2.1 Client VPN Configuration 2 Virtual Private Networks due to NAT traversal constraints). The main contribution of this paper is the design and evaluation of a novel struc- tured P2P VPN overlay architecture. While many of the individual components of our solution are not novel in and of themselves, the integration of these components and their interaction results in a unique system. The rest of this paper is organized as follows. Sec- tion 2 gives an overview of current VPN technologies. Section 3 provides background on P2P systems. Sec- tion 4 describes the techniques used to create structured P2P VPNs. In Section 5, we present evaluation compar- ing our system with other VPNs. Our experience devel- oping, using, and debugging the system is discussed in Section 6. Section 7 discusses related works, while Sec- tion 8 presents concluding remarks. There exist many different flavors of virtual networking. This paper focuses on those that are used to create or ex- tend a virtual layer 3 network, of which there are many types as summarized in Table 1. A brief survey of popu- lar VPNs comprising different configurations is summa- rized in Table 2. This section overviews core features of VPN designs, beginning with client configuration of VPNs, followed by an analysis of different VPN server configurations as highlighted in Table 1. In Figure 1, we abstract the common features of all VPNs clients. The key components of a client machine are 1) client software that communicates with the VPN overlay and 2) a virtual network (VN) device. During initialization, the VPN software starts by authenticat- ing with an overlay or VPN agent. Then, optionally, it queries the agent for information about the network, such as the network address space, and finally the VN device is started enabling secure communication amongst par- ticipants. There are many different mechanisms for communi- cating with an overlay agent. For quick setup, a sys- tem may require no authentication or use a shared secret such as a key or password. Using accounts and pass- words with or without a shared secret provides individu- alized authentication, allowing an administrator to block all users if the shared secret is compromised or individ- ual users if they act maliciously. For the strongest level of security, each client can be configured to have a unique signed certificate that makes brute force attacks very dif- ficult. The trade-offs come in terms of usability and man- agement. While the use of signed certificates provides better security than shared secrets, it can be more diffi- cult to set up and use. In a system comprising of non- experts, the typical setup includes the use of a shared se- cret and individual user accounts, where the shared secret is included with the installation of the VPN application which is distributed from a secured site. To communicate over the VPN transparently, a system must have a VN device driver, which provides the mech- anisms to inject incoming packets and retrieve outgoing packets from the networking stack, enabling the use of Figure 1: A typical VPN client. The VPN uses a VN device to make interaction over the VPN transparent. Packets going to VPN destinations are directed towards the VN device, which interfaces the VPN client. The VPN client in turn sends and receives packets over the hosts physical network device. Table 1: VPN Classifications Type Description Centralized Clients communicate through one or more servers which are statically configured Centralized Servers / P2P Clients Servers provide authentication, ses- sion management, and optionally relay traffic; peers may communi- cate directly with each other via P2P links if NAT traversal succeeds Decentralized Servers and Clients No distinction between clients and servers; each member in the sys- tem authenticates directly with each other; links between members must be explicitly defined Unstructured P2P No distinction between clients and servers; members either know the entire network or use broadcast to discover routes between each other Structured P2P No distinction between clients and servers; members are usually within O (log N ) hops of each other via a greedy routing algorithm; use dis- tributed data store for discovery 2