Stop 02 · Networking Fundamentals for SecurityTopics · 6/10

VPNs

In short

VPNs let remote staff reach office systems safely over home Wi-Fi. They also show up in attacks, so you need to understand both what they protect and what they don't.

Creating secure, encrypted connections over a public network — used both defensively (secure remote access) and, in some cases, by attackers to obscure their origin.

The blob rides a cart through a clear tunnel under a crowded street.

Think of it like this

A private tunnel under a busy road

The road above is crowded and anyone can see who walks where. A private tunnel underneath takes you straight from your house to the office gate, unseen. A VPN builds that tunnel through the public internet using encryption.

Watch it happen

Reaching the office from a café

Your laptop

Café Wi-Fi

VPN gateway

Intranet app

auth + MFA

1/5Your VPN client logs in to the company's VPN gateway, ideally with MFA.

The big ideas

What you need to know

Encrypts the path

A VPN protects data between you and the gateway. After that, it travels like normal traffic.

VPN accounts are prime targets

One stolen VPN password can put an attacker inside the network. Always require MFA.

Patch the gateway fast

VPN appliances face the internet. Known bugs in them get exploited quickly, so patch them first.

Not full anonymity

A consumer VPN hides your traffic from the café, but the VPN provider can still see where you go.

See it in code

Walk through the code

bash

1# WireGuard on Linux: bring a tunnel up and check it2sudo wg-quick up wg03sudo wg show4 5# Confirm traffic now leaves from the VPN's address6curl -s https://ifconfig.me

1/2wg-quick reads /etc/wireguard/wg0.conf and starts the tunnel. wg show lists peers and the last handshake time.

In your own lab, compare the public IP before and after the tunnel comes up. A different address means traffic now exits through the VPN server.

Save yourself the pain

Common mistakes

Oops

Thinking anyone on the VPN can be fully trusted.

Do this instead

A VPN proves you reached the network, not that the device is safe. Combine it with MFA and device checks.

Oops

Using random free VPN apps for privacy.

Do this instead

Some free VPNs log or sell your data. If privacy matters, research the provider carefully.

Your mission

Build a tiny VPN in your lab

~45 min

Quick check

An employee's VPN password is phished, but the attacker still can't connect. Which control most likely stopped them?

Go deeper

1Learn the basic concept of how a VPN tunnels and encrypts traffic.
2Understand the difference between site-to-site VPNs and remote-access VPNs.
3Research why VPN misconfiguration is a common real-world attack surface.