Two shops, one till system
A bakery has two shops in two towns. The tills in both shops must reach one stock list.
Between the shops is the internet. Anybody who runs a link on the way could read what crosses it.
The bakery wants a private road across a public place. That road is a VPN.
By the end of this lesson
Note
I can explain what a VPN protects.
Key words
| Word | What it means |
|---|---|
| Encryption | scrambling data so only someone with the key can read it |
| Key | the secret value that locks or unlocks the data |
| Private key | the half of a key pair that is never shared |
| Public key | the half of a key pair you can give to anybody |
| Tunnel | packets carried inside other packets between two points |
| VPN | a virtual private network: a tunnel with encryption |
The cells students fill in are left blank in this preview.
Two networks with the internet between
The lab has two sites. Site A is 10.1.0.0/24 and site B is 10.2.0.0/24. Their gateways meet on an internet link, 203.0.113.0/24.
Both sites use private addresses. So no router on the internet link knows the way to the other site.
Meet the four machines
wglab statusShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Ping site B from site A
sudo ip netns exec a1 ping -c 2 -W 1 10.2.0.2Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Read gateway A's routing table
sudo ip netns exec gwA ip routeShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Gateway A has no way through
The ping prints From 10.1.0.1 ... Destination Net Unreachable twice. 10.1.0.1 is gateway A.
Its table has two lines: its own site, 10.1.0.0/24, and the internet link, 203.0.113.0/24. There is no line for 10.2.0.0/24 and no default route.
Encryption needs a key
Encryption turns readable data into a jumble. Only someone with the right key can turn it back.
An old example is the Caesar cipher: move every letter three places on. A key of 3 turns CAT into FDW.
Modern encryption uses huge keys and clever maths. Guessing the key would take longer than a lifetime.
Worked example: a Caesar shift of 3
| Plain letter | Count on 3 | Secret letter |
|---|---|---|
| C | D, E, F | F |
| A | B, C, D | D |
| T | U, V, W | W |
| Y | Z, A, B | B |
The cells students fill in are left blank in this preview.
Each gateway has a key pair
WireGuard gives each gateway two keys. The private key stays secret on that gateway. The public key is made from it and handed to the other side.
Each gateway knows the other's public key. That is how each one checks it is talking to the right partner.
Make a throwaway private key
wg genkeyShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
See who may read the key folder
sudo ip netns exec gwA ls -ld /etc/wireguardShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A key is a secret file
The first Run prints one line of 44 letters, numbers and signs, ending in =. Yours is different from everybody else's. It was not saved, so it is gone.
The folder line starts drwx------ and names root twice. Only root may open it, which is right for secret keys.
What the tunnel hides and what it shows
With a tunnel up, gateway A wraps each packet for site B. It encrypts it and sends it inside a new packet to gateway B.
On the internet link, a watcher sees only the two gateways' addresses and scrambled data. The inside addresses and the content are hidden.
A VPN does not hide that the two gateways are talking. It does not clean a virus off a till either.
A common mistake
Warning
Many people think a VPN makes you invisible. It only protects traffic inside the tunnel. The two ends can still be seen, and the devices at each end can still be attacked.
Going further: crack a Caesar message
Somebody sends you WKH WLOO LV RSHQ and does not say the shift.
Write a loop that calls your uncaesar with every shift from 1 to 25 and prints each answer. Which line is English? Why does this show the Caesar cipher is weak?