Geode Cities

Rooms

Settings

Table of Contents

< Chapter 16

Chapter 17 - Tunnels

Alrighty, so after Proxies we get to Tunnels. Tunnels are when you use higher level networks to transmit data formatted for lower level networks. For example, sending Ethernet frames across TCP packets. Putting Ethernet frames as the data payloads of TCP packets is backwards according to the traditional model; usually, TCP packets go inside the data payload of an Ethernet frame. The backwards layering is more or less what makes it a tunnel.

Typically, you use this tunneling technique alongside bridging in order to reach into networks that you wouldn't be able to get to otherwise. In the same way that you might use a serial modem to call up a Bridge to access an Ethernet network somewhere, you could use Tunneling to make a TCP connection to a Bridge to access an Ethernet network somewhere.

Setting up a Tunnel is usually done to access devices which themselves either can't talk Internet Protocol, can talk Internet Protocol but don't have appropriate access controls (i.e. you can't set a password on it), or it can talk Internet Protocol but it is inside a firewalled network where the administrator does not want to set up access rules individually for every device on the network. Certainly, having a single password on the tunnel is much easier to administrate than trying to put passwords and firewall rules on every single individual device.

The model of giving every individual device/service its own credential system actually caught on during the COVID pandemic when they sent everyone to work from home. It had existed before in different forms, like requiring everyone to enter a username and password individually on each service, but it was a real PITA for users to have to keep signing in every time. Instead, a new management technique called "SSO" Single Sign-On was deployed for a ton of people, where they only have to sign into their company portal one time and then that authentication token becomes valid for all the other devices/services that they want to connect to so they don't have to sign in a second time.

For example, let's say I want to print to your printer from this Internet Cafe I'm sitting at. You originally secured your printer by adding a firewall rule that rejected everyone's IP address except for mine. However, because I'm at the Internet Cafe, my IP address is different. My laptop has connected to this public Wi-Fi and so my laptop has an IP address belonging to the Cafe now instead of an IP address belonging to me/my home network. When I go to print my sensitive document pages, I get a "connection request rejected" error from your firewall. Your printer doesn't support putting a password on the print queue, so you don't want to open up the firewall to let just anybody print. Instead, you install a Tunneling server on your PC, put a password on that, and give me the password.

Now if I want to print, I can connect by TCP to the tunnel, fill in the password you gave, and then use that link to connect to your Ethernet network like I was really there. My laptop will get a new IP address on a new "tunnel interface" which shows up in the network settings the same way its Wi-Fi adapter and Ethernet jack would look. Then I can use that interface to send an Ethernet frame across the tunnel and the bridge to the inside of your network. After the connection has been established and the passwords given and all that, the Ethernet frame could look like this:

The tunneling server running on Alisa's PC takes the tunneling IP packet and un-packages the inner Ethernet frame then bridges that frame over to the Ethernet interface (pushing the raw data onto the Ethernet network without modifying it).

Similarly, if Alisa's PC receives an Ethernet frame sent back by the printer, it will package that frame up as a TCP response packet back to g's PC's address at the Coffee Shop.

Chapter 18 >