Finding your way in the VPN jungle can be a daunting task, what with the various terms thrown around. There's a plethora of information and endless discussions about which VPN provider is the best, what protocol is the best, which tunneling protocol is the best, which encryption to use — but what does it all mean? What is a tunneling protocol, and how does it affect you as a user? Without any context and understanding of what a tunneling protocol is — and without knowing what the difference between the various tunneling protocols are — you're left at the mercy of other people. Therefore, we would like to write a quick summary of the various protocols available so that you can make up your own mind.
What is a VPN?
The history of VPN tunnels dates back to 1996 when an employee at Microsoft invented PPTP (peer-to-peer tunneling protocol). This allowed people to have a secure Internet connection and work from home. Additionally, it gave companies a much more scalable, faster, and cheaper alternative over WAN to connect their geographically separated offices.
This milestone eventually lead to further improvements and alternatives to the PPTP protocol. Cisco — which was the company that pioneered the concept of using LAN to connect geographically separated computers — eventually developed L2F, a tunneling protocol specifically designed to tunnel PPTP traffic.
Both PPTP and L2F had flaws and in 1999, L2TP was released as a proposed standard. L2TP combines the best of L2F and PPTP to offer a much more secure and reliable tunneling protocol.
As demand for VPN tunnels grew for both businesses and private citizens, more and more alternatives popped up. Despite all of the advances in VPN protocols, and even though it's been almost 20 years since its original conception, PPTP is still one of the most commonly used protocols.
Today, VPN tunnels are used for all kinds of purposes. For companies, it is often still used as a cheap and reliable alternative to connect geographically distanced offices. For private citizens, it is often used for widely different purposes. In countries like Turkey, a VPN is often used to overcome government censorship. Journalists sometimes use it to communicate with their sources and circumvent oppressive governments. Some people use it when they travel to access web pages restricted to their home country, while others use it when on a public network to keep their communication safe from unauthorized third parties.
Whatever your reason to use a VPN may be, it is always good to know the pros and cons of various protocols.
“Even though we don't know which companies the NSA has compromised – or by what means – knowing that they could have compromised any of them is enough to make us mistrustful of all of them. This is going to make it hard for large companies like Google and Microsoft to get back the trust they lost. Even if they succeed in limiting government surveillance. Even if they succeed in improving their own internal security. The best they'll be able to say is: We have secured ourselves from the NSA, except for the parts that we either don't know about or can't talk about.” - Bruce Schneier, cryptographer, computer security professional, privacy specialist, and writer
What is a protocol?
A protocol is a set of rules and guidelines used in electronic communication. These rules and guidelines are then followed by both systems when they send and receive data to each other. This reduces the time required for data exchange and eliminates the need for the end-user to interfere at either end of the communication.
OpenVPN
OpenVPN is one of the most popular and well-received VPN implementations. It is an Open Source VPN solution with high stability and excellent security, published under the GNU General Public License (GPL)
OpenVPN uses various methods and protocols to keep your communications safe, such as OpenSSL, HMAC authentication and shared keys. It also supports a wide array of cryptographic algorithms, such as Blowfish, 3DES, and AES — which is often touted as the gold standard of cryptographic algorithms.
But perhaps the largest advantage of OpenVPN is that it is highly configurable. In fact, it can be run on any port and both UDP and TCP protocols — which makes it extremely difficult to block.
However, its configurability is also perhaps its greatest disadvantage, as setting up an OpenVPN server can be a very daunting task with disastrous results if done improperly.
Pros:
- Highly configurable
- Very secure
- Supports Perfect Forward Secrecy
- Can bypass firewalls
- Supports a wide range of cryptographic algorithms
- Open source and readily vetted
Cons:
- Requires third-party software to set up
- Can be hard to configure
PPTP
PPTP is based on authentication, encryption, and PPP negotiation. As a matter of fact, it only requires a username, password, and server address to establish a reliable connection. Support for PPTP is included in most modern devices, and because of its relative ease to set up, it is one of the most common protocols used for VPN companies. Due to its low level of encryption, it is also one of the fastest VPN protocols, which is why it has often remained a favorite amongst people who wish to circumvent geo-restricted content.
However, keep in mind that PPTP is almost 20 years old, and even Microsoft has gone out and recommended that people should steer away from PPTP. While some people may enjoy PPTP for its high performance and stability, it is a very unsafe protocol to use from a security standpoint, where encryption may be of importance.
If speed is your main concern, PPTP is the best protocol. Just keep in mind that your security and anonymity will be compromised when using PPTP.
