6

Chapter 3: Planning Your Virtual Private Network (VPN)

Why do I need a VPN?

Wireless-G VPN Broadband Router

Chapter 3: Planning Your Virtual Private Network (VPN)

Why do I need a VPN?

Computer networking provides a flexibility not available when using an archaic, paper-based system. With this

flexibility, however, comes an increased risk in security. This is why firewalls were first introduced. Firewalls help

to protect data inside of a local network. But what do you do once information is sent outside of your local

network, when e-mails are sent to their destination, or when you have to connect to your company's network

when you are out on the road? How is your data protected?

That is when a VPN can help. VPNs are called Virtual Private Networks because they secure data moving outside

of your network as if it were still within that network.

When data is sent out across the Internet from your computer, it is always open to attacks. You may already have

a firewall, which will help protect data moving around or held within your network from being corrupted or

intercepted by entities outside of your network, but once data moves outside of your network—when you send

data to someone via e-mail or communicate with an individual over the Internet—the firewall will no longer

protect that data.

At this point, your data becomes open to hackers using a variety of methods to steal not only the data you are

transmitting but also your network login and security data. Some of the most common methods are as follows:

1) MAC Address Spoofing

Packets transmitted over a network, either your local network or the Internet, are preceded by a packet header.

These packet headers contain both the source and destination information for that packet to transmit efficiently.

A hacker can use this information to spoof (or fake) a MAC address allowed on the network. With this spoofed

MAC address, the hacker can also intercept information meant for another user.

2) Data Sniffing

Data “sniffing” is a method used by hackers to obtain network data as it travels through unsecured networks,

such as the Internet. Tools for just this kind of activity, such as protocol analyzers and network diagnostic tools,

are often built into operating systems and allow the data to be viewed in clear text.

3) Man in the middle attacks

Once the hacker has either sniffed or spoofed enough information, he can now perform a “man in the middle”

attack. This attack is performed, when data is being transmitted from one network to another, by rerouting the

packet

: a unit of data sent over a network

vpn

(virtual private network): a security

measure to protect data as it leaves one

network and goes to another over the Internet

7

Chapter 3: Planning Your Virtual Private Network (VPN)

What is a VPN?

Wireless-G VPN Broadband Router

data to a new destination. Even though the data is not received by its intended recipient, it appears that way to

the person sending the data.

These are only a few of the methods hackers use and they are always developing more. Without the security of

your VPN, your data is constantly open to such attacks as it travels over the Internet. Data travelling over the

Internet will often pass through many different servers around the world before reaching its final destination.

That's a long way to go for unsecured data and this is when a VPN serves its purpose.

What is a VPN?

A VPN, or Virtual Private Network, is a connection between two endpoints—a VPN Router, for instance—in

different networks that allows private data to be sent securely over a shared or public network, such as the

Internet. This establishes a private network that can send data securely between these two locations or

networks.

This is done by creating a “tunnel”. A VPN tunnel connects the two PCs or networks and allows data to be

transmitted over the Internet as if it were still within those networks. Not a literal tunnel, it is a connection

secured by encrypting the data sent between the two networks.

VPN was created as a cost-effective alternative to using a private, dedicated, leased line for a private network.

Using industry standard encryption and authentication techniques—IPSec, short for IP Security—the VPN creates

a secure connection that, in effect, operates as if you were directly connected to your local network. Virtual

Private Networking can be used to create secure networks linking a central office with branch offices,

telecommuters, and/or professionals on the road (travelers can connect to a VPN Router using any computer with

the Linksys VPN client software.)

There are two basic ways to create a VPN connection:

•

VPN Router to VPN Router

•

Computer (using the Linksys VPN client software) to VPN Router

The VPN Router creates a “tunnel” or channel between two endpoints, so that data transmissions between them

are secure. A computer with the Linksys VPN client software can be one of the two endpoints (refer to “Appendix

C: Using the Linksys QuickVPN Software for Windows 2000 or XP”). If you choose not to run the VPN client

software, any computer with the built-in IPSec Security Manager (Microsoft 2000 and XP) allows the VPN Router

to create a VPN tunnel using IPSec (refer to “Appendix D: Configuring IPSec between a Windows 2000 or XP PC

encryption

: encoding data transmitted in a network

ip

(internet protocol): a protocol used to send data

over a network

software

: instructions for the computer

IMPORTANT:

You must have at least one VPN Router on one end of the VPN

tunnel. At the other end of the VPN tunnel, you must have a second VPN

Router or a computer with the Linksys VPN client software.

