And the provider after the tunnel?
— They may see outgoing traffic, depending on what else is encrypted.
— And the website I'm logged into?
— It can still know who you are.
— SO WHERE'S MY ANONYMITY?!
— In the marketing brochure, boss.

🤣

VPN can protect data over a particular section of its journey and can change the IP address a website sees when traffic exits through a VPN gateway. It does not erase cookies, account logins, browser identifiers or other tracking techniques. VPN is a networking tool, not a promise of complete anonymity.

Protection applies to the tunnelled portion of the path. If traffic leaving the VPN is not otherwise encrypted, someone on that later section may see more. HTTPS still matters.

OpenVPN, WireGuard and IPsec: different trucks, similar job

Three sales representatives arrive at the warehouse.

— Our truck is called OpenVPN!
— Ours is WireGuard!
— And ours uses IPsec!
— WHICH ONE IS BEST?! — asks the manager.
— It depends on the requirements, devices and configuration — says the administrator.
— I hate the words “it depends”.
— Welcome to IT.

OpenVPN, WireGuard and IPsec are different technologies used to build secure connections. They differ in session setup, key management, features and deployment requirements. Simply saying “VPN” doesn't reveal the implementation — or whether it's configured correctly.

MTU returns: a car inside a truck beneath the bridge

Everything worked beautifully until the sealed truck arrived at a familiar low bridge.

— BOSS! WE DON'T FIT AGAIN!
— WHAT?! We made the car smaller yesterday!
— Yes, but today we put it INSIDE A TRUCK!
— TAKE IT OUT, THEN!
— But then there won't be a VPN tunnel.
— MAKE THE TRUCK SMALLER!
— We need a smaller payload to leave space for the extra wrapping.
— DAMN IT, MORE MATHEMATICS!

🤣🤣

Encapsulation generally adds headers and reduces the room left for the inner packet. That's why VPNs sometimes trigger the problems described in MTU and MSS: small packets pass but larger transfers stall. The real path MTU, tunnel overhead, ICMP messages and possible TCP MSS clamping all matter.

There is no single magical MTU or MSS that suits every VPN. It depends on the technology, link and encapsulation format.

What if the truck never arrives?

— Boss, the tunnel is down!
— Let the cars take the ordinary road.
— But they're carrying confidential documents!
— Perhaps not, then?
— EXACTLY.

When a VPN fails, traffic may be blocked, redirected or sent over the ordinary connection, depending on configuration. If particular traffic must remain inside the tunnel, policies should explicitly prevent it from escaping elsewhere. This is often called a kill switch or implemented using suitable firewall rules.

— So we have to plan for failure?
— Yes.
— Couldn't we just write “failure-proof” in the advert?
— Unfortunately not.

Finale: secret delivery completed

After a week of configuration, the first sealed truck made it safely from Warsaw to Kraków. Credentials were verified, the keys matched, the routes were correct, and nobody left half the trailer under a bridge.

— Boss, the connection works!
— And nobody saw our car?
— Correct.
— Nobody opened the trailer?
— Correct.
— Everything arrived on time?
— Correct.
— EXCELLENT! Order five more trucks!
— But we only need one.
— Doesn't matter. A company must grow!

🤣

The Packet Highway Authority reminds drivers that VPN trucks are not invisible, cannot drive through bridges that are too low, and must still obey traffic rules. The manager has lodged a formal objection to all three points.