About VPN protocols

The number of users of VPN protocols is growing rapidly. We are talking about those who need a VPN for safe work, and not to bypass various blocking. Since the service has become very popular, it is worth studying the proposed protocols in detail and comparing their capabilities.

First of all, let's look at general information about VPN. It is often used for the following purposes:

●     creation of a secure channel between remote parts of the network (for example, between offices in different cities);

●     joining a remote employee to a client network;

●    change location through VPN Providers (requires little effort, but passes traffic through a third-party server).

Each of these scenarios can be implemented with a specific VPN protocol (traffic anonymity, communication, etc.).

Having defined your goals, you can choose the right VPN. The most famous and popular protocols are OpenVPN and IPSec, recently developed by WireGuard, which managed to cause controversy. There are also more outdated services that can solve a number of problems.

The definition of the benefits of each VPN protocol is influenced by the criteria and conditions for use:

Devices - certain types of devices are compatible with different VPNs.

Network - if access to the service is limited in certain locations, some protocols will not work. For example, VPN Providers is suitable for users in China, while many providers are blacklisted.

Performance - certain protocols have better performance, particularly on mobile devices. Others are suitable for operation on other networks.

Security - Not all protocols demonstrate complete security, so cybercriminals affect them in specific ways.

So, we have reviewed the basic information, now we will acquaint you with the protocols and their features in more detail.

PPTP (Point-to-Point Tunneling Protocol) is the most famous protocol created by Microsoft. It is considered one of the oldest and frequently used by customers.

The VPN protocol uses multiple connections - for data isolation and control. The first one works with the GRE protocol (a replacement for TCP/UDP). The second is using TCP on port 1723. Based on this, users behind NAT cannot connect to the server, since they do not have a point-to-point connection. It is worth noting that the presence of the Call ID header in GRE allows native routers to recognize and correlate traffic originating from the local network user to the main server and vice versa. So, users behind NAT can use this protocol by creating a point-to-point connection. This technology is called VPN PassTrough and is supported by most telecommunications equipment.

PPTP is supported by Windows and other operating systems. The protocol demonstrates a decent download speed, but does not provide reliability: as a result of a connection loss, it takes some time to recover.

Now PPTP is considered obsolete, so Windows advises you to choose other VPNs to work effectively. Also, the protocol should not be used if you are worried about the security and safety of personal data.

Of course, PPTP is good for unblocking web content, but it's worth exploring more reliable options.

SSTP (Secure Socket Tunneling Protocol) is a protocol owned by Microsoft. It is popular in the VPN industry, however, compared to PPTP, it has big security problems.

Traffic is sent over SSL using TCP port 443. Due to this, the protocol is used in specific situations. SSTP, although available on RouterOS, SEI, and Linux systems, is operated primarily by Windows. It is worth noting the high performance and security of the protocol, but few providers work with it.

SSTP is useful for blocking other anonymizers, but OpenVPN remains the best option.

IPsec (Internet Protocol Security) is a set of protocols that protect network information. Operating systems do not require auxiliary programs to work with IPsec. The protocol can also function together with L2TP and IKEv2.

IPsec encodes a block of data with:

Authentication Header, digitally stamping it;

Encapsulating Security Protocol for privacy, integrity and authentication.

Let's take a closer look at L2TP and IKEv2 in conjunction with IPsec.

L2TP/IPsec (Layer 2 Tunneling Protocol) was introduced as a new version of L2F and PPTP over 20 years ago. On its own, a VPN does not provide encryption or authentication, and often works in conjunction with IPsec. This pair is compatible with most operating systems, adhering to the RFC 3193 standard.

L2TP/IPsec provides almost complete security. The protocol uses 3DES or AES block ciphers, while 3DES is weak and rarely exploited.

In rare cases, L2TP has problems with UDP port 500 being blocked by certain firewalls.

L2TP/IPsec secures data well and is compatible with many systems. The only drawback of the protocol is the double encapsulation of data, as a result of which the VPN operates at a low speed and is not as efficient.

IKEv2/IPsec (Internet Key Exchange version 2) is required for two-way authentication and Security Associations.

The standard is RFC 7296. The security level is the same as that of L2TP, which indicates decent security. Giants Microsoft and Cisco have worked on IKEv2, but the protocol is often implemented in open source.

IKEv2 is well tolerated by network replacement with Mobility and Multi-homing Protocol. So, the protocol is great for phones that are constantly switching between a mobile network and a Wi-Fi hotspot.

In addition, IKEv2/IPsec is used for cryptographic encryption algorithms (AES, Blowfish and Camellia) considering 256-bit keys.

The protocol supports Perfect Forward Secrecy.

IKEv2 demonstrates faster performance than OpenVPN. Considering the performance of the protocol, it will be an ideal choice for mobile devices due to good connection re-establishment. IKEv2 runs on popular systems - Windows (version 7 and above), Mac OS (10.11 and above), iOS and some versions of Android.

OpenVPN is a quality open source protocol created by OpenVPN Technologies. It is the most widely used VPN today and has shown a good level of security.

OpenVPN will work for most network connections. The protocol demonstrates high download speed and stability. OpenVPN works over TCP and UDP ports and is also an IPsec replacement for blocked protocols.

To activate OpenVPN, you need to install special software. Most services have their own application for the protocol. VPN freely interacts with TCP and UPD, and is also used on standard platforms with Windows, Linux, Mac OS, Android, Apple iOS.

If OpenVPN is not compatible with your goals, you should explore other options.

WireGuard is a little-known protocol that acts as a replacement for OpenVPN. At the same time, VPN is more secure, simple and effective.

WireGuard-compatible IP packets are encapsulated in UDP and transmitted to other file sharing participants without loss of security. The protocol uses the following cryptography:

●     key transfer - Curve25519;

●     encryption - ChaCha20;

●     authentication - Poly1305;

●     hash array keys - SipHash;

●     hashing - BLAKE2.

Recently, WireGuard 1.0.0 was released, marking the introduction of WireGuard segments into the core of the Linux 5.6 kernel. The code included in it showed an excellent level of security. This is great news, but the protocol needs to prove itself and stand the test of time.