OpenVPN: how secure virtual private networks really work

Because OpenVPN devices are fully managed by the kernel, data transfers are invisible to the network, enhancing security and cross-platform compatibility.

I’m not going to talk about configuring OpenVPN in an AWS environment, for that you should read OpenVPN: Connecting VPCs between regions. We will try to go a bit deeper and learn exactly what’s going on under the hood.

I remember not too many years ago, we would ignore anything we’d hear about VPNs: those details are for the network team to worry about. But with the move to Cloud Computing Infrastructure as a Service models and the rise of DevOps, it’s coming much closer to home. I mean if, for instance, you’re working in a cloud environment like AWS, you will frequently encounter scenarios where you need to enable secured communication between VPC’s in different regions. The most obvious solution to that is some kind of virtual private network. And one of the more obvious virtual private network solutions is OpenVPN.

OpenVPN Introduction

OpenVPN is an open source VPN software solution licensed under GNU General public license (GPL) that enables secure point-to-point or site-to-site connections. OpenVPN can create interfaces from either layer 2 or layer 3 of OSI model using the industry standard SSL/TLS protocol, to provide secure connection and authentication mechanisms.

How OpenVPN works


openvpn - design
The above diagram illustrates OpenVPN’s basic “client server mode” model. From one side, the OpenVPN server connects to the Internet, but at the same time, it maintains a secure communication channel with its clients. We’ll elaborate the working of TUN and TAP so as to understand the basic skeleton of any program attached to these interfaces. These program can be further extended to have OpenVPN kind of daemon or any other user defined behavior.

ll Internet traffic directed at an OpenVPN client is terminated at the server and transmitted to the client over a secure channel. Similar communication happens other way round, where any request originating from a OpenVPN Client is terminated at the server and then relayed to the Internet. This means that an OpenVPN client is known to the outside world only through the server’s identity, maintaining a higher level of privacy.

Communication between OpenVPN client and Server

Let us try to dig bit further and see how the communication channel connecting the OpenVPN client and server works. We’ll use a simple analogy. Usually a network interface in a computer has a physical device associated with it. For instance, ethernet interfaces have network cables attached that are used for physical data transfers. An OpenVPN connection is achieved through a virtual network interface backed by software.
This brings us nicely to the topic of TUN (“network TUNnel”) and TAP (“network TAP”). TUN and TAP are really virtual network interfaces implemented and managed by the kernel itself. So we can think of TUN/TAP as virtual ethernet interfaces.
OpenVPN - architecture

The TUN interface

TUN is a virtual point to point network device whose driver was designed as low level kernel support for IP tunneling. It works at the protocol layer of the network stack.

The TAP Interface

TAP is a virtual Ethernet network device. TAP driver was designed as low-level kernel support for Ethernet tunneling. It works at the Ethernet Layer of OSI stack and aren’t limited to point to point connection as that of TUN devices.

Let’s go back to our analogy: when something is transferred through an ethernet interface, it’s sent through the cable. However, since TUN/TAP interfaces are virtual, data in transit can be available for just about any purpose to any program running in the user space.

OpenVPN implements a daemon which is attached to the TUN/TAP interfaces. So any data sent over a virtual interface is redirected by the kernel to the OpenVPN Daemon, which in turn implements the authentication and encryption mechanism.

How TUN and TAP work

TUN and TAP are fully managed by the kernel and allow user space applications to interact with them just like a real device. Any packets sent to these interfaces will be transmitted by the OS over the real network, remaining invisible to the user. Because it doesn’t require modification of the IP stack in the kernel space, this architecture is a key advantage of OpenVPN compared to other VPN solutions.
Let us try to understand the flow of data with virtual interfaces and a sample encryption application.
OpenVPN
Let us assume two hosts, A and B, both configured with a virtual tap interface and an ethernet interface. Now we have an encryption application running in user space which performs some basic encryption. The encryption application has to keep track of two file descriptors:

  1. File descriptor obtained from attaching itself to the virtual interface, say tap_fd. When the program attaches to the tun/tap interface, it reads the data being sent from the interface from the special file descriptor.
  2. File descriptor received from opening a socket with the ethernet interface, say net_fd.

