content_image/388627.jpg
<img src='content_image/388627.jpg'>

“find successor”. After establishing a connection with the owner of that key, the owner needs to query for its value, which would be the node ID of the node own- ing the virtual IP. After executing “find successor” and retrieving the destination nodes physical IP address, the VPN can “connect” to the remote node using either a UDP or TCP socket. Virtual IP messages would then be sent and received through this “connection”. Unlike our system, NChord does not support sending messages through the overlay, thus a separate “connection” for ap- plication purposes will need to be created. 

FreePastry begins by looking up the mapping of vir- tual IP to node ID in PAST. To form a connection through overlay, the VPN client would use “route” to send pack- ets and “deliver” to receive incoming packets. In fact, the model is very similar to Brunet. Furthermore, FreePas- try has knowledge of proximity in shortcuts, so it may be very easy to apply high-performance autonomic relays in pastry potentially reusing some of their work from ePost [29]. FreePastry does not form shortcuts based upon communication demands, so if two peers were ac- tively communicating, they may always have to route traffic over the overlay, which in most cases will be sig- nificantly slower than if they were directly connected. Though one could argue that since FreePastry does not support NAT traversal, all nodes will already be public and thus an application, as in the NChord example, could form a direct connection bypassing the overlay. 

## 8 Conclusions 

This paper presents a novel VPN approach that has been designed from the ground up to facilitate ease of use while maintaining a reasonable level of security. At the core of the VPN is a structured P2P system that provides decentralized peer discovery, NAT traversal, relays, full tunnel clients and gateways, and secure point-to-point (PtP) and end-to-end (EtE) links. In the paper, we focus primarily on relays, full tunnels, and group security. The relay seekers can use arbitrary information, such as con- nection age or latency, to assist in finding suitable over- 

lap. With overlap sets formed, relays will be created au- tomatically using an existing infrastructure. We present a novel method for client-side full tunneling that works in P2P and provides a level of security not present in prior works by ensuring that only secure data is transmitted over the LAN. The PtP and EtE links are secured via a group system using a partially automated PKI with an in- tuitive web interface, which can be hosted by a group or they may use our public system [40]. 

Through the use of the group interface, users can cre- ate their own VPNs with private P2P pools while using public pools as a bootstrap. Users are able to join the system by downloading a stock VPN and loading it with their user specific configuration or binary blob. The VPN will automatically connect to the appropriate web server and both parties will verify each other’s authenticity. The user is then quickly connected to the VPN. Administra- tors are able to police the system through the web inter- face and offending users are eventually removed from the system through one of the following mechanisms: CRL, DHT events, and broadcast messages. 

The paper introduces many new interesting research problems: 1) distributed load balancing of full tunnel gateways, 2) understanding the long term effects of dif- ferent automatic relay selection models, 3) understand- ing the benefits beyond security of using a private over- lay for a VPN. We believe that this work provides both a position and a model on how to design VPNs. 

## References 

[1] RobotCA. http://www.wlug.org.nz/RobotCA , October 2005. 

[2] Amazon elastic compute cloud. http://aws.amazon.com/ec2 , 2009. 

[3] A. Bavier, N. Feamster, M. Huang, L. Peterson, and J. Rexford. In VINI veritas: realistic and controlled net- work experimentation. In In SIGCOMM’06 , 2006. 

[4] P. O. Boykin and et al. A symphony conducted by brunet, 2007. 

[5] M. Castro, M. Costa, and A. Rowstron. Debunking some myths about structured and unstructured overlays. In 

