• Quick Installation Guide
  • Step by Step
  • Admin User Guide

Basic Concept

VPN ( Virtual Private Network ) is the technology to allow people accessing their private network by establishing a “tunnel” in the public network. Before we go into more details, it would be better to have a general concept here. There are many kinds of mechanisms to implement VPN. The VPN we introduce here is only applicable to the software along with our CD.

Conceptually, you can think VPN in this way: you have an Ethernet interface on your mobile PC that you bring your mobile PC into the place outside your office’s firewall. When you launch your VPN client program on the mobile PC, the VPN client program will “construct” a virtual interface that looks like Ethernet interface. And when you send messages to this virtual interface constructed by the VPN client program, those messages will be delivered to the network inside firewall.



Of course, the traffic sent to the “virtual Ethernet interface” actually pass the Ethernet interface on your mobile PC – but most of the time, you are not aware of that; if you want to send something into the network inside your office’s firewall, you just send to this virtual Ethernet interface created by VPN client program.  You can make analogy with the situation that the “Real Ethernet interface” is a pipe with holes at two ends. The VPN just opens a hole in the pipe and tries to send something into this existing pipe. So, on one end, you can see two hoses; on the other end, there is only one hole. The VPN traffic just uses the existing pipe to send out data. But on the end of sending data, the user will see there are two “hoses” – one is VPN, the other is the original one as indicated in the diagram above. When you throw something into that VPN hose; otherwise, the firewall just handles it in a regular rule. The deployment of VPN needs some network planning effort and it has to take into account your current network topology.

The VPN here is adopting IP-based routing approach which is a little different from the method of using “bridging”.  VPN using “bridging” method allows packets flowing without looking into more details on IP headers so that the network packets might flood everywhere. On the other hand, if the VPN can filter out some traffic based on the IP addresses, it will isolate the unnecessary traffic to go to network.

However, both methods have their advantages and disadvantages respectively. This is not the place to discuss the issue here. The point here: most of the computer network today is IP network. In order to connect to other hosts, your machine needs to have an IP address ( in general ) to function well on the network.

VPN opens the door by allowing the hosts outside the firewall to access the network inside the firewall. By doing that, you have to be very careful on configuring your network. Here is an example. You have a firewall with public IP address 1.2.3.4 on the Internet interface eth0, and private IP address 192.168.1.1 on the LAN interface eth1. With DHCP server running on eth1, basically, you can form a subnet inside the firewall automatically, let’s say the network is 192.168.1.0/24 .



If VPN is designated as 172.16.7.0/24, once a host gets connected to this VPN, its IP address must belong to the class 172.16.7.0/24. Thus, the only thing we need to do is to let the traffic flow between the two networks 172.16.7.0/24 and 192.168.1.0/24.

However, things are not no simple. Consider the following scenario: the network inside your firewall is 192.168.1.0/24 and you bring your mobile PC into other company and the network inside that company is also 192.168.1.0/24 . Thus, the VPN can not function well because it does not know which one is the one you are trying to connect – both of them have the same network address. Sometimes, the situation can be circumventing by using Proxy. But it does not solve all the problems.

It is advised that you plan your network carefully by choosing the class of private IP addresses that are with less probability to have conflict.

Currently, the VPN is working as follows: you obtain a set of files that contain certificates, keys, and configuration file to put them into your mobile PC. This set of files is generated from the VPN server you would like to connect to. After that, you launch the associated VPN process by reading those files and connect to VPN server. VPN server will put your mobile PC into another network. From that network, you can access the local network inside the firewall – it depends on how the company would like to grant the access to the VPN users.

TOP