VPN Packet Structure – Understanding VPN Packet Structure in Different Implementations

vpn

In order to understand different VPN technologies I tried to write down how a single HTTP packet could look like using each implementation.

SSH VPN 

HTTP | TCP | IP | Ethernet ||| SSH | TCP | IP | Ethernet

OpenVPN bridged mode 

HTTP | TCP | IP | Ethernet ||| OpenVPN | TLS | TCP | IP | Ethernet

OpenVPN routed mode 

HTTP | TCP | IP ||| OpenVPN | TLS | TCP | IP | Ethernet

IPSec tunnel mode 

HTTP | TCP | IP ||| IPSec Auth Header | IP | Ethernet

PPTP 

HTTP | TCP | IP | PPP ||| GRE | IP | Ethernet

L2TP 

HTTP | TCP | IP | PPP ||| L2TP | UDP | IP | Ethernet

It is based on information from different sources and I'd like to ask three questions:
1) Are the diagrams correct?
2) Are PPP and Ethernet interchangeable?
3) Is OpenVPN 'TCP over TCP' as implied by the diagrams above?

Best Answer

1) I would say yes, they are correct for some variants of these VPNs.

2) Ron Maupin already pointed out a difference. PPP is sometimes used to insert authentication like in PPPoE or with some proprietary IPsec extensions using IKEv1.

3) OpenVPN is best used with UDP because TCP over TCP is not a good idea. This article from Olaf Titz explains why. Usually you only use TCP over TCP when UDP isn't possible because some firewall on the way between the VPN gateways won't allow it.

Related Topic