Overlay and Virtual Private Networks Security Performances Analysis with Open Source Infrastructure Deployment

Last-generation IT systems can span vast geographical regions, necessitating secure and dependable infrastructures that ensure cost-effectiveness regarding space and time. Virtual Private Networks (VPNs) and Overlay Networks (ONs) emerge as highly dependable technologies catering to these requirements, seamlessly traversing both traditional Public Switched Telephone Networks (PSTN) and cutting-edge 4G/5G architectures [1,2,3]. Just for the sake of clarity, we recall that a VPN is based on a technology that establishes an encrypted secure connection over a public network (typically the Internet), enabling users to transmit data securely. VPNs are often utilized to maintain privacy and security during internet browsing, particularly on public Wi-Fi networks, and to circumvent geographic restrictions by hiding the user’s IP address and location. An ON, on the other hand, is essentially a virtual network constructed atop an already established physical network infrastructure. Typically, it entails establishing extra logical connections, protocols, or network segments to facilitate particular functions or services, all without necessitating alterations to the foundational network structure. These overlay networks find widespread application in implementing functionalities like Content Delivery Networks (CDNs) and Peer-to-Peer (P2P) networks. They offer adaptability and scalability, enabling the smooth deployment of new services or enhancing existing ones while leaving the underlying network undisturbed. It is important to emphasize that the main differences between an overlay network and a VPN concern their approach to security, architecture, and managing data flow over a public network. In particular:

From the sentences above, it is clear that both ONs and VPNs offer solutions for creating private and secure networks over public network infrastructures. Still, their approaches to security, architecture, and data flow management differ. The choice between the two depends on the specific requirements of the network environment and applications.

This work’s main aim is to offer a deep performance comparison (from different points of view) between VPNs and ONs. The scenario in which we operate relates to the analysis of a network’s performance (RTT and bandwidth), since the type of overlay network used for interconnecting traffic between two VMware Virtual Machines varies (in the future, hardware-constrained devices such as Raspberry Pi 4/5 will be used). The networks connect KVM (Kernel-based Virtual Machine) machines instead of Docker/LXC/Podman containers. We only use two network namespaces directly in the MACsec case. The former resides on the first physical endpoint, while the latter resides on the other. The first guest (virtual machine) resides on the first physical host, and naturally, the second guest resides on the same physical host. The host machine has the following specifications: 12th Gen Intel(R) Core(TM) i7-1280P 2.00 GHz processor family, RAM 32GB LPDDR5-SDRAM, 4800 MHz, and 1 TB SSD (ASUSTeK Computer Inc. Taipei, Taiwan). One of the main results we want to achieve with this work is to group the tunnels according to the Achievable RTT, therefore having a wide variety of choices that respect a certain RTT distribution. We will also demonstrate the behavior of UDP compared to TCP, due to channel saturation. In this work, different ON tunnels are considered: GRE, GREtap, FOU, and GUE, IPIP, GENEVE, VXLAN, and MACVLAN. Also, different IPsec approaches are considered: IKEv1/IKEv2 Tunnel Mode, IKEv1/IKEv2 Transport Mode, IKEv2 VTI ROUTE BASED, and IKEv2 XFRMi ROUTE BASED. We also consider different TLS/NOISE-based VPNs: OpenVPN, OpenConnecs Ocserv, Wireguard, and Tinc VPN. Finally, as a pure overlay with native encryption tunnels, we consider Nebula Overlay and MACsec. For the sake of completeness, it is reported that these networks can also be configured to create Site to Site, ROAD WARRIORS, MESH, and HUB & SPOKE topologies. Of course, not all of them have all these features, but they are designed for specific purposes. This paper is organized as follows: Section 2 is dedicated to related works on VPN realizations and evaluates the existing literature. Section 3 gives a deep overview of a VPN’s architecture. Section 4 describes the scenarios used for our testbeds, while Section 5 presents the experimental results. Finally, Section 6 summarizes the paper.

