Week 5, Day 1 — VPN Concepts & Lab Topology

Why VPNs exist, IPSec protocol suite, IKE negotiation, and the StrongSwan mental model

Part 1 — The VPN problem (5 min)

• Draw the scenario: two isolated private networks (S1's LAN1 at 192.168.50.0/24, S3's LAN at 192.168.51.0/24) connected to the same public network (classroom at 172.17.x.x). S2 cannot reach S3's internal hosts. Traffic between S1 and S3 traverses the classroom network in plaintext. A VPN solves both problems: it routes S2→S3's LAN traffic through a tunnel, and it encrypts everything that traverses the public network.
• Tunnel mode (what we use): the entire original IP packet is encrypted and encapsulated inside a new IP packet. The outer IP header carries the VPN endpoint IPs (S1 and S3's external IPs). An observer on the classroom network sees only encrypted ESP packets between S1 and S3 — they cannot see the inner packet headers or payload.
• Transport mode (not used here): only the payload is encrypted; the IP header is left in plaintext. Used for host-to-host encryption, not site-to-site tunnels.

Part 2 — IPSec protocol suite (10 min)

• IKE (Internet Key Exchange): The control plane — negotiates the encryption parameters and exchanges keys. Uses UDP port 500 (or 4500 for NAT traversal). IKE operates in two phases:
  Phase 1: Establishes a secure, authenticated channel (the ISAKMP SA) between the two peers. This is how they verify each other's identity (via PSK or certificate) and agree on encryption for Phase 2 negotiation.
  Phase 2: Within the Phase 1 channel, negotiates the actual IPSec SA — the encryption algorithm (ESP cipher suite) and keys for data traffic. The result is two unidirectional SAs (one for each direction).
• ESP (Encapsulating Security Payload): The data plane — encrypts and authenticates the actual IP packets. Protocol number 50. This is what carries the user data through the tunnel. Most VPN configurations use ESP only.
  AH (Authentication Header): Provides integrity and authentication only — no encryption. Protocol number 51. Rarely used alone; ESP with authentication provides a strict superset of AH's capabilities. AH is incompatible with NAT (it authenticates the IP header, which NAT modifies).
• The IKE cipher suite we configure: ike=aes256-sha2_256-modp1024! — AES-256 encryption, SHA-256 integrity, Diffie-Hellman group 2 (1024-bit MODP). The ! means "exact match only — don't negotiate alternatives." The ESP suite: esp=aes256-sha2_256! — AES-256 and SHA-256 for the data channel.

Part 3 — StrongSwan mental model (8 min)

• StrongSwan uses a "lefty local, righty remotey" convention throughout its configuration. On any given server, left = this server's side, right = the remote peer. This means the ipsec.conf on S1 and the ipsec.conf on S3 are mirrors of each other — left and right are swapped.
• Key ipsec.conf directives:
  left= / right= — the external (tunnel endpoint) IPs
  leftsubnet= / rightsubnet= — the internal subnets that traffic for, are routed through the tunnel
  authby=secret — PSK authentication (changed to pubkey for cert auth)
  auto=start — bring the tunnel up automatically on ipsec restart
  keyingtries=0 — retry negotiation indefinitely (0 = unlimited)
  dpddelay=30 / dpdtimeout=120 / dpdaction=restart — Dead Peer Detection: check peer every 30s, restart tunnel if no response after 120s
• NAT exclusion — why it's critical: Without it, packets from S2 (192.168.50.2) destined for S3's LAN hit S1's iptables POSTROUTING chain before the VPN policy is applied. They get masqueraded — the source IP becomes S1's external IP. The encrypted tunnel receives packets with source IP 172.17.x.x instead of 192.168.50.2. S3's routing can't return them correctly. The fix: exclude tunnel-bound traffic from MASQUERADE using a ! -d [remote-subnet] condition in the rule.

Part 4 — WireGuard preview (7 min)

• Briefly introduce WireGuard as a contrast to IPSec. WireGuard is a modern VPN protocol built into the Linux kernel since 5.6. Its design goals: simplicity (the entire codebase is ~4000 lines vs IPSec's ~400,000), performance, and modern cryptography (ChaCha20, Poly1305, Curve25519 — not negotiable, not configurable). The entire WireGuard configuration is a handful of lines. Students will build it on Thursday after experiencing IPSec's complexity first — the contrast is educational.