To understand a particular protocol stack imposed by tunneling, network engineers must understand both the payload and delivery protocol sets. IPsec has an end-to-end Transport Mode, but can also operate in a tunneling mode through a trusted security gateway. SSH uses port 22 to enable data encryption of payloads being transmitted over a public network (such as the Internet) connection, thereby providing VPN functionality. A tunnel is not encrypted by default: the TCP/IP protocol chosen determines the level of security. The Layer 2 Tunneling Protocol (L2TP) allows the transmission of frames between two nodes. It is also possible to establish a connection using the data link layer. In this case, the delivery and payload protocols are the same, but the payload addresses are incompatible with those of the delivery network. Technical overview Īs an example of network layer over network layer, Generic Routing Encapsulation (GRE), a protocol running over IP ( IP protocol number 47), often serves to carry IP packets, with RFC 1918 private addresses, over the Internet using delivery packets with public IP addresses. Other tunneling methods able to bypass network firewalls make use of different protocols such as DNS, MQTT, SMS. The proxy allows connections only to specific ports, such as 443 for HTTPS. Because this creates a security hole, CONNECT-capable HTTP proxies commonly restrict access to the CONNECT method. The proxy then makes a TCP connection to a particular server:port, and relays data between that server:port and the client connection. A client issues the HTTP CONNECT command to an HTTP proxy. If the firewall policy does not specifically exclude this kind of "wrapping", this trick can function to get around the intended firewall policy (or any set of interlocked firewall policies).Īnother HTTP-based tunneling method uses the HTTP CONNECT method/command.
Users can also use tunneling to "sneak through" a firewall, using a protocol that the firewall would normally block, but "wrapped" inside a protocol that the firewall does not block, such as HTTP. Typically, the delivery protocol operates at an equal or higher level in the layered model than the payload protocol.Ī tunneling protocol may, for example, allow a foreign protocol to run over a network that does not support that particular protocol, such as running IPv6 over IPv4.Īnother important use is to provide services that are impractical or unsafe to be offered using only the underlying network services, such as providing a corporate network address to a remote user whose physical network address is not part of the corporate network.
Tunneling uses a layered protocol model such as those of the OSI or TCP/IP protocol suite, but usually violates the layering when using the payload to carry a service not normally provided by the network. The tunneling protocol works by using the data portion of a packet (the payload) to carry the packets that actually provide the service. It involves allowing private network communications to be sent across a public network (such as the Internet) through a process called encapsulation.īecause tunneling involves repackaging the traffic data into a different form, perhaps with encryption as standard, it can hide the nature of the traffic that is run through a tunnel. In computer networks, a tunneling protocol is a communication protocol which allows for the movement of data from one network to another.
0 kommentar(er)