This application basically attaches and waits on some kind of select() on both the fd’s.
Now let us assume there is a communication channel over TCP established between the ethernet interfaces on Host A and Host B. The ethernet and tap interface at both ends are configured, up and running,

  1. A Telnet application uses the local virtual interface to send the data to the remote host.
  2. Since the encryption application is waiting for the tap_fd and net_fd file descriptors, it receives message over tap_fd descriptor and performs the required encryption.
  3. The sample client sends the encrypted message over the net_fd descriptor to be sent over the TCP channel.
  4. The ethernet interface (net_fd) at Host B receives the packet.
  5. Since the sample decryption server running at host B is also waiting on net_fd and tap_fd, it receives the packet at net_fd and performs the necessary decryption.
  6. After decryption, the sample server writes the data over tap_fd. When the data is written to the tap interface descriptor, kernel recognizes it as the message coming from the network or the wire, and executes it as if received from a normal ethernet interface.

Thus, the outside world only sees a normal TCP communication channel, but the actual data is sent in encrypted format and is never exposed.
The above flow of data provides a fairly simplistic view of how applications interact using TUN/TAP interfaces. The same logic is further extended by the OpenVPN application. OpenVPN allows the flexibility to use various client authentication and encryption mechanisms. The users, if they want, can use the built-in OpenSSL mechanism for authentication and encryption, or can go with an alternate approach using OpenVPN PAM – which provides a plugin module interface for exclusive or combined authentication.

With this blog I’ve tried to drop down one level to see what actually happens under the hood. You can find some additional background on this topic by reading Nitheesh Poojary’s excellent post, OpenVPN: Connecting VPCs between regions, which was written and published last summer. I hope this will help you better understand OpenVPN. I would really appreciate any comments or feedback you might have based on your own experience so we can all learn from each other.

Avatar

Written by

Vineet Badola

Working as a cloud professional for last 6 years in various organizations, I have experience in three of the most popular cloud platforms, AWS IaaS, Microsoft Azure and Pivotal Cloud Foundry PaaS platform. Having around 10 years of IT experience in various roles and I take great interest in learning and sharing my knowledge on newer technologies. Wore many hats as developer, lead, architect in cloud technologies implementation. During Leisure time I enjoy good soothing music, playing TT and sweating out in Gym. I believe sharing knowledge is my way to make this world a better place.


Related Posts

Joe Nemer
Joe Nemer
— September 15, 2020

New Content: Azure DP-100 Certification, Alibaba Cloud Certified Associate Prep, 13 Security Labs, and Much More

This past month our Content Team served up a heaping spoonful of new and updated content. Not only did our experts release the brand new Azure DP-100 Certification Learning Path, but they also created 18 new hands-on labs — and so much more! New content on Cloud Academy At any time, y...

Read more
  • AWS
  • Azure
  • DevOps
  • Google Cloud Platform
  • Machine Learning
  • programming
Joe Nemer
Joe Nemer
— August 28, 2020

AWS Certification Practice Exam: What to Expect from Test Questions

If you’re building applications on the AWS cloud or looking to get started in cloud computing, certification is a way to build deep knowledge in key services unique to the AWS platform. AWS currently offers 12 certifications that cover major cloud roles including Solutions Architect, De...

Read more
  • AWS
  • AWS Certifications
Patrick Navarro
Patrick Navarro
— August 25, 2020

Overcoming Unprecedented Business Challenges with AWS

From auto-scaling applications with high availability to video conferencing that’s used by everyone, every day —  cloud technology has never been more popular or in-demand. But what does this mean for experienced cloud professionals and the challenges they face as they carve out a new p...

Read more
  • AWS
  • Cloud Adoption
  • digital transformation
Avatar
Andrew Larkin
— August 18, 2020

Constant Content: Cloud Academy’s Q3 2020 Roadmap

Hello —  Andy Larkin here, VP of Content at Cloud Academy. I am pleased to release our roadmap for the next three months of 2020 — August through October. Let me walk you through the content we have planned for you and how this content can help you gain skills, get certified, and...

