VPN

Your company has an office in New York and a cloud VPC in AWS us-east-1. Developers need to access internal tools running in the VPC, databases, admin panels, monitoring dashboards. These resources are in private subnets with no public IPs. How do your developers reach them?

Option A: Make everything public. Terrible idea. Your database is now exposed to every bot scanner on the internet.

Option B: Build a dedicated physical cable from your office to AWS. Works, but costs $10,000+ per month (this is what AWS Direct Connect is).

Option C: Create an encrypted tunnel through the public internet. Your traffic travels over the same cables as everyone else's, but it's wrapped in encryption that makes it unreadable to anyone who intercepts it. From your office network's perspective, the VPC feels like it's on the same local network.

That's a VPN. It's the most common way to connect private networks across untrusted infrastructure. Every remote worker who connects to their company's internal network uses one. Every hybrid cloud architecture relies on one. It's the duct tape that holds modern enterprise networking together.

A VPN creates an encrypted tunnel between two endpoints. All traffic inside the tunnel is encrypted before it enters the public internet and decrypted when it exits.

Key protocols:

The tunnel process:

1. Two VPN endpoints negotiate encryption parameters (IKE Phase 1)
2. They establish a shared secret key (IKE Phase 2)
3. A tunnel is created, all traffic between the networks is encrypted
4. If the tunnel drops, it automatically renegotiates and reconnects

Split tunneling vs full tunneling:

• Full tunnel: ALL traffic goes through the VPN. Secure, but slow for personal browsing.
• Split tunnel: Only traffic destined for the private network goes through the VPN. Everything else goes directly to the internet. Better performance, slightly less secure.