Pros:
- Just about every platform supports it
- Very easy to set up and use
- One of the fastest VPN protocols
Cons:
- One of the least secure protocols
- Easily blocked by firewalls
- Does not support Perfect Forward Secrecy
L2TP/IPsec
L2TP is a tunneling protocol that does not inherently use any method of encryption. That is why it is normally encapsulated together with IPSec to provide some additional security. L2TP is an extension of the PPP protocol (like PPTP) and L2F. It is in many ways an improvement over PPTP and L2F. L2TP uses something called double encapsulation and is one of the reasons it first gained popularity over PPTP in security circuits. The first encapsulation establishes a PPP connection to a remote host, and the second encapsulation contains IPSec.
Due to its double encapsulation, it has reduced speed when compared to other protocols However, IPSec is much more adaptable than the encryption method of PPTP and does have support for AES-256 encryption algorithms, which are considered some of the most secure. How much your performance is reduced depends on the encryption method, and the stronger the encryption, the more your performance will be affected.
L2TP also have an often-overlooked advantage, and that is that L2TP prevents the data from being altered between sender and receiver, which prevents man-in-the-middle attacks. L2TP is also often natively supported by most modern devices, so it is just as easy to connect as PPTP.
The main downfall of L2TP is that it can only communicate over UDP, which makes it very easy to block. Overall, L2TP is what could be considered a jack of all trades, master of none, as it has neither the speed of PPTP nor the security of OpenVPN.
Pros:
- Considered secure by most
- Easy to set up
- Just about every platform supports it
- Supports multithreading for increased performance
Cons:
- John Gilmore has pointed out that IPSec may be deliberately weakened by the NSA
- Edward Snowden has pointed out that IPSec may be compromised by the NSA
- Can easily be blocked by firewalls
- Can be slower than OpenVPN due to the double encapsulation
SSTP
SSTP (Secure Socket Tunneling Protocol) is a VPN protocol developed by Microsoft and introduced in Windows Vista. It uses SSL v3, and thus offers similar advantages to OpenVPN, such as the ability to use TCP 443 in order to bypass most firewalls.
Pros:
- Supports Perfect Forward Secrecy
- Supports a wide range of cryptographic algorithms
- Completely integrated into Windows, and very easy to use
Cons:
- Has not been independently audited
- Although other systems do support it, it does not work as well as it does on Windows.
IKEv2/IPSec
IKEv2 (Internet Key Exchange version 2) is based on IPSec and is a joint development project by Microsoft and Cisco.
What makes IKEv2 stand out is its mobility. It is specifically developed for mobile users in mind, and because of its support for the MOBIKE (Mobility and Multihoming) protocol, it is extremely resilient to network changes. This is very beneficial in today's society where users are often traveling and want a constant Internet connection. IKEv2 allows a user to seamlessly switch from a WiFi network to a mobile network without dropping the VPN connection. Additionally, it is one of the few VPN protocols that the Blackberry supports.
Pros:
- Arguably the fastest VPN protocol
- Very stable and not prone to lost connections when switching network.
- Supports a wide range of cryptographic algorithms
- Easy to setup
- Supports Perfect Forward Secrecy
Cons:
- Not supported by many platforms
- Based on IPSec (see IPSec cons)
- Can be blocked by firewalls
Summary
OpenVPN is often considered a bit slower than most other protocols (although this does depend on the encryption used), but once ChaCha20 and Poly1305 are introduced, this may no longer be the case. As a matter of fact, ChaCha20 + Poly1305 may be as much as 300% faster than the AES-256-GCM with HMAC-SHA-1 authentication that we at OVPN currently use. This offers a substantial advantage in performance for devices that may be limited by their processor, such as commercial routers, while sacrificing little if any security.
All in all, IKEv2 and OpenVPN stands above the rest as the best and most secure VPN protocols. While the other protocols may have better speed than OpenVPN, OpenVPN is highly adaptable and open source, which means that while it may not be the fastest at the moment, the implementation of ChaCha20+Poly1305 shows that OpenVPN is a protocol that is still in its infancy and may very well become faster than the rest once it is developed further.
While IKEv2 and SSTP are very good alternatives to OpenVPN, we here at OVPN have chosen to not support them. The reason for this is that we believe in security. OpenVPN has time and time again proven to be extremely robust in independently performed audits. IPSec — while in theory very secure — have had some suspicion thrown at it from both John Gilmore (security expert and founder of Electronic Frontier Foundation and Edward Snowden (former CIA Employee). While SSTP has not had any such suspicion thrown at it, it has also never been independently audited. We here at OVPN take your security and integrity serious, and prefer to play it safe using only the best and tested methods.