Read more
  • alibaba
  • AWS
  • Azure
  • content roadmap
  • Content updates
  • DevOps
  • GCP
  • Google Cloud
  • New content
Alisha Reyes
Alisha Reyes
— August 5, 2020

New Content: Alibaba, Azure AZ-303 and AZ-304, Site Reliability Engineering (SRE) Foundation, Python 3 Programming, 16 Hands-on Labs, and Much More

This month our Content Team did an amazing job at publishing and updating a ton of new content. Not only did our experts release the brand new AZ-303 and AZ-304 Certification Learning Paths, but they also created 16 new hands-on labs — and so much more! New content on Cloud Academy At...

Read more
  • AWS
  • Azure
  • DevOps
  • Google Cloud Platform
  • Machine Learning
  • programming
Alisha Reyes
Alisha Reyes
— July 16, 2020

Blog Digest: Which Certifications Should I Get?, The 12 Microsoft Azure Certifications, 6 Ways to Prevent a Data Breach, and More

This month, we were excited to announce that Cloud Academy was recognized in the G2 Summer 2020 reports! These reports highlight the top-rated solutions in the industry, as chosen by the source that matters most: customers. We're grateful to have been nominated as a High Performer in se...

Read more
  • AWS
  • Azure
  • blog digest
  • Certifications
  • Cloud Academy
  • OWASP
  • OWASP Top 10
  • Security
  • VPCs
Avatar
Cloud Academy Team
— July 9, 2020

Which Certifications Should I Get?

The old AWS slogan, “Cloud is the new normal” is indeed a reality today. Really, cloud has been the new normal for a while now and getting credentials has become an increasingly effective way to quickly showcase your abilities to recruiters and companies. With all that in mind, the s...

Read more
  • AWS
  • Azure
  • Certifications
  • Cloud Computing
  • Google Cloud Platform
Alisha Reyes
Alisha Reyes
— July 2, 2020

New Content: AWS, Azure, Typescript, Java, Docker, 13 New Labs, and Much More

This month, our Content Team released a whopping 13 new labs in real cloud environments! If you haven't tried out our labs, you might not understand why we think that number is so impressive. Our labs are not “simulated” experiences — they are real cloud environments using accounts on A...

Read more
  • AWS
  • Azure
  • DevOps
  • Google Cloud Platform
  • Machine Learning
  • programming
Joe Nemer
Joe Nemer
— June 19, 2020

Kickstart Your Tech Training With a Free Week on Cloud Academy

Are you looking to make a jump in your technical career? Want to get trained or certified on AWS, Azure, Google Cloud Platform, DevOps, Kubernetes, Python, or another in-demand skill? Then you'll want to mark your calendar. Starting Monday, June 22 at 12:00 a.m. PDT (3:00 a.m. EDT), ...

Read more
  • AWS
  • Azure
  • cloud academy content
  • complimentary access
  • GCP
  • on the house
Alisha Reyes
Alisha Reyes
— June 11, 2020

New Content: AZ-500 and AZ-400 Updates, 3 Google Professional Exam Preps, Practical ML Learning Path, C# Programming, and More

This month, our Content Team released tons of new content and labs in real cloud environments. Not only that, but we introduced our very first highly interactive "Office Hours" webinar. This webinar, Acing the AWS Solutions Architect Associate Certification, started with a quick overvie...

Read more
  • AWS
  • Azure
  • DevOps
  • Google Cloud Platform
  • Machine Learning
  • programming
Rebecca Willis
Rebecca Willis
— June 3, 2020

Azure vs. AWS: Which Certification Provides the Brighter Future?

More and more companies are using cloud services, prompting more and more people to switch their current IT position to something cloud-related. The problem is most people only have that much time after work to learn new technologies, and there are plenty of cloud services that you can ...

Read more
  • AWS
  • Azure
  • certification
Alisha Reyes
Alisha Reyes
— June 2, 2020

Blog Digest: 5 Reasons to Get AWS Certified, OWASP Top 10, Getting Started with VPCs, Top 10 Soft Skills, and More

Thank you for being a valued member of our community! We recently sent out a short survey to understand what type of content you would like us to add to Cloud Academy, and we want to thank everyone who gave us their input. If you would like to complete the survey, it's not too late. It ...

Read more
  • AWS
  • Azure
  • blog digest
  • Certifications
  • Cloud Academy
  • OWASP
  • OWASP Top 10
  • Security
  • VPCs