Lecture 20 on basic network knowledge: a preliminary understanding of Tunneling Technology

Nowadays, the computer field is increasingly dependent on various types of tunneling technology. All remote access VPNs (Virtual Private Networks) use tunnels. you often hear computer crazy people talk about SSH (Secure Shell) Tunnels. Using tunneling technology, you can do a lot of amazing work, so please sit comfortably and enjoy this lecture on Tunneling Technology and Its Usage happily. If you want to know the specific situation of the IP Security Protocol (IPSec), we will explain it in future basic knowledge lectures.

The main function of tunneling technology is to allow external protocols not supported by a network to pass through the network. Tunnel protocol allows you to use protocols such as IP to send another protocol through the "data" section of IP packets. Most tunneling protocols work at Layer 4th, which means these protocols can be used to replace the functions of TCP (Transport Control Protocol) or UDP (User Datagram Protocol) protocols.

VPN tunneling technology allows remote customers to access our network through tunnels, which proves earlier ideas about the use of tunnels for "unsupported protocols", although this role is not obvious. If we need to use VPN to share printers and files, it may be because ports 139 and 445 (Windows pairing ports) have been disabled. In fact, for our VBR, the two ports are unsupported TCP ports. However, if you use IPSec or PPTP (Point-to-Point Tunneling Protocol) on a known VPN Server, everything will be "okay.

Packets sent to Active Directory server port 445 are hidden as VPN packets. When these packets arrive at the VPN server, the server unpacks the packets (demux, de-multiplex, also known as disassemble) and sends them to the internal network. When a packet arrives in the internal network, its source address is now the internal IP address of the VPN Server, so that the internal network can return a response to the VPN Server. In addition, data packets will act exactly as you intend. As soon as the VPN Server receives a response, it will add a VPN header to the packet and encapsulate it, and send it back to you through its external interface.

Note a few interesting points about the VPN tunnel: Once your data reaches the internal network, it has been decrypted; and when the data passes through the Internet, some special "things" will be added to the data packet.

One thing we did not mention, but it may be obvious that the VPN protocol will encrypt your data packets before they are transmitted. It is not important to understand the concept of tunnel, but it is worth mentioning. Note that this encryption is not end-to-end, that is, the communication between you and the server is not truly secure. Of course, you and your network are safe, and no one else can snoop. However, once the packet is sent out of the VPN Server, it will be decrypted again.

Speaking of the second interesting part, let's first take a look at the most basic IP Encapsulation principles. In terms of concept, we nest data packets. More specifically, the data part of the external IP data packet must contain a complete IP data packet. Pretty good, isn't it? This explains the concept of IPIP tunneling: IP addresses are contained in IP packets.

Figure 1

1. The data section of the IP data packet contains a brand new IP data packet. In addition to encryption, it works the same as VPN tunnel technology. When an "additional packet header" is added to the top of your data packet, you cannot send a large amount of data because the first IP Address Header occupies 20 characters. It is important to understand this because the Path MTU (maximum transmission unit) problem suddenly occurs when tunneling technology is used.

"Creating an SSH tunnel" is a wonderful and confusing thing, that is, using the SSH protocol to transmit data through a tunnel. X11 program, such as a graphical user interface program) if you need to connect to a display terminal. It can easily transmit data through an SSH tunnel. Customers of X (such as the pop-up window program) will try to connect to the X server on the workstation where the display is located. If you use SSH to connect to a server and the options are set correctly, the information that the program tries to connect to X will be returned to your local computer through a tunnel, decrypted, and then transmitted to the X server on your local machine. Now try creating an SSH tunnel: Execute the "ssh-Y user@hostname.com" command, and then run firefox once it enters, it should be displayed on your local computer, it is also implemented through the encrypted SSH tunnel.

Because OpenSSH is interesting and helps us understand the concept of tunneling, let's look at two other tips on SSH.

You can forward a connection to a port on your computer to a remote computer, which transfers your data through an SSH tunnel to ensure security and reliability. This seems useless. After all, why should I send the port on my computer to another computer? To answer this question, we need to clarify some concepts first. Before using the SSH forwarding port, you must first check whether the local port is connected. After a connection is established, SSH sends the entire connection to the remote host and the port. This is a single-port VPN!

For example: ssh-L80: workserver.com: 80 user@workdesktop.com

This command establishes an SSH connection between the local computer and the workdesktop.com computer, and opens port 80 on your local computer. If you direct the web browser to http: // localhost, the connection will be sent to workdesktop.com over SSH and then to workserver.com server port 80. This is very beneficial for accessing sites that only exist on the Intranet from the home without first connecting to the VPN Server.

The latest OpenSSH version also supports the IP tunneling technology on SSH. In fact, it also supports Ethernet to connect two Ethernet broadcast domains; that is, SSH encryption! In the tunnel option of OpenSSH, people can set a full-featured SSH-VPN tunnel that can be implemented on any SSH network. It creates a tunnel interface at both ends, and the only thing that needs to be manually configured is the route table. If you want to send all the data sent to the destination network through an encrypted tunnel, you only need to add a route for the destination network and direct it to the automatically created SSH tunnel interface. This is indeed the most undisputed VPN setup.

The tunnel also transmits other protocols. We hope that the above content will give you an in-depth understanding of tunnel technology, stimulate a little interest, or at least make some people no longer think of this technology as mysterious.

Summary

Tunnel technology is used to send unsupported protocols in different networks.

Data Packets increase by tunnel data, VPN, or other content, so the data volume sent by each data packet is reduced.

Generally, sending data through the SSH tunnel is a VPN established based on a specific application. However, OpenSSH of the latest version can implement a completely mature and undisputed VPN.

Network basics lecture 19: Understanding Multicast Routing Protocols
Network basics lecture 18: Understanding iBGP Routing Protocol
Network basics lecture 17: BGP routing protocol preliminary
Network basics lecture 16: Internet routing and peer-to-peer networking
Network basics lecture 15: Advanced OSPF Routing Protocol
Network basics Lecture 14: OSPF routing protocol preliminary
Network basics lecture 13: routing information protocol (RIP)
Network basics lecture 12: Basic knowledge of routing protocols
Lecture 11 on basic network knowledge: Internet management architecture
Lecture 10 on basic network knowledge: TCP protocol understanding (advanced tutorial)
Lecture 9 on basic network knowledge: a preliminary understanding of the TCP protocol
Lecture 8 on basic network knowledge: a preliminary understanding of the IP protocol
Lecture 7: understanding and using ICMP protocol
Lecture 6 on basic network knowledge: Implementing subnets, including IPv6)
Lecture 5: Learning Spanning Tree Protocol
Lecture 4: understanding the data link layer
Network basics Lecture 3: Understanding OSI network layering
Network basics Lecture 2: Understanding subnet and CIDR
One of the basic network knowledge lectures: understanding the meaning of IPv4 addresses