How VPNs Work: IPsec, IKEv2, Encrypted Tunnels & VPN Gateway Risks (Animated)

A VPN puts an encrypted tunnel across the internet so a remote laptop can reach internal servers as if it were in the office. That makes the VPN gateway the front door of the company network, and one of the first things attackers probe.

1. Build the tunnel: ikev2: agree keys and prove identities

The laptop and gateway run IKEv2 (UDP 500, then 4500): they agree on algorithms, do a Diffie-Hellman key exchange, and authenticate each other with certificates and the user’s login.

1. IKE_SA_INIT (Remote laptop → VPN gateway): The laptop proposes algorithms and sends its key share.
2. IKE_SA_INIT (VPN gateway → Remote laptop): Both now share a secret; everything after this is encrypted.
3. IKE_AUTH (Remote laptop → VPN gateway): Identities are proven inside the encrypted channel.
4. IKE_AUTH (VPN gateway → Remote laptop): The tunnel is up and the laptop gets an internal address.

Wireshark filter:

isakmp

2. Traffic in the tunnel: internal packets wrapped in esp

The laptop’s packets to internal servers are encrypted and wrapped in ESP packets addressed to the gateway, which unwraps them inside the office.

1. ESP (Remote laptop → Internal file server): Anyone on the internet sees only encrypted packets to the gateway.
2. ESP (Internal file server → Remote laptop): Replies come back the same way.

Wireshark filter:

esp

3. Attacking the front door: attack: unpatched gateways and password-only logins

Attackers continuously scan for VPN gateways, check the product and version, and use publicly known vulnerabilities in unpatched devices, or try stolen and reused passwords where there is no MFA. One success lands them inside the network.

1. PROBE (Attacker → VPN gateway): The attacker identifies an unpatched gateway.
2. LOGIN (Attacker → VPN gateway): A reused password works because there is no second factor.
3. TUNNEL (Attacker → Internal file server): The attacker is now inside, hidden in encrypted VPN traffic.

What the soc watches:

VPN logins from new countries · many failed logins · logins outside working hours

4. Harden the gateway: defence: patch fast, mfa, monitor

Patch VPN gateways as an emergency whenever critical fixes are released, require MFA and device certificates, disable unused portals, restrict admin interfaces, and send VPN logs to the SIEM.

1. LOGIN (Attacker → VPN gateway): A stolen password alone is no longer enough, and the SOC gets an alert.

Gateway checklist:

Critical patches within days · MFA for every user · device certificates
Alert: impossible travel, many failures, new device

FAQ