cyber deal
RouterOS v7 Advanced Security Book
Study material for the MTCSE Certification Course, updated to RouterOS v7
$19,97
Add to cart
MikroTik IPSec: Choose between Tunnel Mode and Transport Mode for VPN
- Kevin Moran
- No comments
- Share this article
Facebook
Twitter
LinkedIn
WhatsApp
Telegram
At Mikrotik, the tunnel mode and transport mode They are two different modes of operation for IPsec VPN connections.
tunnel mode
In tunnel mode, all traffic passing through the VPN interface is encapsulated in an IPsec packet. This means that traffic is encrypted and decrypted on both ends of the VPN connection.
Tunnel mode is the most secure configuration for VPN connections, as it protects all traffic, regardless of its protocol or application. However, it is also the most resource-demanding configuration, as it requires all packets to be encapsulated and decapsulated. In this mode the entire IP packet is encrypted and becomes the data component of a new (and larger) IP packet.
Frequently used in an Ipsec site-to-site VPN
In transport mode, only data that is transmitted between two specific hosts is encapsulated in an IPsec packet. This means that traffic that is not directed to specific hosts is not encrypted or decrypted.
Transport mode is less secure than tunnel mode, as it does not protect all traffic. However, it is also less demanding in terms of resources, as it only requires that packets be encapsulated and deencapsulated when transmitted between specific hosts.
Transport Mode Features
- IPsec header is inserted into the IP packet
- No new package is created
- Works well on networks where increasing the size of a packet could cause a problem
Frequently used for remote access VPNs
Key differences
The following table summarizes the key differences between tunnel mode and transport mode:
Feature | tunnel mode | mode of transport |
Security | High | Low |
Resource requirement | High | Low |
Encapsulation | All traffic | Only traffic between specific hosts |
Choosing the correct mode
Choosing the correct mode for an IPsec VPN connection depends on the security and performance needs of the application.
If security is the top priority, tunnel mode is the best option. If performance is the main priority, transport mode is a good option.
In general, tunnel mode is the best choice for VPN connections that require a high level of security, such as connections used to access sensitive data. Transport mode is a good choice for VPN connections that require good performance, such as connections used to transmit high-speed data.
Types of tunnels that work with IPSec
Tunnel type | Description |
Site-to-Site IPsec Tunnel | Securely connect two separate networks over the Internet. Allows secure communication between the subnets of the two locations. |
Remote Access IPsec VPN | Allows remote users to securely connect to the office network from external locations. It uses IPsec to secure the connection and can be implemented with different VPN protocols such as L2TP/IPsec or IKEv2/IPsec. |
L2TP/IPsec tunnel | Combines L2TP (Layer 2 Tunneling Protocol) with IPsec to create a secure tunnel. Often used for remote access connections. |
IKEv2/IPsec tunnel | It uses the IKEv2 (Internet Key Exchange version 2) protocol for security and key exchange, combined with IPsec for data protection. It offers a more efficient and robust configuration compared to IKEv1. |
EoIP/IPsec tunnel | It allows the creation of an Ethernet over IP (EoIP) tunnel and is then secured using IPsec to provide security. Useful for extending an Ethernet network over the Internet safely. |
IPIP | It allows the creation of an IPIP and is then secured using IPsec to provide security. |
Common features
All IPsec tunnels in MikroTik use the following elements:
- IPsec interface: A virtual interface used to encapsulate IPsec traffic.
- Security parameters: Security parameters, such as encryption algorithm and key, are used to protect data transmitted through the tunnel.
- Firewall rules: Firewall rules allow IPsec traffic to be transmitted through the tunnel.
Choice of tunnel type
The type of IPsec tunnel to choose depends on the specific needs of the application.
- Site-to-Site IPsec Tunnel: This type of tunnel is suitable for connecting two separate networks over the Internet.
- Remote Access IPsec VPN: This type of tunnel is suitable for allowing remote users to securely connect to the office network from external locations.
- L2TP/IPsec Tunnel: This type of tunnel is suitable for remote access connections that require support for the L2TP protocol.
- IKEv2/IPsec Tunnel: This type of tunnel is suitable for remote access connections that require a more efficient and robust configuration.
- EoIP/IPsec Tunnel: This type of tunnel is suitable for extending an Ethernet network over the Internet securely.
- IPIP: This type of tunnel is suitable for providing security to an existing IPIP tunnel.
Brief knowledge quiz
What do you think of this article?
Do you dare to evaluate your learned knowledge?
Recommended book for this article
Related Posts
Related Posts
Microlabs
(ML-001) How to properly manage multiple public or private IPs on the edge router
$8,99
(ML-002) Ways to assign public IP addresses to clients with MikroTik
$9,99
(ML-003) Guide to configure Internet exit routes with two or more providers (failover and recursion in PCC balancing)
$8,99
(ML-004) Filter implementation strategies to restrict access to web pages with MikroTik
$7,99
Other topics that may interest you
Ways to Assign IPv6 Addressing (Part 2)
March 25th, 2024
WireGuard on MikroTik RouterOS: A Secure and Efficient VPN Solution
March 13th, 2024
Ways to Assign IPv6 Addressing (Part 1)
March 11th, 2024
Do you want to suggest a topic?
Every week we post new content. Do you want us to talk about something specific?
Upcoming online courses
MTCINE OnLine
$187,00
MTCNA Online
$187,00
MTCRE Online
$187,00
Pack 4 MikroTik RouterOS books
$68,47
