{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"cs/vpn","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/cs/vpn/","da":"https://cmaintz.github.io/tech-atlas/da/terms/cs/vpn/"},"term":{"en":"VPN","da":"VPN"},"aka":{"en":["virtual private network"],"da":["virtuelt privat netværk"]},"domain":["cs"],"cluster":"networking","layer":"network","status":"current","era":1996,"summary":{"en":"An encrypted tunnel across a public network that makes a distant device act as if it were inside a private one.","da":"En krypteret tunnel over et offentligt netværk, der får en fjern enhed til at opføre sig, som om den var på et privat netværk."},"body":{"formal":{"en":"A technique that wraps a device's packets inside encrypted packets sent to a device at the far end, giving it a private connection to a network it is not physically attached to.","da":"En teknik, der pakker en enheds pakker ind i krypterede pakker sendt til en enhed i den anden ende, så den får en privat forbindelse til et netværk, den ikke fysisk er tilsluttet."},"plain":{"en":"Like a private, sealed tunnel from your home straight into the office building, so the walk through the busy public street no longer matters.","da":"Som en privat, lukket tunnel fra dit hjem direkte ind i kontorbygningen, så turen gennem den travle offentlige gade ikke længere betyder noget."},"inPractice":{"en":"A civil servant at a ministry, working from home, connects to the ministry's VPN and confirms with MFA before she opens the internal case system.","da":"En fuldmægtig i et ministerium, der arbejder hjemmefra, forbinder sig til ministeriets VPN og bekræfter med MFA, før hun åbner det interne sagssystem."},"whyItMatters":{"en":"It lets staff use internal systems safely from anywhere, but once inside, a user often reaches far more than they need - a weakness Zero Trust aims to fix.","da":"Den lader medarbejdere bruge interne systemer sikkert hvor som helst, men når man først er inde, kan man ofte nå langt mere end nødvendigt - en svaghed, Zero Trust vil løse."}},"deepDive":{"en":"VPNs come in three main forms: remote-access VPNs that connect individual devices to an organisation's network, site-to-site VPNs that join whole networks through gateways, and consumer \"privacy\" VPNs that route a user's traffic via a commercial provider. The main protocol families are IPsec, TLS-based VPNs and WireGuard. IPsec (architecture in RFC 4301) protects packets with ESP (RFC 4303), in tunnel mode for gateways or transport mode host to host, and negotiates keys with IKEv2 (RFC 7296) on UDP port 500, switching to UDP 4500 with encapsulation when NAT is detected. TLS-based VPNs, including OpenVPN and most vendor \"SSL VPN\" appliances, carry tunnelled packets over TLS or DTLS, which passes easily through firewalls. WireGuard, built on the Noise protocol framework with Curve25519, ChaCha20-Poly1305 and BLAKE2s, has a deliberately small codebase and was merged into the Linux kernel in version 5.6 (2020). PPTP from the 1990s is broken and should not be used.\n\nOn the client, a VPN creates a virtual network interface (tun or tap) and changes the routing table. In a full tunnel all traffic goes through the VPN; in split tunnelling only the organisation's prefixes do, which saves bandwidth but leaves the rest of the device's traffic outside central inspection. Encapsulation overhead lowers the effective MTU and can cause fragmentation problems. DNS must also be steered into the tunnel, or queries leak to the local network. The TunnelVision technique (CVE-2024-3661, 2024) showed that a hostile DHCP server can push classless static routes (option 121) that pull traffic out of the tunnel on most operating systems.\n\nVPN gateways are internet-facing, hold credentials and give network access, which makes them prime targets. Critical, widely exploited vulnerabilities have affected many vendors, among them Pulse Secure (CVE-2019-11510), Fortinet FortiOS (CVE-2018-13379) and Ivanti Connect Secure (CVE-2023-46805 and CVE-2024-21887, exploited in early 2024). VPN accounts without MFA are also a frequent initial access vector for ransomware groups, through password spraying or stolen credentials. Basic controls are MFA on every VPN login, rapid patching of the gateway, restricting and monitoring the management interface, and logging connections with source addresses to a SIEM.