Hey Thomas,

I didn't forget about you! I have been out of the office for a bit. The last one we have to talk about is VPNs and TLS. When we think about HTTPS remember that this protocol encrypts the communication between a web browser and a server.

So take for instances a quick little diagram:

0_1533910780200_Screen Shot 2018-08-10 at 10.14.06 AM.png

In this diagram we have User01 needs to access a public website, so how to we make it to where a user traversing a public network can connect to our company's website in a secure manner that protects the confidentiality, integrity and availability of the communication, we implement HTTPS which uses the security layer today of TLS.

0_1533911732920_Screen Shot 2018-08-10 at 10.35.00 AM.png

Note the DMZ here, the first (external) firewall allows for public access to our company's internal resources which in this case is the company website. So what does this do for us?

What does this do?

1 - Allows access to our internal resources
2 - Does not expose our internal network to the outside world when accessing the company website
3 - Allows the customer confidentiality of the communication - via HTTPS-based encryption
4 - Allows for integrity of the communication as there is a certificate exchange/validation of the web server.
5 - Encrypts ```web-based`` communication or HTML-based communications.

What doesn't this do?

1 - Allow for access from a public network (Internet) to the internal network for authorized users
2 - Provide authentication, authorization or auditing of those external to internal connections for authorized users

So what can we do to allow authorized users or employees access to internal company resources. For example Remote User 01 works from home 3 days out of the week. This user also needs access to her work files stored in a centralized file server located on the internal company network.0_1533913795231_Screen Shot 2018-08-10 at 11.09.35 AM.png

We could (please do not....lol) do this

1 - Place the web application server in the DMZ
2 - Place the file server in the DMZ

0_1533914034897_Screen Shot 2018-08-10 at 11.13.39 AM.png

As I am sure you are aware this presents a major security risk:

The web application and file server are now exposed to the public (and all the bad actors)
Authentication and authorization has to be performed, which in this case will expose the user database to the public (and all the bad actors)
Sensitive information is now exposed to the public
....and more

This is not a solution. So we need to:
1 - Keep these resources protected inside the company's internal network
2 - Implement a remote access technology that will allow for public access to internal resources that are not limited to web-based technologies such as HTTPS.
3 - Allow for the implementation of authentication, authorization and auditing.

This is where HTTPS is not a viable option because while it does allow for an encrypted communication between a web browser and a web server but lacks the other attributes we need. So insert ```VPN`` technologies.

VPNs allow us to:

1 - Connect to internal resources over existing public networks
2 - Connections appear as though the remote user is connected to the physical network
3 - Do not expose internal resources to those public networks
4 - Authentication can be performed by implementing technologies like RADIUS, TACACS+, Diameter
5 - Protect the user database from exposure to the public and bad actors
6 - Provide confidentiality to sensitive internal data through application of strong encryption.
7 - Allows for connections to and utilization of resources that do not use HTTPS (such as FTP, SSH, LDAP, SMB, NFS to name a few)

When we implement the VPN technologies we get these and more benefits. To the end user it looks like they are connected to the LAN and can access resources (not just HTTPS or web-based technologies)

0_1533916466588_Screen Shot 2018-08-10 at 11.51.11 AM.png

And VPNs security layer can be TLS!

I hope this helps @Thomas-Pondant

Thomas,

I hope all is well. Great questions !! let's see what we can do to shed some light on answers that make sense for you.

I'll go in the order that you asked the questions in:

"If I want to connect to a website and I have a VPN client installed on my computer, when I enter the website's name in my browser, what's exactly the route that my connection is going to take?"

Short answer is: The route will depend on where you are in relation to where you want to go & You ALWAYS have to use DNS to resolve and find a path to get to a website, the only question will be whose DNS and where is it located?

Longer answer involves us having to distinguish here between two possible scenarios to answer your question as noted below:

First Scenario: You DO NOT HAVE the VPN engaged and are using your machine to get to the Internet OUTSIDE OF THE VPN TUNNEL.

Second Scenario: You DO HAVE the VPN engaged and are using your machine to get to the Internet INSIDE OF THE VPN TUNNEL.

