Skip to content

RTFM · Networking

VPN networking

A VPN is an encrypted tunnel plus a routing and firewall design. It is not merely a magic way to log into one hidden host.

Saphira Linux dragon mascot

What a VPN actually does

A VPN creates an interface and cryptographic relationship between endpoints. Routes decide which packets enter it. Firewall rules decide what can cross it. DNS determines which names resolve to private addresses. A working handshake alone does not prove that a subnet is reachable.

  • Remote access connects a laptop or phone to selected private networks.
  • Site-to-site connects network prefixes at two locations.
  • A management-only VPN carries SSH, monitoring, backups, and administration.
  • A full tunnel sends most client traffic through the VPN; split tunnel sends only selected prefixes.

Saphira package reality

The current package catalogue contains wireguard-tools. It also contains nftables, dhcpcd, dnsmasq, freeradius, haproxy, and openvswitch. No matching OpenVPN package was found in the current catalogue, so these pages do not present OpenVPN as a shipped Saphira implementation. Kernel support, package contents, and service integration must still be checked on the target image.

VPN and public services

Keep MailDragon and webDragon public listeners on the public edge. Keep management, databases, internal DNS, and private application traffic on the VPN or management VLAN. HAProxy exposes selected services; VPN routing joins private networks. A business can and often should use both.