,TUNNEL+ IS NET"W+'S MO/ G5]ATIVE TRICK3 C>RY+ A PACKET 9SIDE ANO!R PACKET1 S T :AT AN 9T]M$IATE NET"W SEES " DI6]S F :AT ! 5DPO9TS EX*ANGE "4 ,A TUNNEL LETS ,I,PV#F ISL&S CROSS AN ,I,PV#D OC1N1 A PRIVATE ,,LAN /RET* ACR ! PUBLIC 9T]NET1 OR AN >BITR>Y /R1M HIDE 9SIDE ,,HTTPS4 ,E ,,VPN1 E OV]LAY NET"W1 E ,,S% PORT-=W>D IS ! SAME IDEA ) A DI6]5T 5VELOPE & E "O PAYS ! SAME TAX3 EA* LAY] ( WRAPP+ ADDS H1D] BYTES1 & ! PAYLOAD SPACE %R9KS4 ,! IDEA ,5CAPSULA;N IS ! :OLE ME*ANISM4 ,A TUNNEL 5DPO9T TAKES AN 9N] PACKET SAY1 AN ,I,PV#F DATAGRAM WRAPS X 9 AN \T] H1D] SAY1 ,I,PV#D & S5DS X4 ,! 9T]M$IATE NET"W R\TES ONLY ON ! \T] H1D]2 AT ! F> 5D1 ! WRAPP] IS /RIPP$ & ! ORIG9AL PACKET 3T9UES Z IF ! OC1N 2T 7 A WIRE4 ,TO ! 9N] TRA6IC1 ! TUNNEL IS A L9K2 TO ! \T] NET"W1 X'S UNREM>KABLE TRA6IC 2T TWO 5DPO9TS4 ,TUNNELS EXI/ AT E LAY]3 ,LAY] #B TUNNELS C>RY ,E!RNET FRAMES "2 ,LAY] #C TUNNELS C>RY ,,IP PACKETS "<,,GRE1 ,,IP-9-,,IP1 ,WIRE,GU>D1 ,,TUN DEVICES">4 ,! ,L9UX K]NEL EXPOSES BO? Z VIRTUAL 9T]FACES TUN R1DS & WRITES RAW ,,IP PACKETS1 TAP RAW ,E!RNET FRAMES : IS :Y E TUNNEL IMPLE;TA;N ON ,L9UX />TS BY CR1T+ "O4 ,! CLASSIC TUNNELS ,TUNNEL ,LAY] ,:AT X WRAPS ,": X LIVES ,,GRE "<,,RFC #BGHD1 ,CISCO #AIID"> ,L#C ,ANY?+ 9 ,,IP ,R\T]S "EY": ,,IP-9-,,IP "<,,RFC #BJJC"> ,L#C ,I,PV#D 9 ,I,PV#D ,SIMPLE/ POSSIBLE TUNNEL ,,S% -,L_/-,R_/-;,D /R1M ,,TCP 9SIDE ,,S% ,E ADM9'S POCKET ,I,PSEC ,,ESP TUNNEL MODE ,L#C ,,IP 9SIDE 5CRYPT$ ,,IP ,SITE ,V,P,NS ,OP5,V,P,N ,L#B_/,L#C ,FRAMES_/PACKETS 9 ,,TLS OR ,,UDP ,US]-SPACE ,V,P,NS ,WIRE,GU>D ,L#C ,,IP 9 AU!NTICAT$ ,,UDP ,! MOD]N ,,VPN ,,VXLAN "<,,RFC #GCDH"> ,L#B ,E!RNET 9 ,,UDP ,CL\D_/DATAC5T] OV]LAYS #FTO#D _/ ,T]$O _/ #FRD ,L#C ,I,PV#F 9 ,I,PV#D ,! TRANSI;N ]A ,,HTTP ,,3NECT _/ ,,TLS /R1M ,ANY?+ 9 ,,HTTPS ,PROXIES1 /UNNEL ,! ,I,PV#F TRANSI;N TUNNELS' GR1TE/ ]A ,TUNNELS C>RI$ ,I,PV#F "? XS TWO-DECADE *ILDHOOD4 #FTO#D "<#AIII"> 5COD$ ! ,I,PV#D 5DPO9T 9SIDE ! ,I,PV#F ADDRESS ANY HO/ ) A PUBLIC ,I,PV#D CD EMIT A R\T$ ,I,PV#F _/#DH "? AUTOMATIC 5CAPSULA;N4 ,T]$O TUNNEL$ ,I,PV#F 9SIDE ,,UDP_/,I,PV#D SPECIFICALLY TO CROSS ,N,A,TS4 #FRD LET ,I,S,PS (F] ,I,PV#F OV] ,I,PV#D BACKB"OS4 ,:5 AN ,,ISP TD H&S Y 8,I,PV#F01 "!'S A DEC5T *.E A TUNNEL IS DO+ ! "W ! MOD]N 9T]NET'S B"OS >E "PLY 5CAPSULAT$4 ,,S% TUNNELS ! "EY"D TUNNEL ,! TUNNEL E PRACTI;N] ACTUALLY USES3 S% -;,L #HJHJ39T]NAL-DB3#EDCB US]@ABAS;N _? LOCAL =W>D MY 3#HJHJ R1*ES _! ,,DB S% -;,R #IJIJ3LOCALHO/3#CJJJ US]@APUBLIC-VPS _? REMOTE =W>D EXPOSE MY 3#CJJJ TO !M S% -;,D #AJHJ US]@AHO/ _? DYNAMIC A ,,SOCKS PROXY "? ,,S% ,?REE FLAGS COV] MO/ TUNNEL+ "W4 ,NO ,,VPN DAEMON1 NO C]TIFICATES1 NO 3FIG FILES ! ,,S% SES.N XF IS ! 