2. Layer-2 Ethernet-based VPN

    Table of contents
    to the older version or return to version archive.

    Combined revision comparison

    Comparing version 20:14, 22 Feb 2013 by genya with version 10:58, 28 Feb 2019 by seoss.

    ...

    As you know, Ethernet is a technology for using on LANs (Local Area Networks). Ethernet is very convenient and reliable standard in order to connect several computers togethermutual. With Ethernet, you can enjoy many network programs such as file sharing, printer sharing and accessing amounts of data on RDBMS (Relational Database Management Systems). Today there are no companies who have no LANs with Ethernet in their office.

    Standard formation of Ethernet-using network is hub-and-spoke model. There are hubs (as know as Ethernet switches) central and each computercomputers has a cable to the hub. Then all computers can communicate mutually. The advantage of Ethernet is that you can understand the model very easily. This is a certain reason why Ethernet has been spread the world. Computers and hubs connected in order to enable them free communication consists an Ethernet Segment. It is also called as "Layer-2 Segment" or "Broadcast Domain" .

    ...

    But you cannot use Ethernet beyond the walls of an office or building. NormallyIn normal condition, you know you can connect computers togethermutual only in a room or a building. But you cannot make a computer on site-Athe site-A to communicate with another computer on the site-B with only Ethernet. The reason why you cannot is that Ethernet needsmust need wired Ethernet network cables to connect between devices. Network cables can be laid only in the building. You cannot lay the cable between the separated two or more buildings, because you cannot place any cables across the road. Of course there are other limitations of Ethernet, for example maximum distance of cable. And these limitations cannot be solved by using other physical media as extensions of Ethernet lately invented, such as Wi-Fi and optical cables.

    "Ethernet" is totally different to "Internet". The Internet is the interconnected network of a lot of private networks and ISPs joined togethermutually. It is certain that we can pay ISPs inexpensive money to enjoy the connection to the Internet. You can connect both offices of Tokyo and Beijing to the Internet. And computers on each office can now access to the Internet. But still you cannot enjoy any software written for LAN internal use between two sites, even if they are connected bythere are both two Internet connections. What you can do are only as follows; for example, to exchange emails, to use Skype and Messenger software in order to exchange short messages or voices, and to access the same groupware to exchange schedules and so on. You can do these things if you have two sites and both sites have each Internet connection. But you cannot enjoy any other profits which are came from software for LAN, for example file sharing, print sharing, database protocols, CRMs, ERPs, and other applications which are developed for specified purposes. Again, Ethernet is not Internet. Internet cannot become alternative to Ethernet. Even if you connect both sites to the Internet, two sites don't construct the single Ethernet segment at all. If you want to use application for LAN, you must construct a single Ethernet segment to surround every your computers.

    ...

    By now you understand the advantagesYou understood about the advantage of Ethernet and the difference between Ethernet and Internet, and also the limitation which is came from the difference. But you probably wonder if an Ethernet segment can be extended to other sites beyond any distance, for example beyond roadways between two buildings. If it could, it might be possible to use any applications for purpose of LAN use between two or mote sites.

    ...

    Then you need any other solution. Fortunately, the cost to connect a site to the Internet is very cheap today. You can keep connection two or more sites to the Internet easily. Then if you install SoftEther VPN on each site, you can connect each segment of all sites mutually in order to build a single Ethernet segment. Before you establish the VPN tunnel, every site's network has its own Ethernet segment. Every segment is separated completely from every other segmentand mutually. After the VPN tunnel has been established, however, every segment is combined together and unites them into a 'virtual'then unites to the single segment. After that, you can run any protocols between every remote site regardless of, crossing the physical distance. You can use this technique forto both purposes of remote accessing and site-to-site connections.

    ...

    An Ethernet switch, alsoEthernetswitch,as known as Hub or Layer-2 Switch, is a device to exchange packets between Ethernet hosts. A switch has a FDB (Forwarding Database) inside itself in order to determine the appropriate destination port of outgoing for a packet which came from incoming port. This behavior is called as "Switching"," as a major function of switches.

    Ethernet network cable, as known as Cat5e or Cat6 Copper Cable, is a device to connect between Ethernet devices, such as Ethernet switches and Ethernet adapters. Ethernet Adapters are also called "NIC (Network Interface Card)" and placed on computer. Nowadays a computer usually has an Ethernet adapter built into its motherboard ("Onboard" adapter) . Additional adapters can be inserted onto theon its board. It is called "Onboard" . You know that you can insert more adapters on PCI or USB bus of the computer if neededyou need.