8

Chapter 3: Planning Your Virtual Private Network (VPN)

What is a VPN?

Wireless-G VPN Broadband Router

and the Router”). Other versions of Microsoft operating systems require additional, third-party VPN client

software applications that support IPSec to be installed.

VPN Router to VPN Router

An example of a VPN Router-to-VPN Router VPN would be as follows. At home, a telecommuter uses his VPN

Router for his always-on Internet connection. His router is configured with his office's VPN settings. When he

connects to his office's router, the two routers create a VPN tunnel, encrypting and decrypting data. As VPNs

utilize the Internet, distance is not a factor. Using the VPN, the telecommuter now has a secure connection to the

central office's network, as if he were physically connected. For more information, refer to “Appendix E:

Configuring VPN Tunnels.”

Computer (using the Linksys VPN client software) to VPN Router

The following is an example of a computer-to-VPN Router VPN. In her hotel room, a traveling businesswoman

dials up her ISP. Her notebook computer has the Linksys VPN client software, which is configured with her office's

IP address. She accesses the Linksys VPN client software and connects to the VPN Router at the central office. As

VPNs utilize the Internet, distance is not a factor. Using the VPN, the businesswoman now has a secure

connection to the central office's network, as if she were physically connected.

For additional information and instructions about creating your own VPN, please visit Linksys’s website at

www.linksys.com. You can also refer to “Appendix C: Using the Linksys QuickVPN Software for Windows 2000 or

XP”, “Appendix D: Configuring IPSec between a Windows 2000 or XP PC and the Router,” and “Appendix E:

Configuring VPN Tunnels.”

Figure 3-1: VPN Router to VPN Router

Figure 3-2: Computer to VPN Router

9

Chapter 4: Getting to Know the Wireless-G VPN Broadband Router

The Back Panel

Wireless-G VPN Broadband Router

Chapter 4: Getting to Know the Wireless-G VPN Broadband

Router

The Back Panel

The Router’s ports, where a network cable is connected, are located on the back panel.

Internet

The

Internet

port connects to your cable or DSL modem.

LAN (1-4)

The

LAN

(Local Area Network) ports connect to your PCs and other network devices.

Reset Button

There are two ways to reset the Router's factory defaults. Either press the

Reset Button

, for

approximately five seconds, or restore the defaults from the Administration tab - Factory

Defaults in the Router's Web-based Utility.

Power

The

Power

port is where you will connect the power adapter.

IMPORTANT:

If you reset the Router, all of

your settings, including Internet connection,

wireless, and security, will be deleted and

replaced with the factory defaults. Do not

reset the Router if you want to retain these

settings.

Figure 4-1: Back Panel

10

Chapter 4: Getting to Know the Wireless-G VPN Broadband Router

The Front Panel

Wireless-G VPN Broadband Router

The Front Panel

The Router's LEDs, where information about network activity is displayed, are located on the front panel.

Power

Green. The

Power

LED lights up when the Router is powered on.

DMZ

Red. The

DMZ

LED lights up when the Router has an available DMZ port. If the LED is flashing,

the Router is sending or receiving data over the DMZ port.

Internet

Green. The

Internet

LED lights up when the Router is connected to your cable or DSL modem.

If the LED is flashing, the Router is sending or receiving data over the Internet port.

Wireless-G

Green. The

Wireless-G

LED lights whenever there is a successful wireless connection. If the

LED is flashing, the Router is actively sending or receiving data over the wireless network.

LAN (1-4)

Green. The

LAN

LED serves two purposes. If the LED is solidly lit, the Router is connected to a

device through the corresponding port (LAN 1, 2, or 3). If the LED is flashing, the Router is

sending or receiving data over that port.

Figure 4-2: Front Panel