Numerous studies in the literature make suggestions regarding security systems across various protocol stack layers and network typologies, including cryptography performance analysis; this section provides an overview of key contributions related to VPNs and ONs.

In [4], a novel experimental WAN solution as Software-Defined Wide Area Network (SD-WAN based on ONOSOpenDaylight https://opennetworking.org/onos/ (accessed on 23 June 2024) and OpenvSwitch 2.12.0 https://www.openvswitch.org/ (accessed on 23 June 2024) latest version as SDN controller) is proposed, entirely based on secure tunnels, implemented by the Generic Routing Encapsulation (GRE) tunneling protocol [5]. The proposal’s effectiveness is validated through two SD-WAN testbeds, covering a very long distance (from northeast to south Italy). The authors demonstrate that the SD-WAN can ensure a rapid recovery from and resilience to network failures by leveraging an innovative Berkeley Packet Filtering (BPF)-based monitoring technique. The authors also demonstrate that SD-WAN has several advantages in terms of recovery time and high performance compared to other solutions (e.g., Multi-Protocol Label Switching—MPLS).

The study in [6] evaluates network layer-based VPNs, which enable secure communications between remote LANs using IP tunnels over a shared medium (e.g., Internet). The authors’ primary focus lies in demonstrating the efficiency of various VPNs, backed by several studies on contemporary practices, followed by an analysis of the Wireguard protocol. The authors of [7] provide a comprehensive analysis of MACVLAN and IPvlan modes, focusing on their architecture characteristics and utility in enabling container communication across diverse network segments within complex application scenarios. The proposed work details the setup of container overlay networks in single-machine and multi-machine environments, offering insights into the intricacies of these modes. By evaluating key network indicators such as round-trip time (RTT), bandwidth, and jitter using tools like Ping and Iperf, the research assesses the end-to-end communication performance of containers. The experimental results indicate that the IPvlan mode demonstrates superior network performance compared to MACVLAN, presenting a more extensive and adaptable application scenario for container overlay networks. This finding highlights the significance of selecting the appropriate network mode based on specific performance and scalability requirements within containerized environments. The detailed contribution given in [8] presents a comprehensive approach to studying VPNs in general. It emphasizes that understanding VPN technology necessitates consideration of the values and motivations of individuals within organizations. A significant discovery highlights the divergent perceptions and interpretations of the terms VPN, security, and privacy among corporate employees. In [9] the attention id focuses on the widespread utilization of Secure Socket Layer (SSL)-VPN to ensure both authentication and data confidentiality between the client (typically a web browser) and the server (SSL Server). VPN technology is extensively examined in [10,11]. Specifically, these works delve into the vulnerabilities and suboptimal performance experienced under heavy loads by web browser-based SSL VPNs, which are limited to support only Windows operating systems. The authors of [12] justify the selection of the IPsec-IKEv2 suite over other potential implementations, such as SSL/TLS VPN or SSH Tunnel, by emphasizing the security of the IP communication layer. This choice is motivated by the desire for transparency of the layers above the IP within IPsec-IKEv2, as well as the ability to promptly update encryption in case of a compromise in the data channel. The research in [13] examines the use of IPsec for establishing VPNs tailored to e-business requirements. It utilizes a Linksys router as an access point and a VPN concentrator, with OpenSWAN as the system daemon. The setup employs IKEv1-L2TP for authentication and traffic management and IPsec for encryption. The article [14] proposes an approach to deploy VPN technologies for securely encrypting traffic in untrusted networks. This includes environments like bars, lounges, conferences, free hotspots, airport Wi-Fi, and, more broadly, during any travel scenario. The IPsec stack generally consists of three main parts: Encapsulating Security Payload (ESP), Authentication Header (AH), and the Internet Key Exchange protocol (IKE). The previously mentioned work [13] discusses the AH protocol with an emphasis on VPN security and Quality of Service (QoS) aspects. The IKE protocol can generate session keys for secure communications between VPN endpoints through a proper message exchange, with two existing versions: IKEv1 and IKEv2 [9,15,16]. IKEv1 offers extensive configuration options but suffers from architectural complexity, making it difficult to deploy in modern networks. In contrast, IKEv2 improves upon IKEv1 by addressing its limitations and providing more efficient encryption, with native support on platforms like OS X 10.11+, iOS 9.1+, Linux 3.x+, and Windows 8+. Additionally, IKEv2 is well-supported on mobile devices and compatible with IKEv2-aware clients and third-party iOS, Android, Blackberry, and Windows applications. In [17], a comparative analysis of VPN technologies such as L2TP, PPTP, OpenVPN, Ethernet over IP (EoIP), and MPLS evaluates their suitability for specific business needs based on performance metrics and packet transit characteristics. In [11], the focus is on the authentication parameters required for VPN server access. While some implementations may only necessitate the traditional username/password combination, other deployments like IKEv1-XAUTH may require additional parameters. Microsoft’s Secure Socket Tunneling Protocol (SSTP) [18,19] is proposed to channel PPP device traffic through an encrypted VPN tunnel via HTTP using SSL/TLS transport, handling key negotiation, channel encryption, and traffic integrity. Quick UDP Internet Connections (QUIC) is highlighted as suitable for IoT devices with limited resources [20] with implementation guidance in general TrAnsPort services (TAPS) [10], as discussed in [12]. VPNaaS simplifies network security by integrating configurations into a single product to meet various corporate security needs and enable access to virtualized networks on the cloud. The implementation of VPNaaS using WireGuard with a 5G WAN backbone is proposed in [21]. In [22], an experimental analysis on a Debian Linux environment implements the IPsec tunneling protocol with various encryption algorithms, concluding that IPsec AES-sha1 performs comparably to IPsec 3DES-sha1. However, UDP VPN encryption/decryption can degrade performance due to high memory/CPU usage.

