Secure VPN Tunnel

A Python-based VPN prototype that creates encrypted tunnels between two endpoints using AES-256-GCM encryption and custom packet protocols.

🚀 Features

• Strong Encryption: AES-256-GCM with PBKDF2 key derivation
• Custom Protocol: Structured packets with sequence numbers and flags
• Performance Analysis: Real-time throughput and encryption timing statistics
• Multi-client Support: Server handles multiple concurrent connections
• Cross-platform: Works on Windows, Linux, and macOS
• Network Flexible: Local, LAN, or Internet deployment

🛠️ Installation

Prerequisites

• Python 3.7+
• pip (Python package installer)

Setup

1. Clone the repository:

git clone https://github.com/YOUR_USERNAME/secure-vpn-tunnel.git
cd secure-vpn-tunnel

2. Create and activate virtual environment:

# Windows
python -m venv .venv
.venv\Scripts\activate

# Linux/macOS  
python3 -m venv .venv
source .venv/bin/activate

3. Install dependencies:

pip install -r requirements.txt

🚀 Quick Start

Local Testing

Terminal 1 (Server):

python vpn_tunnel.py --mode server --port 8080

Terminal 2 (Client):

python vpn_tunnel.py --mode client --host localhost --port 8080

Network/Internet Usage

Server (Your Computer):

python vpn_tunnel.py --mode server --host 0.0.0.0 --port 8080 --password "YourStrongPassword123"

Client (Friend's Computer):

python vpn_tunnel.py --mode client --host YOUR_PUBLIC_IP --port 8080 --password "YourStrongPassword123"

📖 Usage Examples

Basic Commands

# Start server with custom settings
python vpn_tunnel.py --mode server --host 0.0.0.0 --port 9999 --password "mySecretKey"

# Connect client with timeout
python vpn_tunnel.py --mode client --host 192.168.1.100 --port 9999 --password "mySecretKey"

# Disable TLS (custom encryption only)
python vpn_tunnel.py --mode server --no-tls

Performance Testing

The client automatically sends test messages and displays performance statistics:

• Throughput (bytes/second)
• Encryption/decryption timing
• Packet loss monitoring
• Connection quality metrics

🔧 Configuration Options

Parameter	Description	Default
--mode	server or client	Required
--host	Server hostname/IP	localhost
--port	Server port	8080
--password	Encryption password	CHANGE_THIS_PASSWORD
--no-tls	Disable TLS layer	False

🏗️ Architecture

Components

• CryptoEngine: Handles AES-256-GCM encryption/decryption
• VPNPacket: Custom packet structure with headers
• VPNTunnel: Main tunnel implementation
• VPNStats: Performance monitoring and statistics

Security Features

• AES-256-GCM authenticated encryption
• PBKDF2 key derivation (100,000 iterations)
• Sequence number tracking
• Integrity verification
• TLS framework ready

📊 Performance

Typical performance on modern hardware:

• Encryption: ~0.04ms per packet
• Decryption: ~0.01ms per packet
• Throughput: Limited by network, not encryption
• Overhead: ~37 bytes per packet (headers + crypto)

🌐 Network Setup

Port Forwarding (for Internet access)

1. Log into your router admin panel
2. Forward your chosen port (e.g., 8080) to your computer's local IP
3. Use your public IP address for remote connections

Firewall Configuration

Ensure your firewall allows connections on the chosen port:

# Windows Firewall
netsh advfirewall firewall add rule name="VPN Tunnel" dir=in action=allow protocol=TCP localport=8080

# Linux ufw
sudo ufw allow 8080/tcp

🔒 Security Considerations

For Production Use

• Use strong, unique passwords (20+ characters)
• Enable TLS with proper certificates
• Implement user authentication
• Add rate limiting and DDoS protection
• Regular security audits

Network Security

• Change default ports
• Use VPN over secure networks when possible
• Monitor connection logs
• Implement IP whitelisting if needed

🛡️ Limitations

This is a prototype/educational implementation:

• Not a full VPN (doesn't route IP traffic)
• No built-in authentication system
• Basic error handling
• No connection persistence
• Self-signed certificates only

For production VPN needs, consider established solutions like OpenVPN or WireGuard.

🤝 Contributing

1. Fork the repository
2. Create a feature branch (git checkout -b feature/amazing-feature)
3. Commit your changes (git commit -m 'Add amazing feature')
4. Push to the branch (git push origin feature/amazing-feature)
5. Open a Pull Request

🙏 Acknowledgments

• Built with Python's cryptography library
• Inspired by VPN protocols like OpenVPN and WireGuard
• Educational implementation for learning network security concepts

🐛 Troubleshooting

Common Issues

"Connection refused"

• Ensure server is running first
• Check firewall settings
• Verify correct IP/port

"ModuleNotFoundError: cryptography"

• Install requirements: pip install -r requirements.txt
• Ensure virtual environment is activated

Ctrl+C doesn't stop server (Windows)

• Use Ctrl+Break instead
• Or close the terminal window
• Updated code includes better interrupt handling

Performance seems slow

• Check network latency with ping
• Monitor system resources
• Try disabling TLS for testing

---

⭐ Star this repo if you found it helpful! ⭐