    SoftEther VPN virtualizes Ethernet switching and emulatesswitch and emulate it. The virtual Ethernet switch is called "Virtual Hub" in the software. And SoftEther VPN virtualizes Ethernet adapter and emulate it. The virtual Ethernet adapter is called "Virtual Network Adapter" in the software. SoftEther VPN also virtualizes Ethernet network cable and emulates it. The virtual Ethernet network cable is called "VPN Session" or "VPN Tunnel" in the software.

    Above three elements are important to understand SoftEther VPN. For example, when you want to build a remote access VPN in order to accept VPN connections from remote site to the company LAN, you will create a Virtual Hub on the VPN Server in the company LAN. That Virtual Hub constructs an Ethernet segment. And you connect together both the Virtual Hub and the physical network adapter on the server computer mutually. Then both segments of the Virtual Hub and the existing physical LAN are now combined and united as the single Ethernet segment. VPN Client software is then installedAnd you will installVPN Client software on the remote client PCsPC, for instance, a laptop PC. VPN Client software can create a Virtual Network Adapter on the client PC. You will create a connection setting in order to connect the VPN Client to the Virtual Hub on the VPN Server in your company. When you initiateignite the connection, a new VPN Session will be established between the Virtual Network Adapter and the Virtual Hub. This situation is very similar to that whenthat you attach the one end-side of an Ethernet cable to the physical Hub and the otherend-side to the physical Ethernet adapter on the computer. From a functional and logical perspective, it is identical to a physical Ethernet connectionNot only similar, but it is also exactly same in the logical aspect of behavior of Ethernet. After you established the VPN connection, you can send and receive any protocols suitable for Ethernet. All packets are transmitted on the virtual cable, as called as VPN Session or VPN Tunnel.

    OnceAfter once you understood the architecture of usingrealizing method of SoftEther VPN, you will also be able to understand that the potential possibilities for range of use of SoftEther VPN is almost infinite. The above example showsshow you the way to construct a remote access VPN, but you can apply the techniquethis way to make any other form of VPN. It is very easy to build a site-to-site VPN. The onlyOnly difference to remote access VPN is the opposite endends from the VPN Server is not a VPN Client but a VPN Bridge.

    ...

    Version from 20:14, 22 Feb 2013

    This revision modified by genya (Ban)

    ...

    As you know, Ethernet is a technology for using on LANs (Local Area Networks). Ethernet is very convenient and reliable standard in order to connect several computers mutual. With Ethernet, you can enjoy many network programs such as file sharing, printer sharing and accessing amounts of data on RDBMS (Relational Database Management Systems). Today there are no companies who have no LANs with Ethernet in their office.

    Standard formation of Ethernet-using network is hub-and-spoke model. There are hubs (as know as Ethernet switches) central and each computers has a cable to the hub. Then all computers can communicate mutually. The advantage of Ethernet is that you can understand the model very easily. This is a certain reason why Ethernet has been spread the world. Computers and hubs connected in order to enable them free communication consists an Ethernet Segment. It is also called as "Layer-2 Segment" or "Broadcast Domain" .

    ...

    But you cannot use Ethernet beyond the walls of office or building. In normal condition, you know you can connect computers mutual only in a room or a building. But you cannot make a computer on the site-A to communicate with another computer on the site-B with only Ethernet. The reason why you cannot is that Ethernet must need wired Ethernet network cables to connect between devices. Network cables can be laid only in the building. You cannot lay the cable between the separated two or more buildings, because you cannot place any cables across the road. Of course there are other limitations of Ethernet, for example maximum distance of cable. And these limitations cannot be solved by using other physical media as extensions of Ethernet lately invented, such as Wi-Fi and optical cables.

    "Ethernet" is totally different to "Internet". The Internet is the interconnected network of a lot of private networks and ISPs mutually. It is certain that we can pay ISPs inexpensive money to enjoy the connection to the Internet. You can connect both offices of Tokyo and Beijing to the Internet. And computers on each office can now access to the Internet. But still you cannot enjoy any software written for LAN internal use between two sites, even if there are both two Internet connections. What you can do are only as follows; for example, to exchange emails, to use Skype and Messenger software in order to exchange short messages or voices, and to access the same groupware to exchange schedules and so on. You can do these things if you have two sites and both sites have each Internet connection. But you cannot enjoy any other profits which are came from software for LAN, for example file sharing, print sharing, database protocols, CRMs, ERPs, and other applications which are developed for specified purposes. Again, Ethernet is not Internet. Internet cannot become alternative to Ethernet. Even if you connect both sites to the Internet, two sites don't construct the single Ethernet segment at all. If you want to use application for LAN, you must construct a single Ethernet segment to surround every your computers.

    ...

    You understood about the advantage of Ethernet and the difference between Ethernet and Internet, and also the limitation which is came from the difference. But you probably wonder if an Ethernet segment can be extended to other sites beyond any distance, for example beyond roadways between two buildings. If it could, it might be possible to use any applications for purpose of LAN use between two or mote sites.

