I won't even try to answer the question directly, but merely to make
some comments. A VPN is a way to conceal the content of traffic moving
between one (user or site or computer or program or ...) to another
over a publicly accessible channel (eg, the Internet). In order to do
this, some way of exchanging (in a SECURE fashion) secret information
(ie, key(s)) is required beforehand. This can be accomplished in some
clever and tricky ways if both ends cooperate correctly. Once the
key(s) have been exchanged (SECURELY), some encryption algorithm is
needed (there are many) and a correct implementation must be used
correctly. Several good algorithms (no practical method is known to
break them directly) are (more or less, depending...) easily defeated
if used in particular ways; and of course, misimplementations of
otherwise good algorithms are not likely to be satisfactory.
Having all of that prepared, both ends must 'dance together' (as it
were) lest some mistep give away information to some attacker. And
behind the scenes at both ends, it is necessary that the application
(perhaps a database) talk to the operating system to dispatch traffic
to the right place via the cryptosystem handling the VPN.
Misconfiguration at that stage can reveal much, perhaps everything
you'd like to conceal from others.
Since there are no standard, known good, VPNs from anyone, and since
(some) operating systems are notorious for security leaks and such,
setting up a VPN which does what is desired is not trivial. In
particular, it cannot be (reasonably) done by blinding using a 'VPN
solution' from some vendor, whether or not provided builtin to some
operating system. Part of the reason is that a properly operating VPN
does not produce error messages, nor do would be attackers succeed in
reading the traffic. Improperly working VPNs may not produce error
messages, and successful attackers are unlikely to tell you about it.
In both cases, the other end may receive the information sent. If the
real world does not flag failure, and the software cannot, how can one
identify a properly functioning VPN? This is a serious problem and
there is no known solution, only various workarounds. The least
reasonable of those is blind faith that it's all working right.
Welcome to the world of attempts at secure communication. It's an
interesting place (remember the Chinese curse?). ww |
