Defence: VPNs and IPsec
Anyone on the internet path can copy, change or replay your packets. A VPN stops that by building an encrypted tunnel. Watch two offices (192.168.1.0/24 and 192.168.2.0/24) set one up with IKEv2, carry a packet through it in ESP tunnel mode, and leave the eavesdropper with nothing but a locked envelope.
5 quick questions
Pick an answer to see why. Your score saves with your progress.
01In a site-to-site VPN using ESP tunnel mode, which addresses can the eavesdropper read?
Tunnel mode encrypts the whole original packet, its header included, and puts a new outer header between the two gateways in front of it. That outer header must stay readable so routers can deliver it.
02What does IKEv2 do before any office data flows?
IKE_SA_INIT agrees algorithms and does the Diffie–Hellman exchange; IKE_AUTH, already encrypted, proves identities and creates the first pair of ESP SAs. The key itself never crosses the wire.
03The attacker changes one byte of a captured ESP packet and sends it on. What happens at Gateway B?
ESP checks an integrity tag (here from AES-GCM) before it decrypts anything. Making a valid tag needs the key, which the attacker does not have.
04Why is a recorded packet sent again later (a replay) also dropped?
Every ESP packet carries a sequence number covered by the tag. The receiver remembers which numbers it has accepted (a window of 64 is the preferred size) and drops duplicates.
05When would transport mode be used instead of tunnel mode?
Transport mode protects only what follows the IP header. It suits host-to-host IPsec; gateways protecting networks use tunnel mode so the inner addresses are hidden too.
Glossary
- VPN
- Virtual private network: an encrypted tunnel across an untrusted network that makes distant networks or devices behave as if they were connected directly.
- IPsec
- A family of standards (RFC 4301) that protects IP packets themselves: IKE for keys and ESP for encryption and integrity.
- IKEv2
- Internet Key Exchange version 2 (RFC 7296): the handshake on UDP port 500 that agrees keys, checks identities and creates SAs.
- ESP
- Encapsulating Security Payload (RFC 4303, IP protocol 50): the wrapper that encrypts a packet and adds an integrity tag and sequence number.
- Security association (SA)
- One direction's set of keys, algorithms and counters. A tunnel needs a pair, one each way.
- SPI
- Security Parameter Index: the 32-bit number in each ESP packet that tells the receiver which SA, and so which keys, to use.
- Tunnel mode
- ESP wraps the whole original packet and adds a new outer IP header between the two gateways.
- Transport mode
- ESP protects only what follows the original IP header, which stays visible; used between two hosts.
Notes and sources
- 198.51.100.10, 203.0.113.20 and 192.0.2.50 are RFC 5737 documentation addresses; 192.168.1.0/24 and 192.168.2.0/24 are RFC 1918 private networks. SPI values are illustrative.
- Tunnel mode with AES-GCM adds 54–57 bytes to every packet: a 20-byte outer header, 8 bytes of SPI and sequence number, an 8-byte IV, 0–3 bytes of padding, 2 trailer bytes and a 16-byte tag.
- If a gateway or laptop is behind NAT, IKEv2 notices and moves to UDP port 4500, carrying ESP inside UDP so the NAT can track it (RFC 3948).
- SAs have lifetimes. Before one runs out, IKEv2 makes a fresh pair with CREATE_CHILD_SA, so no key is used for too long.
- IPsec also defines AH (protocol 51), which checks integrity but does not encrypt; VPNs use ESP.
- WireGuard, the next lesson, builds the same kind of tunnel with fewer choices and a fixed set of modern algorithms.
- RFC 4301: Security Architecture for the Internet Protocol
- RFC 7296: Internet Key Exchange Protocol Version 2 (IKEv2)
- RFC 4303: IP Encapsulating Security Payload (ESP)
- RFC 4106: AES-GCM in IPsec ESP
- RFC 3948: UDP Encapsulation of IPsec ESP Packets
- RFC 8221: Cryptographic Algorithm Implementation Requirements for ESP and AH
Quiz Unlocks after the last step.