Virtual Private Network

Full Title or Meme

Virtual Private Networks (VPNs) have given computers the ability to join a remote network as though they were physically attached to that network.

Context

Ever since Enterprise employees started to travel with laptop computers the Enterprise has deployed Virtual Private Networks so the remote employees could function as though they were at their own desk in the home office. VPNs allow devices that aren’t physically on a network to securely access the devices that are on the network.

Problems

• Each device on the network has equal access to the network, even if that device has been compromised. (Since this page is about commercial networks, we do not address partitioned networks such as those found in the Military.)
• Note that a Zero Trust Architecture requires additional Authentication for each use of the network above and beyond that supplied by the network itself.

Solutions

Android

• VPNs on android developer site include some legacy implementations. This page assumes Android 7 or later.
• Always-on VPN Android can start a VPN service when the device boots and keep it running while the device is on. While Android maintains the service lifecycle, it’s your VPN service that’s responsible for the VPN-gateway connection. Always-on VPN can also block connections that don’t use the VPN.
• Blocked connections A person using the device (or an IT admin) can force all traffic to use the VPN. The system blocks any network traffic that doesn’t use the VPN. People using the device can find the Block connections without VPN switch in the VPN options panel in Settings. Caution: When non-VPN traffic is blocked, apps that aren’t in an allowed list or in a disallowed list lose their network connection. Consider warning people when making allowed or disallowed lists.

Pixel VPN

• Allows Google to act as the home site for a VPN on a Pixel which is supplied by them.
• The existing android VPN does allow a list of sites you can get to access the internet w/o going thru the VPN. It should be presumed that this feature will still be a part of the pixel offering. The question there is "can YOU set the list of sites?" For an enterprise VPN that is not normally allowed.