5VELOPE4 ,! ,,MTU TAX ,E WRAPP] CO/S BYTES4 ,A TUNNEL 9SIDE ,E!RNET />TS 2L ! #AEJJ-BYTE ,,MTU ,,GRE TAKES @9#BD1 ,I,PSEC @9#EJ"61 ,WIRE,GU>D @9#FJ1 ,,VXLAN @9#EJ4 ,9N] PACKETS T FIT ! PHYSICAL ,,MTU NO L;G] FIT ONCE WRAPP$1 =C+ FRAG;TA;N OR ,PA? ,,MTU ,4COV]Y & :5 ,,PMTUD'S ,,ICMP REPLIES GET FILT]$ "1 3NEC;NS HANG MY/]I\SLY ON L>GE TRANSF]S :ILE P+S SU3E$4 8,! TUNNEL IS UP B /ALLS ON BIG PACKETS0 IS ! ,,MTU TAX COM+ DUE ! FIX IS CLAMP+ ,,MSS "D -;P TCP --TCP-FLAGS ,,SYN1,,R/ ,,SYN -;J ,,TCPMSS --CLAMP-MSS-TO-PMTU"> OR L[]+ ! TUNNEL 9T]FACE ,,MTU4 ,TUNNELS Z OV]LAY NET"WS ,9 DATAC5T]S1 TUNNEL+ IS ! NET"W3 ,,VXLAN WRAPS ,E!RNET FRAMES 9 ,,UDP TO /RET* ,L#B SEG;TS ACR ,L#C FABRICS "O PHYSICAL NET"W C>RY+ ?\S&S ( ISOLAT$ VIRTUAL "OS "<#AF MILLION ,V,N,IS VS ,,VLAN'S #DJID">4 ,KUB]NETES OV]LAYS "<,FLANNEL1 ,CALICO'S ,,VXLAN MODE">1 CL\D ,V,P,CS1 & MULTI-T5ANT FABRICS ALL RUN ON 5CAPSULAT$ TRA6IC4 ,G5EVE G5]ALIZ$ ! IDEA A TUNNEL ^: H1D]S C>RY EXT5SIBLE METADATA4 ,! MOD]N CL\D IS TUNNELS ALL ! WAY D[N4 ,SECUR;Y & ABUSE ,AN 5CRYPT$ TUNNEL HIDES ! 3T5TS B N ! FACT ( A TUNNEL 5DPO9TS1 TIM+1 & VOLUME REMA9 VISIBLE4 ,& ! SAME TE*NIQUE T SECURES A ,,VPN C EXFILTRATE DATA3 ,,DNS TUNNEL+ " SMU7LES TRA6IC 9 ,,TXT QU]IES1 ,,ICMP TUNNEL+ RIDES P+S1 & E RE/RICTIVE EGRESS FILT] IS A TUNNEL WAIT+ TO 2 BUILT4 ,TUNNELS >E NEUTRAL PLUMB+ ! 5VELOPE DOESN'T "K :AT X'S C>RY+4 ,SPLIT TUNNEL+ ,A ,,VPN NE$N'T C>RY ALL TRA6IC3 SPLIT TUNNEL+ R\TES ONLY *OS5 SUBNETS "? ! TUNNEL " A R\T+-TABLE "Q1 N A TUNNEL "Q4 ,WIRE,GU>D'S ,ALL[$,I,PS MAKES X EXPLICIT3 ! ALL[$ RANGE IS BO? ! R\TE & ! ,,ACL4 ,9 ! H&BOOK ,TUNNEL+ IS ": ,L9UX NET"W+ MEETS PRACTICE IP TUNNEL1 TUN_/TAP DEVICES1 S% -;,L1 ,WIRE,GU>D'S WG#J1 & ! ,,MTU SUBTLETIES T BITE E F/ ,,VPN4 ,! DEEP FOLL[-ON3 ,WIRE,GU>D A MOD]N TUNNEL R$UC$ TO XS CRYPTOGRAPHIC ESS;E4 ,"TL9E #AIID ,,GRE /&>DIZ$ "<,,RFC #AGJA2 UPDAT$ ,,RFC #BGHD1 #BJJJ"> #AIIE#IH ,I,PSEC ,,ESP TUNNEL MODE "<,,RFC #AHBG ,,RFC #BDJF"> #BJJA #FTO#D AUTOMATIC ,I,PV#F TUNNELS "<,,RFC #CJEF"> #BJJA ,OP5,V,P,N ,,TLS-BAS$ US]-SPACE ,,VPN #BJJF ,T]$O ,,NAT-TRAV]SAL TUNNELS "<,,RFC #DCHJ"> #BJAD ,,VXLAN DATAC5T] OV]LAY /&>D "<,,RFC #GCDH"> #BJBJ ,WIRE,GU>D M]G$ 9TO ,L9UX #E4F ,SEE AL - ,WIRE,GU>D ! MOD]N TUNNEL - ,L9UX TUN_/TAP1 IP1 & ! K]NEL 9T]FACES TUNNELS LIVE ON