VPNs may not be common in home networks, but for enterprise networks, they are a critical component. A VPN ensures the security and stability of corporate data transmission. This article uses Huawei routers as an example to introduce VPN-related knowledge.
Currently, VPNs generally use two connection methods: L2TP and PPTP. Below is a detailed explanation of both.
1. For L2TP VPN connections, the VPN server maintains a UDP connection between port 1701 and port 1701 on the client. An IPsec policy using certificate authentication is automatically created for the L2TP connection, so L2TP communication is encapsulated within the IPsec tunnel created by the IPsec policy. Using ipsecmon, you can clearly see that it is still UDP communication between 1701<–>1701.
When the VPN connection initiates, both parties need to exchange keys. This is achieved via ISAKMP over UDP port 500. After that, all VPN communications, including connection/disconnection requests, user authentication, and data transfer, are transmitted over ESP.
2. For PPTP VPN connections, the VPN client’s connection/disconnection requests communicate with the server’s TCP port 1723 using the PPTP protocol. Specific tasks like user authentication and data transfer are communicated through the PPP protocol, which in turn runs over GRE.
3. When using a PPTP VPN connection, the VPN server maintains a TCP connection between its port 1723 and an arbitrary port on the client. PPTP Control Messages run over TCP port 1723, handling daily management tasks including PPTP tunnel creation, maintenance, and termination. After the client establishes a connection with the server over TCP port 1723, GRE-based PPP negotiation begins.
4. This includes all communications such as user authentication and data transfer. When disconnecting the VPN, the PPTP Control Message based on port 1723 is used again. L2TP VPN clients cannot use private addresses to