Virtual Private Networks, Cloud Computing and Network Design

Why a VPN exists. A worker in a café needs to reach the company's file server as if sitting in the office, but the path runs over the public internet, where any intermediate node can read unencrypted traffic. A virtual private network builds a tunnel: the original packet is encrypted, then wrapped inside a new packet addressed to the VPN server at the edge of the company network (encapsulation). An eavesdropper sees only that traffic is flowing between the laptop and the VPN server. At the far end the outer packet is stripped, the inner packet decrypted and delivered inside the private network. Three technologies make this work: tunnelling (encapsulation), encryption of the payload, and authentication of both ends so that the server accepts only genuine users and the client cannot be lured to a fake server. Companies also use VPNs to join branch offices into one private network over public lines instead of leasing dedicated circuits.

What a VPN does not do. It protects the path, not the endpoints: a laptop infected with malware carries the malware into the company network through a perfectly secure tunnel, which is why VPN access is usually combined with endpoint checks. It adds latency and processing overhead, and a consumer VPN merely moves the point of trust from the café's network to the VPN provider.

Cloud computing. Instead of owning servers, an organisation rents computing from a provider over the internet. A public cloud shares the provider's infrastructure among many customers: pay per use, instant scaling, no upfront purchase or maintenance, but data lives in the provider's data centres, possibly in another country, under the provider's security. A private cloud applies the same virtualisation and automatic provisioning to servers the organisation owns: full control and easier legal compliance, but capital cost and scaling limited by the hardware already bought. A hybrid cloud keeps sensitive data private and lets peak load overflow to the public cloud — a retailer's product pages on the public cloud at holiday peaks, its customer records private — at the price of the most complex operation and security. Evaluation always turns on four questions: what data, what law, how variable the load, and whether the organisation has technical staff.

Designing a network. A design question gives an organisation and asks for hardware, media, topology and security with justification. Work from constraints: distances decide copper versus fibre; mobility decides wireless; the number of devices and traffic pattern decide switch layout and where bandwidth must be highest; the boundary with the internet decides where the router and firewall go; separate subnets or VLANs keep student traffic away from servers; and redundancy — two links, a second switch — is justified where downtime costs more than the extra hardware. A justified design with a diagram scores; a list of expensive equipment does not.