WAN & VPN
What Is a WAN?
A Wide Area Network connects networks across large geographic distances. Typical situation: the LAN is self-managed, while the WAN runs through a service provider (ISP) that you pay for the connection.
| LAN | WAN |
|---|---|
| Small geographic area | Large geographic distances |
| Owned and managed by you | Managed by an ISP, phone or cable provider |
| High bandwidth (Ethernet, Wi-Fi) | Variable bandwidth, paid service |
| Free after infrastructure costs | Recurring costs |
WAN protocols work at Layer 1 and Layer 2 — different L2 protocols than in a LAN (not IEEE 802.3 / Ethernet / 802.11).
WAN Terminology
| Term | Description |
|---|---|
| DTE (Data Terminal Equipment) | Connects the customer's LAN to the WAN communication device |
| DCE (Data Communications Equipment) | Device for communicating with the provider |
| CPE (Customer Premises Equipment) | DTE + DCE together on the customer side |
| POP (Point of Presence) | The point where the customer connects to the provider network |
| Demarcation Point | Physical location separating CPE and provider equipment |
Serial Communication
Almost all network communication over a WAN is serial — bits are sent one at a time over the same line. Parallel communication causes synchronization problems over larger distances and is not suited to WAN.
WAN Technologies — Overview
WAN
├── Private (resources exclusive to 1 customer)
│ ├── Dedicated → Leased Lines (T1/E1, T3/E3)
│ └── Switched
│ ├── Circuit Switched → PSTN, ISDN
│ └── Packet Switched → Metro Ethernet, MPLS, Frame Relay*, ATM*
└── Public (shared)
└── Internet
└── Broadband + VPN
├── Wired → xDSL, Cable, Optical Fiber (FTTx)
└── Wireless → Cellular (3G/4G/5G), Satellite, WiMAX
Frame Relay and ATM are outdated, replaced by MPLS and Metro Ethernet.
Private WAN — Leased Lines
A permanent leased line from an ISP — always available, fixed capacity, paid through SLA contracts. Expensive but secure and reliable. Limited to the infrastructure of 1 ISP.
| Standard | Region | Bandwidth |
|---|---|---|
| T1 | North America / Japan | 1.544 Mbps |
| E1 | Europe (CEPT) | 2.048 Mbps |
| T3 | North America | 44.736 Mbps |
| E3 | Europe | 34.368 Mbps |
Private WAN — Circuit Switching
A connection is set up in advance between sender and receiver before exchanging data.
PSTN (Publicly Switched Telephony Network) — the classic telephone network: - Advantage: copper cabling already everywhere, extremely reliable (5 nines = 99.999% uptime) - Disadvantage: analog → a modem is needed for digital data, not always-on, you pay even if you send nothing
ISDN (Integrated Services Digital Network): - Digital signal all the way to the endpoint - Better throughput than POTS by bundling lines - Uses existing copper cabling
Private WAN — Packet Switching
The provider provides a virtually fixed line — an always-on connection, no dial-in needed. Each packet can take a different route. Capacity can vary.
Metro Ethernet (Ethernet WAN)
Ethernet WAN services over fiber cabling. Easy to integrate with existing LAN infrastructure. Known under various names: Metropolitan Ethernet, EoMPLS, VPLS.
MPLS — Multi Protocol Label Switching
A WAN routing technique where routers make decisions based on labels, not IP addresses (works at a layer between L2 and L3 — sometimes called "L2.5").
- Independent of access technology (Ethernet, DSL, Cable, ...)
- Independent of payload type
- Supports QoS, VPN, redundancy, traffic engineering
Public WAN — Broadband
xDSL
DSL = Digital Subscriber Line — data over copper telephone lines.
| Type | Upstream vs Downstream |
|---|---|
| ADSL | Downstream > Upstream |
| SDSL | Downstream = Upstream |
| VDSL | Very high bitrate, successor to ADSL |
Speed depends on the distance to the ISP central office, cable quality and type.
Cable
Data transfer over coaxial cable. High-speed, always-on. Standard: DOCSIS. A shared medium — neighbors share the available bandwidth.
FTTx — Fiber To The ...
| Variant | Meaning |
|---|---|
| FTTH | Fiber To The Home |
| FTTB | Fiber To The Building |
| FTTN | Fiber To The Neighbourhood |
The most performant of all broadband technologies, but also the most expensive.
Wireless Broadband
| Technology | Details |
|---|---|
| Cellular (3G/4G/5G) | Based on the mobile phone network |
| Satellite | Geosynchronous orbit, sensitive to weather and vegetation |
| WiMAX (IEEE 802.16) | Microwave radiation over a large area |
Cheaper to deploy (no digging required), but less robust and sensitive to environmental factors.
VPN — Virtual Private Network
The WAN is a public network — data is exposed to eavesdropping, replay and modification. A VPN provides a secured path over a public communication channel through encryption.
A VPN tunnel makes the data stream appear as if there is only 1 hop between the start and end points.
A VPN provides
- Confidentiality via encryption
- Authentication — identity check of sender/receiver
- Integrity checking — messages not altered in transit
- Anti-replay measures
VPN Types
| Type | Description |
|---|---|
| Site-to-site (gateway-to-gateway) | Connects two networks — encryption/decryption done by routers, transparent to end users |
| Client-to-site (remote access) | An individual user connects via a VPN client to the corporate network |
VPN Protocols
| Protocol | OSI layer | Note |
|---|---|---|
| IPSec | L3 | Framework of encryption and authentication protocols |
| GRE | L3 | Tunneling, no encryption on its own |
| L2TP | L2 | Tunneling, often combined with IPSec for encryption |
| PPTP | L2 | Outdated (PPP + GRE) |
| SSL/TLS | L4/L7 | Works at the application layer, e.g. HTTPS, clientless VPN |
VPN Classification by OSI Layer
| OSI layer | VPN technologies |
|---|---|
| L4/L7 (transport/application) | SSL/TLS |
| L3 (network) | IPSec, GRE |
| L2 (data link) | L2TP, PPTP, MPPE |
Overhead
Every VPN technology adds extra headers to every packet — the more layers of encapsulation, the more overhead. An IPSec tunnel already adds an extra IP + ESP header; an L2TP tunnel adds UDP, L2TP, PPP and an extra IP on top of that.