Because OpenVPN devices are fully managed by the kernel, data transfers are invisible to the network, enhancing security and cross-platform compatibility.
I’m not going to talk about configuring OpenVPN in an AWS environment, for that you should read OpenVPN: Connecting VPCs between regions. We will try to go a bit deeper and learn exactly what’s going on under the hood.
I remember not too many years ago, we would ignore anything we’d hear about VPNs: those details are for the network team to worry about. But with the move to Cloud Computing Infrastructure as a Service models and the rise of DevOps, it’s coming much closer to home. I mean if, for instance, you’re working in a cloud environment like AWS, you will frequently encounter scenarios where you need to enable secured communication between VPC’s in different regions. The most obvious solution to that is some kind of virtual private network. And one of the more obvious virtual private network solutions is OpenVPN.
OpenVPN is an open source VPN software solution licensed under GNU General public license (GPL) that enables secure point-to-point or site-to-site connections. OpenVPN can create interfaces from either layer 2 or layer 3 of OSI model using the industry standard SSL/TLS protocol, to provide secure connection and authentication mechanisms.
How OpenVPN works
The above diagram illustrates OpenVPN’s basic “client server mode” model. From one side, the OpenVPN server connects to the Internet, but at the same time, it maintains a secure communication channel with its clients. We’ll elaborate the working of TUN and TAP so as to understand the basic skeleton of any program attached to these interfaces. These program can be further extended to have OpenVPN kind of daemon or any other user defined behavior.
ll Internet traffic directed at an OpenVPN client is terminated at the server and transmitted to the client over a secure channel. Similar communication happens other way round, where any request originating from a OpenVPN Client is terminated at the server and then relayed to the Internet. This means that an OpenVPN client is known to the outside world only through the server’s identity, maintaining a higher level of privacy.
Communication between OpenVPN client and Server
Let us try to dig bit further and see how the communication channel connecting the OpenVPN client and server works. We’ll use a simple analogy. Usually a network interface in a computer has a physical device associated with it. For instance, ethernet interfaces have network cables attached that are used for physical data transfers. An OpenVPN connection is achieved through a virtual network interface backed by software.
This brings us nicely to the topic of TUN (“network TUNnel”) and TAP (“network TAP”). TUN and TAP are really virtual network interfaces implemented and managed by the kernel itself. So we can think of TUN/TAP as virtual ethernet interfaces.
The TUN interface
TUN is a virtual point to point network device whose driver was designed as low level kernel support for IP tunneling. It works at the protocol layer of the network stack.
The TAP Interface
TAP is a virtual Ethernet network device. TAP driver was designed as low-level kernel support for Ethernet tunneling. It works at the Ethernet Layer of OSI stack and aren’t limited to point to point connection as that of TUN devices.
Let’s go back to our analogy: when something is transferred through an ethernet interface, it’s sent through the cable. However, since TUN/TAP interfaces are virtual, data in transit can be available for just about any purpose to any program running in the user space.
OpenVPN implements a daemon which is attached to the TUN/TAP interfaces. So any data sent over a virtual interface is redirected by the kernel to the OpenVPN Daemon, which in turn implements the authentication and encryption mechanism.
How TUN and TAP work
TUN and TAP are fully managed by the kernel and allow user space applications to interact with them just like a real device. Any packets sent to these interfaces will be transmitted by the OS over the real network, remaining invisible to the user. Because it doesn’t require modification of the IP stack in the kernel space, this architecture is a key advantage of OpenVPN compared to other VPN solutions.
Let us try to understand the flow of data with virtual interfaces and a sample encryption application.
Let us assume two hosts, A and B, both configured with a virtual tap interface and an ethernet interface. Now we have an encryption application running in user space which performs some basic encryption. The encryption application has to keep track of two file descriptors:
- File descriptor obtained from attaching itself to the virtual interface, say tap_fd. When the program attaches to the tun/tap interface, it reads the data being sent from the interface from the special file descriptor.
- File descriptor received from opening a socket with the ethernet interface, say net_fd.
This application basically attaches and waits on some kind of select() on both the fd’s.
Now let us assume there is a communication channel over TCP established between the ethernet interfaces on Host A and Host B. The ethernet and tap interface at both ends are configured, up and running,
- A Telnet application uses the local virtual interface to send the data to the remote host.
- Since the encryption application is waiting for the tap_fd and net_fd file descriptors, it receives message over tap_fd descriptor and performs the required encryption.
- The sample client sends the encrypted message over the net_fd descriptor to be sent over the TCP channel.
- The ethernet interface (net_fd) at Host B receives the packet.