\n\nThe contrast with Zero Trust lies in what a connection grants. A classic VPN puts the device on the network, and unless internal segmentation restricts it, the user and any malware on the device can reach far more than needed. Zero Trust network access (ZTNA), in the spirit of NIST SP 800-207, instead brokers access per application after checking identity and device posture on each request. A VPN also differs from TLS: TLS protects one application connection end to end, whereas a VPN protects all traffic only between the device and the gateway, after which it travels unprotected unless the applications use TLS as well. A consumer VPN does not make a user anonymous; it moves trust from the local network and ISP to the VPN provider.","da":"VPN findes i tre hovedformer: fjernadgangs-VPN, der forbinder enkelte enheder med en organisations netværk, site-to-site-VPN, der forbinder hele netværk via gateways, og forbruger-VPN til \"privatliv\", der sender brugerens trafik via en kommerciel udbyder. De vigtigste protokolfamilier er IPsec, TLS-baserede VPN'er og WireGuard. IPsec (arkitekturen i RFC 4301) beskytter pakker med ESP (RFC 4303), i tunnel mode mellem gateways eller transport mode fra vært til vært, og forhandler nøgler med IKEv2 (RFC 7296) på UDP-port 500 og skifter til UDP 4500 med indkapsling, når der registreres NAT. TLS-baserede VPN'er, herunder OpenVPN og de fleste leverandørers \"SSL VPN\"-udstyr, bærer tunnelerede pakker over TLS eller DTLS, som let slipper gennem firewalls. WireGuard, der bygger på Noise-protokolrammen med Curve25519, ChaCha20-Poly1305 og BLAKE2s, har en bevidst lille kodebase og blev optaget i Linux-kernen i version 5.6 (2020). PPTP fra 1990'erne er brudt og bør ikke bruges.\n\nPå klienten opretter en VPN en virtuel netværksgrænseflade (tun eller tap) og ændrer routingtabellen. Ved full tunnel går al trafik gennem VPN'en; ved split tunnelling gør kun organisationens præfikser det, hvilket sparer båndbredde, men efterlader resten af enhedens trafik uden for den centrale inspektion. Ekstra headere fra indkapslingen mindsker den effektive MTU og kan give problemer med fragmentering. DNS skal også ledes ind i tunnelen, ellers lækker forespørgslerne til det lokale netværk. Teknikken TunnelVision (CVE-2024-3661, 2024) viste, at en ondsindet DHCP-server kan skubbe klasseløse statiske ruter (option 121) ud, som trækker trafik ud af tunnelen på de fleste styresystemer.\n\nVPN-gateways vender mod internettet, håndterer legitimationsoplysninger og giver netværksadgang, hvilket gør dem til oplagte mål. Kritiske, bredt udnyttede sårbarheder har ramt mange leverandører, bl.a. Pulse Secure (CVE-2019-11510), Fortinet FortiOS (CVE-2018-13379) og Ivanti Connect Secure (CVE-2023-46805 og CVE-2024-21887, udnyttet i begyndelsen af 2024). VPN-konti uden MFA er også en hyppig indgang for ransomware-grupper via password spraying eller stjålne legitimationsoplysninger. Grundlæggende kontroller er MFA på hvert VPN-login, hurtig patching af gatewayen, begrænsning og overvågning af administrationsgrænsefladen og logning af forbindelser med kildeadresser til en SIEM.\n\nKontrasten til Zero Trust ligger i, hvad en forbindelse giver adgang til. En klassisk VPN placerer enheden på netværket, og medmindre intern segmentering begrænser den, kan brugeren - og eventuel malware på enheden - nå langt mere end nødvendigt. Zero Trust network access (ZTNA) i ånden fra NIST SP 800-207 formidler i stedet adgang pr. applikation efter kontrol af identitet og enhedens tilstand ved hver anmodning. En VPN adskiller sig også fra TLS: TLS beskytter én applikationsforbindelse fra ende til ende, mens en VPN kun beskytter al trafik mellem enheden og gatewayen, hvorefter den rejser ubeskyttet videre, medmindre applikationerne også bruger TLS. En forbruger-VPN gør ikke brugeren anonym; den flytter blot tilliden fra det lokale netværk og internetudbyderen til VPN-udbyderen."},"edges":[{"type":"requires","to":"cs/network","confidence":"high","strength":"normal"},{"type":"requires","to":"cs/encryption","confidence":"high","strength":"normal"},{"type":"requires","to":"cs/ip-address","confidence":"high","strength":"normal"},{"type":"implements","to":"security/confidentiality","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/zero-trust","why":{"en":"A VPN trusts whoever gets into the network; Zero Trust checks every request no matter where it comes from.","da":"En VPN stoler på den, der kommer ind på netværket; Zero Trust tjekker hver anmodning, uanset hvor den kommer fra."},"confidence":"high","strength":"primary"}],"depth":2,"sources":[{"title":"Kurose & Ross, Computer Networking: A Top-Down Approach","tier":"textbook"},{"title":"Tanenbaum, Computer Networks","tier":"textbook"}],"draft":true}