The reason to distinguish between these two scenarios is twofold: First, it is a question of your location PRIOR to making the request to resolve the website & Second, it is a question of what DNS infrastructure comes into play when, and as a result, whether you can get to the internet or not, and if so, how?

In the FIRST SCENARIO, you are connecting WITHOUT the VPN being engaged, so if you are at home, using your machine via your Internet Service Provider's (ISPs) network, you simply open a browser, type in a URL or IP address for the website you want to reach, and using the IP configuration provided by your ISP you use their DNS infrastructure to resolve the website, and then are routed to it via whatever path is most expedient over the public network(s) beyond your home access device provided by the ISP (cable modem, DSL device, etc...)

This would be the same by the way if you were at work, and connecting over the corporate network to an external website such as ITPRO.TV and did not use a VPN. The only difference would be that your company would most likely be providing the IP configuration and DNS information for you to use on the corporate network PRIOR to you connecting to the Default Gateway (the router for your subnet) that would allow you to gain access to the outside world. From there, the process would be the same.

In the SECOND SCENARIO, since you are using the VPN to establish a tunnel PRIOR to attempting to access the internet, things change a bit.

First, the VPN creates a dedicated pathway via an encrypted tunnel to allow you to securely connect to and use resources at the other end of that tunnel, wherever that is. As a result, when you establish the VPN, and successfully authenticate and connect, your machine will now NO LONGER be operating from the original connection point PRIOR to establishing the VPN, but rater is now operating from WITHIN the VPN tunnel and more specifically, from the other network that you have connected the VPN to. As a result, your machines IP configuration is changed and now matches whatever the IP configuration is for the endpoint network you are connected to via the VPN.

This is the critical difference between the two scenarios, as it means that your pathway to connect to the internet is now specified by the network that you are connected to, the VPN endpoint network. Whatever that path is, however it is designed, and whatever DNS and IP configuration it requires will be what is used if you attempt to access the internet while the VPN is active.

The above assumes of course that there is a pathway defined to get to the internet from the VPN endpoint network. If there is no path defined, then you WOULD NOT be able to connect to the internet while the VPN is active on you system.

"if you want to connect anywhere on the internet, you first have to use your ISP's infrastructure to do it, right? Is the first step out to the routers of the ISP's and then to whatever DNS server that will give me the IP of my VPN server? Or is my computer smart enough to directly send its packet to the VPN server?"

Lets break these down one question at a time:

"if you want to connect anywhere on the internet, you first have to use your ISP's infrastructure to do it, right?"

Based on the two scenarios we discussed above, the short answer is that you would use the ISP's infrastructure of the network that you are connecting through,

"Is the first step out to the routers of the ISP's and then to whatever DNS server that will give me the IP of my VPN server? Or is my computer smart enough to directly send its packet to the VPN server?"

Short answer is actually a combination of the two, assuming that you have a static IP configured as part of the configuration parameters for the VPN client's target.

Longer Answer: So, because we are using an IP ADDRESS to create the connection to the VPN endpoint, the target of the VPN client, that is provided EITHER ahead of time as part of the static configuration of the VPN client, or is prompted for or entered when you initialize the VPN client. DNS does not come into play for the resolution, UNLESS you are providing a Fully Qualified Domain Name (FQDN) as the endpoint for the VPN, in which case then DNS would be used to resolve and find the IP address to actually use for the connection.

As a result, your VPN client initializes its connection and goes straight to the router / default gateway that is local to where you are, and then from there the VPN tunnel is connected over the pathway that the ISP provides based on a variety of factors such as routing protocols being used, QoS on the connection, etc...

"if the first step has to be one of my ISP's routers, can the ISP see your unencrypted data before it reaches out to the VPN server? Or does my computer encrypt automatically its packets even before reaching the ISP? I guess that the ISP would still see the destination IP address in order to be able to forward my packets, am I correct?"

Short answer is that if there is no encryption being used / provided on a connection, then the data is available to anyone who is able to connect and see it.

