Tunneling protocol 1272738 225529406 2008-07-14T04:21:45Z Mail2yogie 7472312 /* External links */ {{IPstack}} <!-- Edit the stack image at: Template:IPstack--> The term '''tunneling protocol''' is used to describe when one [[network protocol]] called the '''payload protocol''' is [[encapsulation (networking)|encapsulated]] within a different '''delivery protocol'''. Reasons to use tunnelling include carrying a payload over an incompatible delivery network, or to provide a secure path through an untrusted network. Tunneling typically contrasts with a layered protocol model such as those of [[Open Systems Interconnection|OSI]] or [[TCP/IP]]. The tunnel protocol is usually (but not always) at a higher level than the payload protocol, or at the same level. To understand a particular protocol stack, both the payload and delivery protocol sets must be understood. Protocol encapsulation that is carried out by conventional layered protocols, in accordance with the [[OSI model]] or [[TCP/IP model]], for example HTTP over TCP over IP over PPP over a V.92 modem, should not be considered as tunneling. As an example of network layer over network layer, [[Generic Routing Encapsulation]] (GRE), which is a protocol running over IP ([[IP protocol|IP Protocol Number]] 47), often is used to carry IP packets, with RFC 1918 private addresses, over the Internet using delivery packets with public IP addresses. In this case, the delivery and payload protocols are compatible, but the payload addresses are incompatible with those of the delivery network. In contrast, an IP payload might believe it sees a data link layer delivery when it is carried inside the Layer 2 Tunneling Protocol, which appears to the payload mechanism as a protocol of the data link layer. L2TP, however, actually runs over the transport layer using [[User Datagram Protocol]] (UDP) over IP. The IP in the delivery protocol could run over any data link protocol from [[IEEE 802.2]] over [[IEEE 802.3]] (i.e., standards-based [[Ethernet]]) to the [[Point-to-Point Protocol]] (PPP) over a dialup modem link. Tunneling protocols may use data encryption to transport insecure payload protocols over a public network such as the Internet thereby providing [[VPN]] functionality. [[IPSec]] has an end-to-end Transport Mode, but also can be operated in a Tunneling Mode through a trusted security gateway. == Common tunneling protocols == Examples of tunneling protocols include: [[Datagram]]-based: * [[IPsec]] * [[Generic Routing Encapsulation|GRE]] (Generic Routing Encapsulation) ''supports multiple protocols and multiplexing'' * [[IP in IP]] Tunneling <ref>[http://www.ietf.org/rfc/rfc2003.txt IP Encapsulation within IP],RFC2003, C. Perkins,October 1996</ref> ''Lower overhead than GRE and used when only 1 IP stream is to be tunneled'' * [[L2TP]] ([[Layer 2]] Tunneling Protocol) <ref>[http://www.ietf.org/rfc/rfc2661.txt Layer Two Tunneling Protocol "L2TP"],RFC 2661, W. Townsley ''et al.'',August 1999</ref> * [[Multiprotocol Label Switching|MPLS]] (Multi-Protocol Label Switching) * [[GPRS Tunnelling Protocol|GTP]] (GPRS Tunnelling Protocol) * [[Point-to-point tunneling protocol|PPTP]] (Point-to-Point Tunneling Protocol) <ref>[http://www.ietf.org/rfc/rfc2637.txt Point-to-Point Tunneling Protocol (PPTP)],RFC 2637, K. Hamzeh ''et al.'',July 1999</ref> * [[Point-to-Point Protocol over Ethernet|PPPoE]] ([[point-to-point protocol]] over [[Ethernet]]) * [[Point-to-Point Protocol over ATM|PPPoA]] (point-to-point protocol over [[Asynchronous transfer mode|ATM]]) * [[IEEE 802.1Q]] (Ethernet VLANs) * [[DLSw]] ([[Systems Network Architecture|SNA]] over [[Internet Protocol|IP]]) * [[XOT]] ([[X.25]] datagrams over [[Transmission Control Protocol|TCP]]) * [[IPv6]] tunneling: [[6to4]]; [[6in4]]; [[Teredo tunneling|Teredo]] * [[Anything In Anything]] (AYIYA; e.g. IPv6 over UDP over IPv4, IPv4 over IPv6, IPv6 over TCP IPv4, etc.) [[Stream (computing)|Stream]]-based: * [[Transport Layer Security|TLS]] * [[Secure Shell|SSH]] * [[SOCKS]] * [[HTTP]] CONNECT command * Various circuit-level proxy protocols, such as [[Microsoft Proxy Server]]'s [[Winsock Redirection Protocol]], or [[WinGate (computing)|WinGate]] [[Winsock Redirection Service]]. == SSH tunneling == An SSH