Virtual Private Networks虛擬私人網路

VPN is a technology that secures communication across an untrusted network. According to RFC 2828, a VPN is "a restricted-use, logical (for example, artificial or simulated) computer network that is constructed from the system resources of a relatively public, physical (for example, real) network (such as the internet), often by using encryption (located at hosts or gateways), and often by tunneling links of the virtual network across the real network".

VPN 是一種可跨越不受信任網路來確保通訊安全的技術。根據 RFC 2828，VPN 是「一種限制用途的邏輯（例如人為建構或模擬的）電腦網路，由相對公開的實體網路（例如網際網路）的系統資源所構成，通常會透過加密（位於主機或閘道）並在真實網路上建立虛擬網路的通道鏈路來實現」。

With the advent of VPNs, enterprises can support remote users by leveraging the internet. A mobile user simply needs access to the internet to communicate with the main office. For telecommuters, their internet connectivity is typically a broadband, DSL, or cable connection.

隨著 VPN 的出現，企業可藉由運用網際網路來支援遠端使用者。行動使用者只需要連上網際網路，即可與總公司通訊。對電傳工作者而言，其網際網路連線通常是寬頻、DSL 或纜線連線。

The word tunnelingis often used in networking. To explain its networking meaning, think of real-world tunnels. Usually, a tunnel construction involves building a tunnel pipe. If you put something into a pipe, you hide it from view—it is the pipe surface that remains visible, not what is inside it. You can put a pipe into another pipe, making the insides more difficult to see. On the other hand, by removing the pipes, you can get to the content. In networking, the tunnel effect is achieved by adding a new header to the packet, in front of the existing one, for example, by additional encapsulation. The newly added header becomes the first one "visible" and it is often called the outer header. Sometimes, the trailer is added also. The new header can be added at the source endpoint or can be added by a dedicated networking node. The tunneled packet is processed on its path throughout the network. The processing can consider only the outside header, which typically happens at devices that are not aware of tunneling actions. On the nodes that are aware of the applied tunneling, the processing can go further to expose the inner data of the packet.

通道（tunneling）一詞在網路領域中經常使用。要理解其在網路上的意義，可以想像現實世界中的隧道。通常建造隧道會涉及建置一條隧道管路。若您把某物放進管路中，就會將其隱藏起來，外界只看得到管路表面，看不到裡面的東西。您也可以把一條管路放進另一條管路中，讓內容物更難以被看見。反之，移除這些管路後，就能取得其中內容。在網路中，通道效應是透過在封包既有標頭之前加上新標頭來達成的，例如藉由額外的封裝。新加上的標頭成為第一個「可見」的標頭，通常稱為外層標頭；有時也會加上尾端。新標頭可以在來源端點加上，也可以由專用的網路節點加上。通道化封包在網路中傳輸的路徑上會持續被處理。這種處理可能僅考量外層標頭，這通常發生在不知道有通道處理動作的裝置上。而在知道所套用通道處理的節點上，處理則可進一步深入，揭露封包的內層資料。

As piping can be made more or less difficult to remove, so the tunneling can involve more or less processing to protect content. For instance, if you make your physical piping openable by using a key, only someone in possession of the key can get to the inside content easily. The same is true of VPN tunnels. They can employ cryptographic functions, in which case they are called cryptographic VPNs, or they can be constructed just by adding readily readable information.

正如管路可以做得或難或易於拆解，通道也可以涉及或多或少的處理來保護內容。舉例來說，若您讓實體管路必須用鑰匙才能開啟，那麼只有持有鑰匙的人才能輕易取得內部內容。VPN 通道也是同樣的道理。它們可以採用加密函式，此時稱為加密型 VPN（cryptographic VPN）；也可以僅透過加入可直接讀取的資訊來建構。

IPsec and SSL VPNs are both cryptography-based VPNs. VPNs can also be network-based. For example, a service provider can use a technology such as MPLS to segregate customer traffic as it crosses a shared infrastructure. The service provider is providing a network that is virtually private. While traffic physically crosses shared infrastructure, there is no mixing of traffic. One customer cannot see another customer’s traffic. This behavior is different from an IPsec VPN, which uses cryptographic technologies to transform packet data to provide privacy, data integrity, and origin authentication.

IPsec 與 SSL VPN 皆屬於基於加密技術的 VPN。VPN 也可以是網路型的。舉例來說，服務供應商可使用像 MPLS 這樣的技術，在流量跨越共享基礎架構時區隔客戶流量。此時服務供應商所提供的是一個實質上私有的網路。雖然流量在實體上跨越共享基礎架構，但不會發生流量混雜，一位客戶無法看到另一位客戶的流量。這與 IPsec VPN 不同，後者是使用加密技術轉換封包資料，以提供隱私性、資料完整性與來源驗證。

The figure illustrates a site-to-site VPN and a remote-access VPN. These two basic VPN deployment models typically use either IPsec or SSL technologies to secure the communications.

此圖說明站對站 VPN 與遠端存取 VPN。這兩種基本 VPN 部署模式通常會使用 IPsec 或 SSL 技術來確保通訊安全。