    ...

    Then you need any other solution. Fortunately, the cost to connect a site to the Internet is very cheap today. You can keep connection two or more sites to the Internet easily. Then if you install SoftEther VPN on each site, you can connect each segment of all sites mutually in order to build a single Ethernet segment. Before you establish the VPN tunnel, every site's network has its own Ethernet segment. Every segment is separated completely and mutually. After the VPN tunnel has been established, however, every segment is combined together and then unites to the single segment. After that, you can run any protocols between every remote site, crossing the physical distance. You can use this technique to both purposes of remote accessing and site-to-site connections.

    ...

    Ethernet switch, as known as Hub or Layer-2 Switch, is a device to exchange packets between Ethernet hosts. A switch has a FDB (Forwarding Database) inside itself in order to determine the appropriate destination port of outgoing for a packet which came from incoming port. This behavior is called as "Switching" as a major function of switches.

    Ethernet network cable, as known as Cat5e or Cat6 Copper Cable, is a device to connect between Ethernet devices, such as Ethernet switches and Ethernet adapters. Ethernet Adapters are also called "NIC (Network Interface Card)" and placed on computer. Nowadays a computer has an Ethernet adapter on its board. It is called "Onboard" . You know that you can insert more adapters on PCI or USB bus of the computer if you need.

    SoftEther VPN virtualizes Ethernet switch and emulate it. The virtual Ethernet switch is called "Virtual Hub" in the software. And SoftEther VPN virtualizes Ethernet adapter and emulate it. The virtual Ethernet adapter is called "Virtual Network Adapter" in the software. SoftEther VPN also virtualizes Ethernet network cable and emulates it. The virtual Ethernet network cable is called "VPN Session" or "VPN Tunnel" in the software.

    Above three elements are important to understand SoftEther VPN. For example, when you want to build a remote access VPN in order to accept VPN connections from remote site to the company LAN, you will create a Virtual Hub on the VPN Server in the company LAN. That Virtual Hub constructs an Ethernet segment. And you connect both the Virtual Hub and the physical network adapter on the server computer mutually. Then both segments of the Virtual Hub and the existing physical LAN are now combined and united as the single Ethernet segment. And you will installVPN Client software on the remote client PC, for instance, laptop PC. VPN Client software can create a Virtual Network Adapter on the client PC. You will create a connection setting in order to connect the VPN Client to the Virtual Hub on the VPN Server in your company. When you ignite the connection, a new VPN Session will be established between the Virtual Network Adapter and the Virtual Hub. This situation is very similar that you attach the one-side of an Ethernet cable to the physical Hub and the other-side to the physical Ethernet adapter on the computer. Not only similar, but it is also exactly same in the logical aspect of behavior of Ethernet. After you established the VPN connection, you can send and receive any protocols suitable for Ethernet. All packets are transmitted on the virtual cable, as called as VPN Session or VPN Tunnel.

    After once you understood the architecture of realizing method of SoftEther VPN, you will be able to understand that the potential possibilities for range of use of SoftEther VPN is almost infinite. The above example show you the way to construct a remote access VPN, but you can apply this way to make any other form of VPN. It is very easy to build a site-to-site VPN. Only difference to remote access VPN is the opposite ends from the VPN Server is not a VPN Client but a VPN Bridge.

    ...

    Current version

    This revision modified by seoss (Ban)

    ...

    As you know, Ethernet is a technology for using on LANs (Local Area Networks). Ethernet is very convenient and reliable standard in order to connect several computers together. With Ethernet, you can enjoy many network programs such as file sharing, printer sharing and accessing amounts of data on RDBMS (Relational Database Management Systems). Today there are no companies who have no LANs with Ethernet in their office.

    Standard formation of Ethernet-using network is hub-and-spoke model. There are hubs (as know as Ethernet switches) central and each computer has a cable to the hub. Then all computers can communicate mutually. The advantage of Ethernet is that you can understand the model very easily. This is a certain reason why Ethernet has been spread the world. Computers and hubs connected in order to enable them free communication consists an Ethernet Segment. It is also called as "Layer-2 Segment" or "Broadcast Domain" .

    ...

    But you cannot use Ethernet beyond the walls of an office or building. Normally, you know you can connect computers together only in a room or a building. But you cannot make a computer on site-A communicate with another computer on site-B with only Ethernet. The reason why you cannot is that Ethernet needs wired Ethernet network cables to connect between devices. Network cables can be laid only in the building. You cannot lay the cable between the separated two or more buildings, because you cannot place any cables across the road. Of course there are other limitations of Ethernet, for example maximum distance of cable. And these limitations cannot be solved by using other physical media as extensions of Ethernet lately invented, such as Wi-Fi and optical cables.