This section covers the two most popular VPN protocols (IPsec and SSL/TLS-based VPN) and Linux virtual interfaces, specifically examining the following tunnels:

Figure 1 illustrates the generic concept of stacking and encapsulation, fundamental to understanding the functioning of Overlay networks and VPNs.

These solutions, backed by commercial products like Mikrotik and open-source ones like OpenWrt and Linux distributions, are both at the forefront of the field and serve as a foundation for new research, encompassing VPN protocols, Linux operating systems, and both proprietary and open-source hardware platforms, as referenced in [23].

To deploy a VPN, many HW and SW solutions are available (e.g., use Mikrotik RouterBoards, Mikrotik, https://mikrotik.com/ accessed on 23 June 2024, or, for example, with a Debian OS DEBIAN OS https://www.debian.org/index.it.html accessed on 23 June 2024).

Three macro application scenarios, shown in Figure 2, Figure 3, Figure 4 and Figure 5, are described in [23] and deployed both with VPNs and Overlay TLS.

These solutions guarantee secure transit through encryption algorithms such as AES (128–512) and elliptic curve implementations like ecp192. They offer a range of authentication methods, from PSK + XAUTH to certificate-based and two-step solutions using OTP or additional credential files like RADIUS + VPN IPsec/OpenVPN/OpenConnect, tailored for diverse devices and networks.

This work assesses the current landscape of communication infrastructures (WI-FI, CABLE, 4G/5G) and the devices that can be connected with those infrastructures (NUC, mini PC, Raspberry Pi, Smartphones). It aims to provide the broadest support for various devices and technologies while ensuring optimal performance and security.

Table 2 summarizes the implemented testbeds, outlining the network infrastructure and software used. Several of the proposed architectures remain in active use, including OpenVPN and WireGuard, as part of the COGITO project, https://www.icar.cnr.it/progetti/cogito-sistema-dinamico-e-cognitivo-per-consentire-agli-edifici-di-apprendere-ed-adattarsi/ accessed on 23 June 2024, Themes to interconnect the cloud and local offices.

