The LPIC-2 exam objective 202.5 specifically tests your understanding of secure remote access. This chapter covers OpenVPN and SSH tunnelling, which are the two main ways IT professionals connect securely to remote servers and protect data sent over untrusted networks like the internet. You need to grasp these concepts to pass the exam and to understand how real-world businesses keep their data safe.
Jump to a section
A simple way to picture OpenVPN and SSH Tunneling
A postcard is a piece of paper that anyone handling it can read. When you send a postcard from a holiday, the postal worker, the sorting machine operator, and anyone else who touches it can see the message and the address. The message is not secret.
Now imagine you want to send a private message to a friend, but you can only use the public postal system. You could put that message inside a sealed envelope first. That envelope is like an SSH tunnel — it wraps your ordinary message inside a secure, encrypted wrapper. The postal workers can still see the envelope's address (the destination server), but they cannot read the letter inside. Only your friend, who has the key to open the envelope, can read it.
OpenVPN is different. It is like building a completely private postal route between two houses. Instead of sending individual envelopes through the public mail, you build a permanent, secure pipe between both houses. Anyone who wants to send a letter must use this private pipe. No one outside the pipe can see how many letters pass through or what they say. The pipe itself is the tunnel, and it protects all traffic equally, without needing to seal each letter individually.
This difference is critical: SSH creates a single secure envelope for one specific connection, while OpenVPN creates a whole secure route that multiple connections can use simultaneously.
SSH tunnelling and OpenVPN are both ways to create a secure, encrypted connection between two computers over an untrusted network, most often the internet. The core problem they solve is that data sent over the internet is vulnerable to being intercepted and read by malicious actors, a process called eavesdropping. Without encryption, anyone with the right tools on the network path between you and a server can see exactly what you are doing – passwords, emails, file contents, everything.
Let's start with SSH, which stands for Secure Shell. SSH was originally designed to let you log into a remote machine's command line securely. Think of it as a secure replacement for older, unencrypted protocols like Telnet. When you use SSH to connect to a server, all the data between your computer and that server is encrypted. This means even if someone captures the network traffic, they will see only gibberish.
SSH tunnelling, often called port forwarding, takes this a step further. Instead of just securing your shell session, it creates a secure channel that other applications can use. There are three main types of SSH tunnelling: local, remote, and dynamic. - Local port forwarding: You tell your SSH client to listen on a specific port on your local machine. When any application on your computer sends traffic to that local port, the SSH client encrypts it and sends it through the SSH tunnel to the remote server, which then forwards it to the destination service. For example, you could access a company database that is only reachable from inside the office network by tunnelling through a bastion host, which is a specially hardened server that acts as a gateway. - Remote port forwarding: This is the reverse. You create a tunnel where the remote server listens on a port. Traffic sent to that port on the remote server gets encrypted and sent back through the tunnel to your local machine. This is useful for, say, letting a colleague access a web server running on your local development machine. - Dynamic port forwarding: This creates a SOCKS proxy tunnel. Your SSH client becomes a proxy server. You configure your web browser to use the SOCKS proxy on your local machine. The browser then sends all its traffic through the SSH tunnel, and the remote server acts as the exit point for the web traffic. This makes it appear as though your web traffic is coming from the remote server's location.
OpenVPN, on the other hand, is a full Virtual Private Network (VPN) solution. Instead of creating a tunnel for one specific port or application, it creates a virtual network interface on your computer. This interface gets an IP address from the VPN server's network. All traffic that the operating system sends to this interface is automatically encrypted and sent to the OpenVPN server. The server then decrypts it and forwards it to the target network.
OpenVPN can run in two modes: tunnelling (TUN) mode and bridging (TAP) mode. In TUN mode, it creates a point-to-point IP link. It works at layer 3 of the OSI model, the network layer, meaning it routes IP packets. In TAP mode, it creates an ethernet bridge, working at layer 2. This allows non-IP protocols to be transported, which is sometimes necessary for specific legacy applications.
OpenVPN uses TLS (Transport Layer Security) for the control channel, which is how the client and server authenticate each other and exchange keys. The data channel, where actual user traffic flows, uses a cipher such as AES (Advanced Encryption Standard). The configuration is managed through server and client configuration files.
The key difference between SSH tunnelling and OpenVPN is scope. SSH tunnel is a one-off, application-specific solution. It is great for accessing a single service behind a firewall. OpenVPN is a network-wide solution, connecting entire networks to each other or providing remote access for all applications on a client machine. For the LPIC-2 exam, you need to understand how to configure both, when to use each, and the security implications of each approach.