tunnel (sometimes referred to as a [[virtual private network|VPN]]) is an encrypted network [[tunneling protocol|tunnel]] created through an [[Secure Shell|SSH]] connection. SSH is frequently used to tunnel insecure traffic over the Internet in a secure way. For example, Windows machines can share files using the [[Server Message Block|SMB]] protocol, which is not encrypted. If you were to mount a Windows filesystem remotely through the Internet, someone snooping on the connection could see your files. To mount an SMB file system securely, one can establish an SSH tunnel that routes all SMB traffic to the fileserver inside an SSH-encrypted connection. Even though the SMB traffic itself is insecure, because it travels within an encrypted connection it becomes secure. In order to create an SSH tunnel, the SSH client is configured to forward a specified remote port and [[IP address]] (that is accessible on the SSH server) to a port on the local machine. Once the SSH connection has been established, the user can connect to the specified local port to access the network services that would otherwise be available only at the remote IP address and port. SSH tunnels provide a means to bypass firewalls that prohibit certain Internet services provided that outgoing connections on [[TCP and UDP port|port]] 22 are allowed. For example, many institutions prohibit users from accessing Internet web pages (port 80) directly without first being examined by a proxy/filter device. However, if users are able to connect to an external SSH server, it is possible for them to create an ssh tunnel to forward port 80 on an external web server to a given port (probably port 80) on their local machine, and thus access that web page by typing http://localhost in their [[web browser|browser]]. More commonly, users may set up their own [[proxy server]] at home, using free software such as [[Squid cache|Squid]], and construct a tunnel from their workstation to the proxy. Next, by configuring their browser to use [[localhost]] rather than the corporate proxy server, users can access any web page they want, bypassing their company's filters and firewalls. Another method is to use dynamic port forwarding, which creates a local [[SOCKS]] 4/5 proxy server that a user can connect to, effectively creating an encrypted tunnel to the remote SSH server. The user can then configure his/her applications to use the SOCKS proxy server, usually for bypassing filters and firewalls. == Tunneling to circumvent firewall policy == Tunneling can also be used to "sneak through" a firewall. A protocol that is blocked by the firewall is "wrapped" inside a protocol that is NOT blocked by the firewall, such as [[HTTP]]. If the firewall policy has not been written to exclude this kind of "wrapping", this trick can be used to get around the intended firewall policy. Another HTTP-based tunneling method uses the [[HTTP]] CONNECT method/command. A client issues the HTTP CONNECT command to an HTTP proxy. The proxy then makes a TCP connection to a particular server:port, and relays data between that server:port and the client connection. Because this creates a security hole, CONNECT-capable HTTP proxies commonly restrict access to the CONNECT method. The proxy allows access only to TLS/SSL-based HTTPS services. == See also == * [[Tunnel broker]] * [[Virtual private network]] * [[HTTP tunnel (software)]] ==References== {{FOLDOC}} <references /> == External links == * [http://polishlinux.org/apps/ssh-tunneling-to-bypass-corporate-firewalls SSH Tunnels explained by example] * [http://www.allthingsmarked.com/2006/08/17/how-to-set-up-a-windows-ssh-server-for-vnc-tunneling/ HOWTO: Set up a Windows SSH server for VNC tunneling] * [http://www.securityfocus.com/infocus/1816/ SSH port forwarding and tunneling explained in detail.] * [http://ple-q.com/2007/04/27/ngumpet-dengan-ssh-tunnel-di-linux/ SSH tunneling to anonymous proxy (Indonesian Version).] [[Category:Tunneling protocols| ]] [[cs:Síťové tunelování]] [[de:Tunnel (Rechnernetz)]] [[es:Tunneling]] [[eu:Tunneling]] [[fr:Tunnel (réseau informatique)]] [[it:Tunneling]] [[nl:Tunnelingprotocol]] [[pl:Tunel (informatyka)]] [[pt:Tunelamento]] [[ru:Протокол туннелирования]] [[sv:Tunnlade protokoll]]