The modular structure of OpenVPN can not only be found in its security model, but also in the networking scheme. James Yonan chose the Universal TUN/TAP driver for the networking layer of OpenVPN.
The TUN/TAP driver is an open source project that is included in all modern Linux/Unix distributions, as well as Windows, Solaris, and Mac OS X. Like SSL/TLS, it is used in many projects, and therefore it is steadily being improved, and new features are being added. Using the TUN/TAP devices takes away a lot of complexity from the structure of OpenVPN. Its simple structure brings increased security when compared to other VPN solutions. Complexity is always the main enemy of security. For example, IPsec has a complex structure with complex modifications in the kernel and the IP stack, thereby creating many possible security loopholes.
The Universal TUN/TAP driver was developed to provide Linux kernel support for tunneling IP traffic. It is a virtual network interface, which appears as authentic to all applications and users. Only the name tunX or tapX distinguishes it from other devices. Every application that is capable of using a network interface can use the tunnel interface. Every technology that you are running in your network can be run on a TUN or TAP interface too.
This driver is one of the main factors that makes OpenVPN very easy to understand, easy to configure, and at the same time, very secure.
The following figure depicts OpenVPN using standard interfaces:
A TUN device can be used like a virtual point-to-point interface, like a modem or DSL link. This is called routed mode because routes are set up to the VPN partner.
However, a TAP device can be used like a virtual Ethernet adapter. This enables the daemon listening on the interface to capture Ethernet frames, which is not possible with TUN devices. This mode is called bridging mode because the networks are connected as if over a hardware bridge. Applications can read/write to this interface. Software (the tunnel driver) will take all the data and use the cryptographic libraries of SSL/TLS to encrypt them. The data is packaged and sent to the other end of the tunnel. This packaging is done with standardized UDP or optional TCP packets. UDP should be the first choice, but TCP can be helpful in some cases. You are almost completely free to choose the configuration parameters such as protocol or port numbers, as long as both tunnel ends agree on the same figures.
OpenVPN listens on TUN/TAP devices, takes the traffic, encrypts it, and sends it to the other VPN partner, where another OpenVPN process receives the data, decrypts it, and hands it over to the virtual network device, where the application might already be waiting for the data.
As far as I know, there are only few other VPN software applications that enable VPN partners to transmit. This concept offers the following exciting possibilities:
- Broadcasts are needed for browsing Windows networks or for LAN games
- Non-IP packets like IPX be used and almost anything is possible in your LAN that is sent over the VPN to the other side
As OpenVPN uses standard network packets, NAT is no problem either. A host in the local net in Sydney with a local IP can start a tunnel to another host in the local net in London, if it is also equipped with a local IP.
But there’s more. As the network interface is a standardized Linux network interface (either TUN or TAP), anything possible on an Ethernet NIC can also be done on VPN tunnels. Consider the following:
- Firewalls can restrict and control traffic
- Traffic shaping is not only possible, but it is also a feature incorporated in OpenVPN
Also, if you want to use DSL lines with frequent reconnects and dynamically assigned IPs, OpenVPN will be your first choice. The reconnect is much faster than that of any other VPN software that we have tested. A Windows terminal server or SSH session does not terminate when one of the VPN partners changes its IP. The session just freezes for a few seconds and then you can continue. Can your VPN accomplish that?
OpenVPN and firewalls
OpenVPN works perfectly with firewalls. There are a few VPN solutions that can claim to have similar firewall support, but none can offer the same level of security.
What is a firewall? There is a famous and simple definition. A firewall is a router that does not route. If you consider this to be not very helpful, then here is a more refined definition:
A firewall is a router that routes only selected Internet data. Firewall rules define how to handle specific data and traffic.
Firewalls can be devices or software on PCs, servers, or on other devices. A firewall takes care of the data that has been received and has a closer look at it. Modern firewalls are so-called packet filtering, stateful inspection firewalls. Depending on the OSI layer it is operating in, the firewall can pass decisions based on the data that is found in the headers of the packets or application data. Packet filtering firewalls usually operate by reading the IP data header. Stateful inspection is a mechanism to remember the connection states. In this way, internal networks can be protected from external networks. While Internet connections initiated from the inside can be allowed, all unwanted unauthorized connections from the outside can be rejected. At the same time, incoming data requested by a member of the local net is passed through (because the firewall remembers the state of the request).
Under Linux, most firewalls are based on the program iptables. This is a user-space interface to the Linux kernel’s netfilter firewall functionality, and offers everything that modern firewalls should. Probably the best way to protect your LAN is by writing a set of iptables rules with a shell script. However, the usability of such a script is not perfect. Most administrators want a Graphical User Interface (GUI) for firewall control and all the hardware firewalls offer this. Enterprise Distributions, such as RHEL or SLES come with sophisticated firewall tools, but there are also several open source projects. Outstanding tools for this purpose and Linux (iptables) firewalls are as follows:
- The Shorewall (Shoreline Firewall) project that integrates into the Webmin suite—a web-based frontend to administer Linux systems from a browser. People from the Shorewall project, namely, Simon Matter and Tom Eastep, have written a very useful guideline for the integration of OpenVPN tunnels into Shorewall and more at http://www.shorewall.net/OPENVPN.html.
- IPCop (http://www.ipcop.org) is a promising standalone, easy-to-configure Linux firewall system that is also equipped with a professional GUI. It has had great success in third-world projects like Linux4africa (http://www.linux4africa.de) and in other medium-size professional setups. Standardized installation, simple structures, and modular add-ons make this a fast-growing project, and with the help of OpenVPN, the IPCop firewall becomes a true VPN server.
- Tools like Fwbuilder (http://www.fwbuilder.org) help you build, manage, and distribute your iptables scripts on your own. Fwbuilder does even more. It can work independently from your platform and is able to translate Linux rules into Cisco, BSD, or other firewall languages. This is really worth a look.