Longer answer: It comes down to when the encryption protection(s) are applied to the data stream. If you are not using an application that provides encryption, then the data is being sent in the clear and can be seen. This why you use secure transmission protocols to send data over public networks such as the Internet/ World Wide Web.

Computers DO NOT automatically encrypt anything unless told to do so. For that matter, they do not do anything automatically unless told to do so.

It is not really that the ISP is able to see the destination IP address in the header of the request to set up the VPN, but rather that whatever mechanism(s) are used to transmit that request between routers until it gets to where it needs to go is able to understand the destination IP address.

I hope that this helps to clarify all your questions. Please let me know if we need to discuss anything further.

Good Luck !!!

Cheers,

Adam

I wanted to add a little on the SMB protocol for clarification, while I am not sure that this will help on the exam, it might help for understanding the SMB protocol packet exchange:

Keep in mind that SMB allows you to print to share printers as well

Step 1

The client and server establish a NetBIOS session. (This is the NetBIOS part see the packet capture below)

Step 2

The client and server negotiate the Microsoft SMB Protocol dialect.

Step 3

The client logs on to the server.

Step 4

The client connects to a share on the server.

Step 5

The client opens a file on the share.

Step 6

The client reads from the file.

Here is a Windows 10 Workstation below using NETBIOS:
0_1532115414415_Screen Shot 2018-07-20 at 3.19.58 PM.png

@thomas-pondant,

The whole purpose of classless IP addressing was to become more efficient with addressing. If, your ISP were to have to assign you an address in classful it would be a block of addresses. So lets say, 192.168.99.0 255.255.255.0. This would allow you to use 192.168.99.1 - 192.168.99.254 as possible addresses. What if you only used 60 of those addresses? Then there would be waste of 194 addresses that couldn't be re-assigned to potential customer. Here is the need for classless, it allows me to take the unused portion of that address block and subdivide it to smaller address space.

The other way is also possible, where we might be combining multiple address blocks together that are contiguous... Let's say I wanted to create a larger block than what the class C space I was assigned. I could get re-assigned a class B address but what if my ISP only has class C addresses. I could in theory lease, if my ISP would let me, 255 networks, 192.168.0.0, - 192.168.255.0. If I do so it's still 255 networks with 254 hosts per network. But what if I wanted one address block instead. It's here I can used classless to break the rules to use a class B subnet mask to create 1 network 192.168.0.0 255.255.0.0.

The network ID 192.168.0.0 The subnet mask 255.255.0.0 The range 192.168.0.1 - 192.168.255.254 (65,534 hosts) The broadcast 192.168.255.255

@thomas-pondant,

This can be because of many things.

It could be the Power of the wireless access point. It could be the wireless nic on the connecting device. It could be additional EM field interference from Microwaves, TVs, Electrical bleed from fluorescent lighting...etc. It could even be too many devices plugged into the same electrical circuit or that circuit having a common ground.
In other words, it's only by the process of elimination that you can isolate. There could be antenna issues itself. The VPN slows down the traffic because it has to build up the tunnel, filter, etc but it shouldn't influence the signal strength.

This is a layer 1 troubleshooting issue.

@thomas-pondant,

The provider wouldn't be accessing your equipment. But for you to configure it to allow for access to the DSL network. You may or not may not need to configure your wireless router to access the DSL network. The modem is normally their demarc, separating the customer's edge from the provider network. But for you to have access and now allow everyone to just jack into your RJ-11 outlet and get access to DSL, you may have to provide this PPPoE (or you may see PPPoDSL) password or id, etc.) for access.

Any troubleshooting they would do is only up to the Demarc on their end and the rest is your responsibility.

@thomas-pondant,

I'm not sure then I was clear then in the recording. The Wireless router is actually a combo device (Router, Switch and a Wireless Access Point). The only part of the Wireless Router that acts as a Layer 1 device is the Wireless Access Point. It operates using CSMA/CA and is half-duplex device.

All wireless access points act as a hub. If you device has one antenna, then only a single device accesses that antenna at any one time. Even if your device has antennae, only one connection per antenna at any one time, regardless of SOHO or production level devices.