- Since the sample decryption server running at host B is also waiting on net_fd and tap_fd, it receives the packet at net_fd and performs the necessary decryption.
- After decryption, the sample server writes the data over tap_fd. When the data is written to the tap interface descriptor, kernel recognizes it as the message coming from the network or the wire, and executes it as if received from a normal ethernet interface.
Thus, the outside world only sees a normal TCP communication channel, but the actual data is sent in encrypted format and is never exposed.
The above flow of data provides a fairly simplistic view of how applications interact using TUN/TAP interfaces. The same logic is further extended by the OpenVPN application. OpenVPN allows the flexibility to use various client authentication and encryption mechanisms. The users, if they want, can use the built-in OpenSSL mechanism for authentication and encryption, or can go with an alternate approach using OpenVPN PAM – which provides a plugin module interface for exclusive or combined authentication.
With this blog I’ve tried to drop down one level to see what actually happens under the hood. You can find some additional background on this topic by reading Nitheesh Poojary’s excellent post, OpenVPN: Connecting VPCs between regions, which was written and published last summer. I hope this will help you better understand OpenVPN. I would really appreciate any comments or feedback you might have based on your own experience so we can all learn from each other.
What Exactly Is a Cloud Architect and How Do You Become One?
One of the buzzwords surrounding the cloud that I'm sure you've heard is "Cloud Architect." In this article, I will outline my understanding of what a cloud architect does and I'll analyze the skills and certifications necessary to become one. I will also list some of the types of jobs ...
Content Roadmap: AZ-500, ITIL 4, MS-100, Google Cloud Associate Engineer, and More
Last month, Cloud Academy joined forces with QA, the UK’s largest B2B skills provider, and it put us in an excellent position to solve a massive skills gap problem. As a result of this collaboration, you will see our training library grow with additions from QA’s massive catalog of 500+...
DevSecOps: How to Secure DevOps Environments
Security has been a friction point when discussing DevOps. This stems from the assumption that DevOps teams move too fast to handle security concerns. This makes sense if Information Security (InfoSec) is separate from the DevOps value stream, or if development velocity exceeds the band...
Test Your Cloud Knowledge on AWS, Azure, or Google Cloud Platform
Cloud skills are in demand | In today's digital era, employers are constantly seeking skilled professionals with working knowledge of AWS, Azure, and Google Cloud Platform. According to the 2019 Trends in Cloud Transformation report by 451 Research: Business and IT transformations re...
Disadvantages of Cloud Computing
If you want to deliver digital services of any kind, you’ll need to estimate all types of resources, not the least of which are CPU, memory, storage, and network connectivity. Which resources you choose for your delivery — cloud-based or local — is up to you. But you’ll definitely want...
Google Cloud vs AWS: A Comparison (or can they be compared?)
The "Google Cloud vs AWS" argument used to be a common discussion among our members, but is this still really a thing? You may already know that there are three major players in the public cloud platforms arena: Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP)...
Deployment Orchestration with AWS Elastic Beanstalk
If you're responsible for the development and deployment of web applications within your AWS environment for your organization, then it's likely you've heard of AWS Elastic Beanstalk. If you are new to this service, or simply need to know a bit more about the service and the benefits th...
How to Use & Install the AWS CLI
What is the AWS CLI? | The AWS Command Line Interface (CLI) is for managing your AWS services from a terminal session on your own client, allowing you to control and configure multiple AWS services and implement a level of automation. If you’ve been using AWS for some time and feel...
Cloud Academy’s Blog Digest: July 2019
July has been a very exciting month for us at Cloud Academy. On July 10, we officially joined forces with QA, the UK’s largest B2B skills provider (read the announcement). Over the coming weeks, you will see additions from QA’s massive catalog of 500+ certification courses and 1500+ ins...
AWS Fundamentals: Understanding Compute, Storage, Database, Networking & Security
If you are just starting out on your journey toward mastering AWS cloud computing, then your first stop should be to understand the AWS fundamentals. This will enable you to get a solid foundation to then expand your knowledge across the entire AWS service catalog. It can be both d...
How to Become a DevOps Engineer
The DevOps Handbook introduces DevOps as a framework for improving the process for converting a business hypothesis into a technology-enabled service that delivers value to the customer. This process is called the value stream. Accelerate finds that applying DevOps principles of flow, f...
AWS AMI Virtualization Types: HVM vs PV (Paravirtual VS Hardware VM)
Amazon Machine Images (AWS AMI) offers two types of virtualization: Paravirtual (PV) and Hardware Virtual Machine (HVM). Each solution offers its own advantages. When we’re using AWS, it’s easy for someone — almost without thinking — to choose which AMI flavor seems best when spinning...