Lesson 5 of 8 · 9 min read
How Tunnels and VPNs Work
A tunnel carries one packet inside another; a VPN adds authentication and encryption so the inner packet crosses untrusted networks safely. IPsec negotiates keys with IKE and protects packets with ESP; WireGuard binds static public keys to allowed address ranges with a one-round-trip handshake; TLS VPNs ride over port 443. All of them authenticate who connected and then deliver packets onto a network, so what a client can reach is decided by policy behind the gateway. Leaks (DNS, IPv6, local routes), gateway vulnerabilities and broad post-connect access are where real failures happen.
free sign-in, no card required
Practise it as an interviewer asks it
Walk through a TLS 1.3 handshake. What does each step protect against?What is SSRF, and why do LLM tools that fetch URLs bring it back?What are reverse shells and command-and-control channels, why do attackers use them, and how do you detect them?How would you secure remote access: a traditional VPN or zero-trust network access? What attacks target each?Explain the network stack layer by layer: what lives at each layer, how it is attacked, and which control works there.What does zero trust mean in practice, beyond the slogan?