How does a VPN client work under the hood? - networking

I'm wondering how L2TP works internally to provide transparent IP connectivity.
I understand that L2TP tunnels IP packets via UDP port 1721. However I don't see how this provides transparent access. For example let's say I have a VPN connection and my browser connects to google.com. It would normally make a TCP connection to google's IP address over port 80. However something has to intercept this request and route it through L2TP's mechanism.

In the Security Now podcast they did a 4 part series VPNs is great detail. The best part is that there are transcripts online so you don't have to listen to the whole thing if you know what to search for. here's a link to the main page http://www.grc.com/vpn/vpn.htm

Related

How do I implement a captive portal with STM32 microcontroller?

I am using my device as an Access Point and I need to display a deafault web page once somebody is connected.
Right now I have to connect to a specific IP (socket parameters: IP 192.168.0.1 , PORT 80) to show the page.
The page doesn't need to open automatically, it just has to show up no matter what URL gets inserted in the browser.
I've read the RFC7710 but I'm not able to implement "low level" solutions such as modify the option 160 of the DHCP.
The best thing for me would be to work at the HTTP level.
Any ideas?
HTTP works on the top of the TCP/IP infrastructure, it requires an established TCP connection first. As long as there is no TCP connection from the client to the HTTP server, the server has no way to tell, force, or trick a client to connect to its IP address and TCP port. No connection, no HTTP.

How browser access internet when ports are blocked

I was having a doubt on how browser gets the data from website. I read these two links:
how can an application use port 80/HTTP without conflicting with browsers?
and
Port 80 blocked on my ISP so how my browser still works?
With this I understand that browser opens a local random source port and connect to port 80 of website. Now our system firewall have opened all outbound connection and blocked all incoming connection as default configuration. So how does it get back the response. Similarly how response comes back when our home routers and ISP have ports blocked.
So now, I am assuming that connection is somewhat different from response. And there must be some sort of header/information that is sent along which helps in recognizing it as response? And this helps in bypassing the ports?
My humble apologies in case I am messing up all terminologies and thanks for patience. I am beginner in this stuff. Any link towards guide will be very useful.
So how does it get back the response
Assuming you're talking about a firewall or NAT, these devices track outgoing connections, and allow replies to pass through. Connections are typically identified using Source IP + Destination IP + Source Port + Destination Port + Protocol (TCP/UDP). These connection identifiers are stored in a table in the NAT/Firewall.

Possible to hide TCP ip for clients?

this is my first post so...
I'm quite new to networking, I just started transferring data over TCP and everything is working fine. I am hosting a small chat server (Made in Autoit v3) on my own network, but what bothers me is that all the clients could simply track the ip on which the server is hosted...
As I don't want to be 'hacked' I would like to know if there is a way to hide the ip on which the server is hosted. Maybe routing it through another network if that is possible.. As I said I have pretty much 0 experience with networking, I can port forward and setup a simple server but that is pretty much it :)
Thanks everyone!
When you are opening up any service to the world, you should secure via IPsec or TLS/SSL like services, further more you should open only those ports on the IP which is required by that service.
example: a.b.c.d:8080 for HTTP so instead have it on HTTPS(port 443) that means a.b.c.d:443. HTTPS requires TLS/SSL certificate and you can get them from here.
For your service TLS/SSL should suffice the needs because it works over transport layer.

When is port forwarding necessary?

I've been investigating networking for use in a two-player game I'm writing, and I'm still not clear on when a device must have a port forwarded in order to communicate with the outside world.
From what I've seen in other games, port forwarding is always required in order to host a server, but is not required on the client. In addition, there are other situations, such as skype (which, to my understanding is ultimately client to client), where neither end must forward a port.
So my question is, in over-the-Internet communication, when is and isn't port forwarding necessary, and what steps can i take as a developer to make it so my users don't have to worry about it? Thanks in advance!
Port forwarding is needed when a machine on the Internet needs to initiate a connection to a machine that's behind a firewall or NAT router. If the connection is initiated by the machine behind the firewall, the firewall/router automatically recognizes the reply traffic and sends it to the machine that opened the connection.
But if a packet arrives on the external interface, and it's not a part of such a connection, the router needs to know what to do with it. By default, it will reject it. But if forwarding is configured for the port, that tells it what internal machine to send it to.
Put another way: you need port forwarding if you want to run a server behind the NAT firewall/router, you don't need it if you're just running a client.
There is reason why Skype don't (not always) need manual setting of port forwarding:
When you install Skype, a port above 1024 is chosen at random as the
port for incoming connections. You can configure Skype to use a
different port for incoming connections if you wish, but if you do,
you must open the alternative port manually.
If the port chosen for incoming connections becomes unavailable, by
default ports 80 and 443 will be used as alternatives. If another
application (such as Apache HTTP server or IIS) uses these ports, you
can either configure the application to use other ports, or you can
configure Skype to not use these ports.
Port forwarding is must if you host a server.
You can use same technique as Skype...
I am not sure if there is any other option...
Port forwarding (occurs) when a NAT, firewall or some other device blocks communication on all or some ports.
To answer your question as an example, most commercial routers use NAT to allow multiple people to use the same IP(As view from the outside world) provided by ISPs. Most ISP's use NAT to allow multiple customers to use the same IP(As viewed from the outside world). To get this to work, the NAT changes the internal IP and the port number of a communication to THE(there is only one for the entire sub network) external IP and a new port number. By doing this, the router/isp/ect can tell which internal IP and port each external communication goes to.
Anytime one of the computers communicating over the internet are behind a NAT, port forwarding is required. I'm sure there are way more situations than this, and the solution to each can be quite complicated. But this covers the vast majority.

Port Forwarding For Online Games/Other Services?

I've noticed recently that I don't have to forward ports for mmorpg's that I play.
I'm thinking about working on a game that people can play online and had a question.
Why is this the case given its a two way socket connection that is constantly sending data back and forth? Doesn't their server need to get through my firewall in order to connect to me?
TCP crash lesson: TCP is a two-way protocol. The challenge is that at least one host needs to initiate. Since within an MMORPG, your own computer is never acting as a server, nobody has to connect to it. All the information about game state is passed through the company's public facing servers that have public facing IP addresses (and hey, maybe they actually use port forwarding there, just to confuse my explanation... but you never have to see their pretty network internals, proxies, and other wizardry.).
Anyway, when you connect to Stackoverflow, you're making one outbound connection that requests data from the server, and then over that same connection you're receiving it back. Same exact scenario, only with a webserver instead of a game.
UPnP allows you to tackle many routers. There's also NAT Punch-Through if you have access to a third party that isn't behind a router.
Either way, port forwarding is only necessary if you wish to act as a server (or the sender in a P2P relationship). A client does not need to forward ports.
You don't need to forward ports to access the web either, despite data coming in as well.
When you make an outgoing TCP connection, your NAT router puts the connection in a table, so that when data comes in, it knows what machine in your LAN to send the packet to.
Everyone mentions TCP, but NAT works for UDP as well: The first outgoing UDP packet associates that source port with the internal IP address, and your NAT device will forward incoming traffic to that port to the correct host on the internal network.
In other words, if your computer requests the connection (outbound) first, the router opens up the port automatically, on the assumption that you're going to want data back. But if you want remote users to connect to your computer without your computer requesting it, the router would normally drop the packets since it wouldn't know where to send them (they were unsolicited). So instead, you need to tell the router to deliver any unsolicited packets at port N to your computer.
Sorry to add another answer so late, and I know one was already accepted, but I personally found the other answers to be more confusing than this simple explanation.

Resources