VPN Gateway security

IPsec

VPN Gateway employs IPsec for secure data transmission.

IPsec (Internet Protocol Security) is a suite of protocols designed to secure network traffic by authenticating and encrypting each IP packet within a communication session. It operates at the network layer, securing data transfer over untrusted networks. IPsec provides essential security services including data confidentiality through encryption, data integrity through hashing, and authentication of data origin.

Authentication

Pre-shared keys (PSKs) are used to authenticate the VPN connections.

A PSK is a secret key that is automatically generated by the service, and configured and shared between the VPN Gateways at both ends of the connection. The PSK enables authenticating the VPN session and is a requirement to establish the VPN tunnel. Both endpoints use the shared key to authenticate one other, ensuring both are trusted parties.

Encryption and data integrity

Traffic in VPN tunnels is encrypted with AES. Each tunnel has its own algorithm settings for IKEv2 phase 1 and phase 2. A new tunnel uses these defaults:

Encryption algorithms: aes128, aes256, aes128gcm128, aes256gcm128
Integrity algorithms: sha256, sha384, sha512
Diffie-Hellman groups (DH groups): 14, 16, 18, 19, 20, 21

You can change them in the tunnel's Advanced settings in the Control Panel, or with the API. The following values are supported.

Encryption algorithms:

aes128
aes192
aes256
aes128gcm16
aes128gcm128
aes192gcm16
aes192gcm128
aes256gcm16
aes256gcm128

Integrity algorithms:

sha1
sha256
sha384
sha512
aes128gmac
aes256gmac

Phase 1 needs at least one SHA integrity algorithm. The Control Panel offers the GMAC algorithms for phase 2 only.

DH groups:

MODP

Diffie-Hellman Group 2 (1024-bit)
Diffie-Hellman Group 5 (1536-bit)
Diffie-Hellman Group 14 (2048-bit)
Diffie-Hellman Group 15 (3072-bit)
Diffie-Hellman Group 16 (4096-bit)
Diffie-Hellman Group 18 (8192-bit)
Diffie-Hellman Group 24 (2048-bit, 256-bit subgroup)

ECP (elliptic curve)

Diffie-Hellman Group 19 (256-bit)
Diffie-Hellman Group 20 (384-bit)
Diffie-Hellman Group 21 (521-bit)

Internet Key Exchange

Only IKEv2 (Internet Key Exchange) is supported. IKEv1 is not supported.

Compatible endpoints

Most VPN endpoints are compatible with UpCloud VPN service. See a list of known compatible endpoints.