    "Ethernet" is totally different to "Internet". The Internet is the interconnected network of a lot of private networks and ISPs joined together. It is certain that we can pay ISPs inexpensive money to enjoy the connection to the Internet. You can connect both offices of Tokyo and Beijing to the Internet. And computers on each office can now access to the Internet. But still you cannot enjoy any software written for LAN internal use between two sites, even if they are connected by Internet connections. What you can do are only as follows; for example, to exchange emails, to use Skype and Messenger software in order to exchange short messages or voices, and to access the same groupware to exchange schedules and so on. You can do these things if you have two sites and both sites have each Internet connection. But you cannot enjoy any other profits which are came from software for LAN, for example file sharing, print sharing, database protocols, CRMs, ERPs, and other applications which are developed for specified purposes. Again, Ethernet is not Internet. Internet cannot become alternative to Ethernet. Even if you connect both sites to the Internet, two sites don't construct the single Ethernet segment at all. If you want to use application for LAN, you must construct a single Ethernet segment to surround every your computers.

    ...

    By now you understand the advantages of Ethernet and the difference between Ethernet and Internet, and also the limitation which is came from the difference. But you probably wonder if an Ethernet segment can be extended to other sites beyond any distance, for example beyond roadways between two buildings. If it could, it might be possible to use any applications for purpose of LAN use between two or mote sites.

    ...

    Then you need any other solution. Fortunately, the cost to connect a site to the Internet is very cheap today. You can keep connection two or more sites to the Internet easily. Then if you install SoftEther VPN on each site, you can connect each segment of all sites mutually in order to build a single Ethernet segment. Before you establish the VPN tunnel, every site's network has its own Ethernet segment. Every segment is separated completely from every other segment. After the VPN tunnel has been established, however, every segment is combined together and unites them into a 'virtual' single segment. After that, you can run any protocols between every remote site regardless of the physical distance. You can use this technique for both purposes of remote accessing and site-to-site connections.

    ...

    An Ethernet switch, also known as Hub or Layer-2 Switch, is a device to exchange packets between Ethernet hosts. A switch has a FDB (Forwarding Database) inside itself in order to determine the appropriate destination port of outgoing for a packet which came from incoming port. This behavior is called as "Switching", a major function of switches.

    Ethernet network cable, as known as Cat5e or Cat6 Copper Cable, is a device to connect between Ethernet devices, such as Ethernet switches and Ethernet adapters. Ethernet Adapters are also called "NIC (Network Interface Card)" and placed on computer. Nowadays a computer usually has an Ethernet adapter built into its motherboard ("Onboard" adapter) . Additional adapters can be inserted onto the PCI or USB bus of the computer if needed.

    SoftEther VPN virtualizes Ethernet switching and emulates it. The virtual Ethernet switch is called "Virtual Hub" in the software. And SoftEther VPN virtualizes Ethernet adapter and emulate it. The virtual Ethernet adapter is called "Virtual Network Adapter" in the software. SoftEther VPN also virtualizes Ethernet network cable and emulates it. The virtual Ethernet network cable is called "VPN Session" or "VPN Tunnel" in the software.

    Above three elements are important to understand SoftEther VPN. For example, when you want to build a remote access VPN in order to accept VPN connections from remote site to the company LAN, you will create a Virtual Hub on the VPN Server in the company LAN. That Virtual Hub constructs an Ethernet segment. And you connect together both the Virtual Hub and the physical network adapter on the server computer. Then both segments of the Virtual Hub and the existing physical LAN are now combined and united as the single Ethernet segment. VPN Client software is then installed on the remote client PCs, for instance, a laptop PC. VPN Client software can create a Virtual Network Adapter on the client PC. You will create a connection setting in order to connect the VPN Client to the Virtual Hub on the VPN Server in your company. When you initiate the connection, a new VPN Session will be established between the Virtual Network Adapter and the Virtual Hub. This situation is very similar to that when you attach the one end of an Ethernet cable to the physical Hub and the otherend to the physical Ethernet adapter on the computer. From a functional and logical perspective, it is identical to a physical Ethernet connection. After you established the VPN connection, you can send and receive any protocols suitable for Ethernet. All packets are transmitted on the virtual cable, as called as VPN Session or VPN Tunnel.

    Once you understood the architecture of using SoftEther VPN, you will also be able to understand that the potential possibilities for range of use of SoftEther VPN is almost infinite. The above example shows you the way to construct a remote access VPN, but you can apply the technique to make any other form of VPN. It is very easy to build a site-to-site VPN. The only difference to remote access VPN is the opposite end from the VPN Server is not a VPN Client but a VPN Bridge.

    ...