Security / VPN / Tunneling

This section explores key protocols and technologies that secure communication over untrusted networks. These include encryption, tunneling, and segmentation techniques to ensure data confidentiality and integrity.

Protocol / Tech

Description

Use Case

SSH (Secure Shell)

Secure remote access protocol using encryption and key authentication. Supports tunneling, file transfer, and remote command execution.

Secure remote login to servers and network devices.

IPsec (Internet Protocol Security)

Suite of protocols for securing IP traffic via encryption and authentication. Works in transport or tunnel mode.

Site-to-site or remote-access VPNs.

L2TP (Layer 2 Tunneling Protocol)

Tunneling protocol often combined with IPsec for encryption. Encapsulates PPP frames for VPNs.

Secure remote VPN access.

IKEv2 (Internet Key Exchange v2)

Protocol for setting up security associations in IPsec. Supports fast reconnection and mobility.

Mobile VPNs, secure key negotiation.

VPN (Virtual Private Network)

Encrypted connection over the internet that emulates a private network. Utilizes protocols like IPsec, SSL, OpenVPN.

Remote access to internal networks.

DMZ (Demilitarized Zone)

Network segment exposed to external users but isolated from internal LAN. Hosts public services like web or mail servers.

Hosting internet-facing apps securely.

Firewall

Security system that filters traffic based on rules. Protects networks from unauthorized access.

Enforcing access control between networks.

MACsec (802.1AE)

Link-layer encryption for LAN security. Encrypts Ethernet frames to prevent snooping.

Securing Layer 2 segments in enterprise networks.

RFC: RFC 4251–4254

Main Features:

  • Encrypted remote access to devices and servers

  • Supports tunneling, port forwarding, and file transfers (SCP/SFTP)

  • Key-based authentication and session security

Use Cases:

  • Secure system administration

  • File transfer over insecure networks

Alternative Protocols:

  • Telnet (insecure, legacy)

  • RDP – for graphical remote access

Let us learn more about SSH:

Jump to “SSH”

RFC: RFC 4301 (Framework), RFC 4303 (ESP), RFC 2402 (AH)

Main Features:

  • Encrypts and authenticates IP packets

  • Supports transport and tunnel mode

  • Often used in VPNs and secure WAN communication

Use Cases:

  • Enterprise VPNs (site-to-site or remote access)

  • Secure communication between data centers

Alternative Protocols:

  • SSL VPN (OpenVPN, WireGuard)

  • MACsec – for Layer 2 encryption

Let us learn more about IPsec:

Jump to “IPsec”

RFC: RFC 2661

Main Features:

  • Tunnels PPP frames across IP networks

  • No built-in encryption (typically paired with IPsec)

  • Often used in legacy VPN setups

Use Cases:

  • L2TP/IPsec VPN for remote users

  • Legacy Windows VPN infrastructure

Alternative Protocols:

  • PPTP (deprecated)

  • OpenVPN, WireGuard

Let us learn more about L2TP:

Jump to “L2TP”

RFC: RFC 7296

Main Features:

  • Automates key exchange and session setup in IPsec

  • Supports EAP authentication

  • Handles mobility and reconnection efficiently

Use Cases:

  • Mobile VPNs on iOS, Android

  • IPsec-based secure tunnels

Alternative Protocols:

  • IKEv1 (legacy)

  • SSL/TLS for non-IPsec VPNs

Let us learn more about IKEv2:

Jump to “IKEv2”

Standard: Conceptual (uses multiple protocols)

Main Features:

  • Encrypts traffic across public networks

  • Protects identity and location

  • Supports multiple protocols (IPsec, SSL, WireGuard, etc.)

Use Cases:

  • Secure remote access

  • Privacy and bypassing censorship

Alternative Protocols:

  • MPLS VPN (carrier-grade)

  • Zero Trust models

Let us learn more about VPNs:

Jump to “VPN”

Standard: Architecture Concept

Main Features:

  • Isolated network segment for public-facing services

  • Restricts external access to internal LAN

  • Limits exposure and attack surface

Use Cases:

  • Hosting public servers securely (e.g., web, mail)

  • Isolating test/dev environments

Alternative Technologies:

  • Reverse proxy

  • Bastion hosts

Let us learn more about DMZ:

Jump to “DMZ”

RFC: Varies (vendor implementation)

Main Features:

  • Filters traffic using rules and policies

  • Supports stateless and stateful inspection

  • May inspect up to Layer 7 (Next-Gen Firewalls)

Use Cases:

  • Enterprise network protection

  • Access control and segmentation

Alternative Technologies:

  • Access Control Lists (ACLs)

  • Host-based firewalls

Let us learn more about Firewalls:

Jump to “Firewall”

Standard: IEEE 802.1AE

Main Features:

  • Layer 2 (Ethernet) encryption

  • Protects against LAN sniffing and replay attacks

  • Point-to-point security on switches and routers

Use Cases:

  • Securing enterprise LANs

  • Government and financial infrastructure

Alternative Technologies:

  • IPsec – for higher-layer encryption

  • 802.1X – for authentication

Let us learn more about MACsec:

Jump to “MACsec”