With the rapid expansion of technologies such as IoT [29] and the evolution of communication paradigms like Fog Computing and cloud-based solutions (e.g., AMAZON AWS), or multi-site clusters (e.g., through Kubernetes), it is essential to manage the increasing data volume while ensuring compliance with GDPR.

The OpenWRT operating system allows these technologies to be implemented on compatible routers and devices. The wide range of supported bridges, particularly for IoT networks, enables interfacing with third-party protocols (e.g., LoRa and ZigBee) and traditional TCP/IP stack protocols. The x86-64 versions support virtualization, allowing for the secure and cost-effective creation of Fog networks of microservices and IoT multiprotocol networks. For instance, outdoor sensor networks can be installed in areas covered by 4G/5G networks and configured locally using an Edge Computing approach.

To assess the efficiency of various VPN protocols across different OS and HW configurations illustrated in Table 2, various network configurations were established as depicted in Figure 2, Figure 3 and Figure 4. Using guest KVM stems from the ability to nest container networks, possibly using a MACVLAN approach instead of a classical bridge, directly on individual guest networks. This would enable harnessing the capabilities of both virtual machines, such as resilience, and containers, such as lightweightness and portability.

The tools used to capture network traffic data during various VPN and Overlay Tunnel sessions are those referenced in [23] and the network hosts topology is shown in Table 3.

Listings 1–3 (bash scripts) depict the script executed by Ansible to activate a tunnel (in this case a FOU type) and automatically configure the network settings and kernel firewall parameters.

The nodes are connected to a gigabit VMWARE Ethernet switch with 1 Gbps links. The complete topology deploys a subnet representing the WAN (with public IP assigned) and two private subnets (the KVM networks) for each workstation, as shown in Figure 6. In the Site-to-Site scenario, we have two VPN/Overlay Endpoints used as terminations of the tunnels and linked to local hosts that create traffic flows. In the Site-to-Multi-Site topology, three endpoints (the number of nodes can be increased) are linked to local hosts through which traffic flows. To generate the network traffic, the Iperf, Netperf and ping tools are used to measure productivity, jitter, bandwidth, and round-trip time (RTT) while several counters of the same operating system measure the CPU usage.

To run the emulations necessary to collect the data, Ansible (Ansible Project, https://www.ansible.com/ accessed on 23 June 2024) was used on the network endpoint machines. An Ansible playbook to manage network tunnels on Linux works by defining a series of steps to be executed on one or more Linux systems to configure the desired network tunnels. These steps typically include:

The Ansible playbook defines the actions to configure and manage network tunnels on the target Linux system. It allows administrators to automate this process through a series of declaratively defined steps in the YAML playbook file.

In this work, we provided several details about VPN and Overlay connections in TCP/IP networks. In particular, we focused on analyzing several tunnels from different points of view, implementing them into virtualized environments, and giving different information on how they can be implemented. This work’s second part has been dedicated to analyzing the obtainable results regarding RTT, maximum bandwidth, and throughput. One of the main results is the possibility of clustering the tunnels in the function of the reachable RTT, thus providing a wide variety of choices that respect a given RTT distribution, depending on the desired results. The second analysis that has been illustrated regards the performance of tunneling for TCP and UDP connection: we have shown how, for UDP, all the connections saturate, while for TCP, there are some preferred tunnels. The same trend has been found for the throughput analysis.

One of the future works will certainly be to translate this study onto the Proxmox platform to evaluate the performance achievable through systems managed through this hypervisor. Proxmox VE optimizes the network and CPU management layers to deliver high performance and efficiency in virtualized environments. Here is an emphasis on these optimizations: Proxmox VE supports a wide array of advanced networking technologies crucial for creating flexible and high-performance virtual networks. These include:

Proxmox VE enhances CPU management through various techniques to ensure that virtual machines (VMs) and containers run efficiently:

Proxmox VE’s optimizations in network and CPU management layers ensure that virtualized environments operate with high efficiency and performance. The comprehensive support for advanced networking technologies combined with robust CPU management techniques makes Proxmox VE a powerful platform for modern data centers and cloud environments.