VPNs: IPsec and WireGuard
Linking networks and remote workers through an encrypted tunnel: site to site or remote access, IPsec or WireGuard, split tunnelling, and the classic failures (NAT, MTU, routes).
- 38 cards
- 3 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- The principle
- IPsec
- WireGuard
A few cards from the deck
What is a VPN?
Show the answer
An encrypted tunnel that carries a machine's or a network's traffic across the Internet as if it were on a private network.
The Internet only sees encrypted packets between the tunnel's two ends.
Linking the office network to a private cloud network permanently?
- Opening the cloud's ports to the Internet
- An SSH tunnel per computer
- A site-to-site VPN between the two gateways
- A VPN client on every office computer
Show the answer
A site-to-site VPN between the two gateways
The gateways encrypt for the whole network; computers install nothing.
VPN or “zero trust” access app by app?
Show the answer
A VPN opens access to a whole network, which eases an attacker's lateral movement; zero trust checks every access, by application and identity.
A VPN trusts network position; zero trust only trusts identity and device state.
Bringing up a WireGuard tunnel: after “Handshake initiation (public key, timestamp)”, what is the next message?
- Decrypted packet delivered to 10.0.0.5
- Internal server's response
- Handshake response
- Encrypted packet to 10.0.0.5, over UDP
Show the answer
Handshake response
Both sides derive the session keys. → Session keys established