VPNs and Secure Tunnels: Connecting Across the Void

In the previous lessons, we learned how to route traffic and protect networks. But what if you have a team of developers in Europe and a database in America? You can't run a 5,000-mile ethernet cable.

You use a VPN (Virtual Private Network).

A VPN creates an encrypted "Tunnel" through the dangerous public internet. For your applications, it feels like the remote server is sitting in the same room. In this lesson, we will focus on WireGuard, the state-of-the-art VPN built directly into the Linux Kernel, and contrast it with the classic OpenVPN.

1. How a VPN Works: The 'Tun' Interface

When you start a VPN, Linux creates a new virtual network card, usually named tun0 (for "Tunnel").

Your App sends data to an IP like 10.8.0.5 (the VPN IP).
The Tun Interface takes the data and "Wraps" it in a thick layer of encryption.
The Physical Card (eth0) sends the encrypted blob to the other side.
The Recipient unwraps the data and delivers it to its destination.

2. WireGuard: The New Standard

For 20 years, OpenVPN was the king. But it was slow, complex, and had 100,000 lines of code (making it hard to audit for security). WireGuard is only 4,000 lines of code, runs much faster, and uses modern "Noise" cryptography.

The WireGuard Philosophy:

WireGuard doesn't have "Servers" and "Clients." It has Peers. Each peer has a Public Key and a Private Key (just like SSH).

Quick Setup:

# 1. Generate keys
wg genkey | tee privatekey | wg pubkey > publickey

# 2. Create the configuration file (/etc/wireguard/wg0.conf)
# [Interface]
# PrivateKey = <Your Private Key>
# Address = 10.0.0.1/24
# ListenPort = 51820
#
# [Peer]
# PublicKey = <The Other Side's Public Key>
# AllowedIPs = 10.0.0.2/32
# Endpoint = 34.56.78.90:51820

# 3. Start the tunnel
sudo wg-quick up wg0

3. OpenVPN: The Enterprise Classic

While WireGuard is faster, OpenVPN is still the industry standard for large corporations with thousands of users.

Port Flexibility: It can run over Port 443 (HTTPS) to bypass strict office firewalls.
Auth Integration: It can connect to Active Directory or LDAP for user logins.

4. The Exit Node (Full Tunnels)

There are two ways to use a VPN:

Split Tunnel: Only traffic for the company database goes through the VPN. Everything else (Youtube/Google) goes through your normal ISP.
Full Tunnel: EVERY byte of data goes through the VPN. This is what you use when you are on public Wi-Fi in a coffee shop to prevent people from spying on you.

5. Practical: The "Always On" Server Tunnel

Suppose you have a file server in your office. You want it to always be connected to your cloud HQ. You set up a systemd unit to ensure the WireGuard tunnel starts at boot.

# Enable the wg0 tunnel at startup
sudo systemctl enable wg-quick@wg0

6. Example: A VPN Latency Monitor (Python)

Because VPNs add encryption, they also add "Latency." Here is a Python script that compares your speed with and without the tunnel to see how much the "VPN Tax" is costing you.

import subprocess
import time

def measure_ping(target):
    """
    Measures average ping time over 5 packets.
    """
    cmd = ["ping", "-c", "5", "-q", target]
    res = subprocess.run(cmd, capture_output=True, text=True)
    
    if res.returncode == 0:
        # Parse the rtt min/avg/max/mdev line
        stats = res.stdout.split('\n')[-2]
        avg = stats.split('/')[4]
        return float(avg)
    return None

if __name__ == "__main__":
    # 1.1.1.1 is public internet
    # 10.0.0.1 is your internal VPN gateway
    
    public_ping = measure_ping("1.1.1.1")
    vpn_ping = measure_ping("10.0.0.1")
    
    print("--- VPN Performance Audit ---")
    print(f"Internet Latency: {public_ping} ms")
    print(f"VPN Tunnel Latency: {vpn_ping} ms")
    
    if vpn_ping and public_ping:
        diff = vpn_ping - public_ping
        print(f"\nVPN Overhead: {diff:.2f} ms")

7. Professional Tip: Use 'IP Masquerade' for VPN Gateways

If you want your VPN users to be able to access the rest of your office network (not just the VPN server itself), you must enable IP Masquerading on the VPN server, just like we learned in the NAT lesson.

# Let VPN users (10.0.0.0/24) out to the local network (eth0)
sudo nft add rule ip nat postrouting ip saddr 10.0.0.0/24 oifname "eth0" masquerade

8. Summary

VPNs are the bridges of the modern distributed world.

WireGuard is the choice for speed, simplicity, and kernel-level performance.
OpenVPN is the choice for enterprise compatibility and firewall bypassing.
Tun/Tap are the virtual wires that make it all possible.
Keys (not passwords) are the professional way to secure tunnels.

In the final lesson of this module, we will learn how to "See" the invisible signals using Network Monitoring and Troubleshooting (tcpdump and Wireshark).

Quiz Questions

Why is WireGuard significantly faster than OpenVPN on most systems?
What is the role of the "AllowedIPs" setting in a WireGuard configuration?
What is a "Split Tunnel" and why would a company use it?

Continue to Lesson 6: Network Troubleshooting—tcpdump, Wireshark, and nmap.

The Invisible Tunnel: VPNs and WireGuard