FreeVPN-一键连接，极速免费 1.0

Technology Introduction:
The virtual private network, which is what we usually call the blue light VPN, is not a brand new network concept. As its name suggests, the Blue Light VPN Overlay can be defined as a private network service that utilizes public network infrastructure. A typical example is calling. When we called with friends, we used a public telephone network to establish a virtual private connection between the two parties. Two important concepts in the blue light VPN over the wall are virtual and private. The so-called virtual is relative to reality. In a real private network, all network devices belong to a company or organization. The virtual private network uses the public network infrastructure, so it is not really private. The so-called private means that all real information is invisible to the outside world. Although the communication between the two parties utilizes a public network, the security and privacy of the data can be ensured by means of information encryption.

The first question: Why deploy Lantern VPN over the wall The main reason for deploying Lantern VPN is to save money. In modern economic activities, many multinational companies have their own branches and offices around the world. They often need to conduct business communications and remote collaboration. In order to establish such a connection, there are only two ways: one is to establish a private line between each branch, and the other is to directly access the Internet and form a Lantern VPN over the public network. Obviously, the solution to the Internet is much more economical. If you use a private line, you need to establish a point-to-point connection between every two branches. If there are n branches, then each branch needs at least n-1 lines. The private network thus constructed is not only complicated but also very expensive. Not a general company can afford it. The solution using the Internet is simple and economical, and each branch only needs to be responsible for connecting itself to the nearest Internet node.
Lantern VPN over the wall technology introduction

The lantern VPN wall, Virtual Private Network, is defined as a temporary, secure connection through a public network (usually the Internet), a secure, stable tunnel through a public network. The virtual private network is an extension of the enterprise intranet. It can help remote users, company branches, business partners and suppliers establish a trusted and secure connection with the company's intranet and ensure the secure transmission of data.

The IETF organization interprets the IP-based lantern VPN over the wall: emulating a point-to-point leased line technology on a public data network through specialized tunnel encryption techniques. Virtual is that users no longer need to have actual long-distance data lines, but long-distance data lines using the Internet public data network. The so-called private network means that users can develop a network that best suits their needs. The early private network generally refers to the network of virtual fixed line (PVC) services such as Frame Relay or ATM provided by the telecom operators, or the user's own private network is constructed through the operator's DDN private line network.

Now Lantern VPN is a security-dedicated virtual network temporarily established on the Internet. Users save the cost of renting leased lines. In addition to purchasing VPN over-the-wall equipment or VPN software products, the company pays only to pay for the ISP at the local location. The cost of Internet access also saves long-distance telephone charges for customer contacts in different regions. This is why the Lantern VPN overturned the wall.

With the OSI model reference standard, different Lantern VPN over-wall technologies can be implemented in different OSI protocol layers.
The following table: VPN over the wall in the OSI level Lantern VPN over the wall to achieve technical application layer SSL VPN
Session layer Socks5 VPN
Network layer IPSec VPN
Data link layer PPTP and L2TP


Application layer VPN
SSL protocol:
Secure Socket Layer (SSL) is a high-level security mechanism widely used in Web browsers and Web server programs to provide peer-to-peer authentication and application data encryption. In SSL, authentication is certificate-based. The authentication of the client to the client is a must, and the authentication of the client to the service provider in SSL version 3 is only an option, but it has not been widely used. The SSL session contains a handshake phase in which the communicating parties exchange certificates, generate session keys, and negotiate encryption algorithms used for communication. After the handshake is completed, for B/S applications, the application can safely transfer data without much modification, except that the SSL API is called instead of the traditional socket API when transferring data, but for C/S The structure of the application software, its solution and the session layer VPN are the same.
SSL is an end-to-end protocol that is implemented on machines at the endpoints of the communication path (usually on the client and server) and does not need to be implemented on intermediate nodes (such as routers or firewalls) in the communication path. Although SSL can theoretically be used to protect TCP/IP communications, the reality of SSL is almost exclusively limited to HTTP. In SSL communication, the server side uses port 443, and the client side's port is optional.

Session layer VPN
Socks4 protocol:
Socks is in the session layer of the OSI model. In the Socks protocol, the client initiates a connection through the firewall through the 1080 port of the Socks client, establishes a VPN tunnel to the Socks server, and then the client of the proxy application communicates with the application server. In this framework, the protocol can pass through the firewall securely and transparently, and the client program is invisible to the destination host, thus hiding the target host well. The key technology of SOCKS is to Socks the client application, add support for the Socks protocol, and then parse the Socks results on the server side.
The Socks4 protocol, which provides a non-authenticated firewall for client/server programs based on TCP (excluding UDP) such as TELNET, FTP, HTTP, WAIS, and GOPHER, establishes a VPN tunnel without encryption authentication.

Socks5 protocol:
The Socks5 protocol extends Socks4 to support IPv4, domain name resolution, and IPv6 as defined in the secure authentication scheme specified by the UDP and TCP frameworks, and in the address resolution scheme. In order to implement this Socks protocol, it is often necessary to recompile or relink the TCP-based client application to use the corresponding encryption function in the Socks library, and to increase the integrity of the data transmission, compression support of the data packet.
Network layer VPN over wall technology

IPSec protocol:
IPSec is also one of the standards supported by the IETF. It differs from the first two in that it is the encryption of the third layer, the IP layer. IPSec is not a special encryption algorithm or authentication algorithm, nor does it specify a special encryption algorithm or authentication algorithm in its data structure. It is just an open structure, defined in the IP packet format, and different encryption algorithms. Both can be implemented in the network data transmission process using the architecture defined by IPSec.
The IPSec protocol can be set to operate in two modes: one is a tunnel mode and the other is a transport mode. In tunnel mode, IPSec encapsulates IPv4 packets in secure IP frames. The transport mode is to protect end-to-end security, ie routing information is not hidden in this mode. Tunnel mode is the most secure, but it brings a lot of system overhead.

Link layer VPN over wall technology
PTP protocol:
PPTP (Point-to-Point Tunneling Protocol) is a point-to-point secure tunneling protocol developed by the PPTP Forum to provide secure VPN services for users using telephone Internet access. In 1996, it became an IETF draft. PPTP is an extension of the PPP protocol. It provides a secure VPN communication method for establishing multi-protocol on the IP network. Remote users can access the enterprise private network through any ISP that supports PPTP.
PPTP provides secure communication between the PPTP client and the PPTP server. A PPTP client is a PC running the protocol, and a PPTP server is a server running the protocol. Through PPTP, customers can dial into the public IP network. The dial-up customer first dials the ISP's access server in the normal way to establish a PPP connection. On this basis, the customer makes a second dial-up to establish a connection to the PPTP server. The connection is called a PPTP tunnel. The PPTP tunnel is essentially another PPP connection based on the IP protocol, where the IP packet can encapsulate multiple protocol data, including TCP/IP, IPX, and NetBEUI. For customers directly connected to the IP network, the first PPP dial-up connection is not required, and a virtual path can be established directly with the PPTP server.
The biggest advantage of PPTP is Microsoft's support. Another advantage is that it supports flow control, ensuring non-congestion between client and server, improving communication performance, and minimizing packet loss and rediscovery. PPTP gives the initiative to establish a tunnel, but the customer needs to configure PPTP on its PC. This will increase the workload of the user and cause network security risks. In addition, PPTP works only on IP, does not have the authentication function of the tunnel endpoint, and needs to rely on user authentication.