Understanding the Need
Identify that data sent over the internet is visible to anyone on the network path. SSH tunnelling and OpenVPN solve this by encrypting the data.
Choosing the Tool
Decide between SSH tunnelling (for a specific service) and OpenVPN (for full network access). The exam tests your ability to select the correct tool for the scenario.
Configuring SSH Local Forwarding
Use the command ssh -L local_port:destination_host:destination_port user@bastion. This creates a tunnel from your local machine to the destination through the bastion.
Configuring SSH Dynamic Forwarding
Use the command ssh -D local_port user@remote. This creates a SOCKS proxy on your local machine, allowing your browser to route all traffic through the remote server.
Setting Up OpenVPN Server
Install OpenVPN, generate certificates with easy-rsa, configure the server.conf file with settings like dev tun, proto udp, ca, cert, key, dh, and server network pool. Then start the service.
Connecting OpenVPN Client
Copy the client config file, which includes remote server address, client certificate, and key. Connect using openvpn client.conf. The client receives a virtual IP and can access the remote network.
An IT professional at a mid-sized company needs to connect to an internal accounting database from a coffee shop. The database is on a private network that is not directly reachable from the internet. The company has a bastion host, a hardened Linux server, sitting in a public-facing network (a DMZ, or demilitarised zone) that is allowed to connect to the database.
The IT professional opens their terminal and uses an SSH local port forward command. They connect to the bastion host, telling it to forward traffic from a local port (say, 54321) to the database server's IP address and port (say, 192.168.1.100:5432). The command looks something like: ssh -L 54321:192.168.1.100:5432 user@bastion.company.com. - They enter their password or use an SSH key for authentication. - The SSH client creates an encrypted tunnel to the bastion host. - They then configure their database client software to connect to localhost on port 54321. - The database client sends data to this local port, which the SSH client encrypts and sends through the tunnel to the bastion host. - The bastion host decrypts the data and forwards it to the actual database server on port 5432. - Responses from the database travel the same path in reverse.
This works, but it is fiddly. Every time they need a different service, they must set up a new tunnel. A more permanent solution is to deploy an OpenVPN server inside the company's network. The IT professional installs OpenVPN on a server and generates client certificates. They then distribute the OpenVPN client configuration files to all employees. - An employee connects to the OpenVPN server, authenticating with their certificate. - The OpenVPN server assigns them a virtual IP address from the company's internal network (e.g., 10.8.0.2). - All network traffic from the employee's laptop is encrypted and sent through the VPN tunnel to the company network. - The employee can now access the database, internal web servers, and file shares as if they were sitting in the office. - The network administrator can control access through firewall rules on the OpenVPN server and through the VPN's routing table.
For the exam, you must know the configuration files. The OpenVPN server config defines the port (1194 by default), the protocol (UDP or TCP), the TLS certificates, the cipher, and the network pool for client IP addresses. The client config mirrors the server settings and includes the remote server's address. You need to know the difference between static key and TLS-based authentication, where TLS uses certificates for a more scalable and secure setup.
The LPIC-2 exam objective 202.5 covers specific commands, configuration syntax, and conceptual differences. The exam will not ask you to write a full OpenVPN config from memory, but you will be expected to recognise the correct syntax and options from a list. - SSH tunnelling options: You must know the -L, -R, and -D flags for the ssh command. They love to test your understanding of the argument syntax. For local forwarding, the format is -L local_port:destination_host:destination_port. For remote forwarding, it is -R remote_port:destination_host:destination_port. For dynamic forwarding, it is -D local_port. - A common trap question: You are asked to allow a colleague to access a web server on your local machine running on port 8080. The correct answer involves using -R 8080:localhost:8080 on the remote server. Many beginners incorrectly choose the -L flag because they see the word 'local', but the tunnel is being built from the remote side. - OpenVPN modes: You must distinguish between TUN (routed, layer 3) and TAP (bridged, layer 2) modes. The exam will test scenarios where one is more appropriate than the other. For example, if you need to transport non-IP protocols like NetBIOS, you need TAP mode. - OpenVPN configuration directives: You need to recognise directives like dev tun, proto udp, ca, cert, key, dh (Diffie-Hellman parameters), server, ifconfig, and route. They may provide a partial config and ask what the next step is, such as specifying the cipher. - Authentication: Know the difference between static key mode (pre-shared key, simpler but less scalable) and TLS mode (certificate-based, standard for production). The exam expects you to know when to use each. Static key is fine for a point-to-point link; TLS is required for multiple clients. - Security hardening: The exam tests you on securing an OpenVPN server. This includes using tls-auth or tls-crypt to protect against packet floods, setting appropriate cipher suites (AES-256-CBC is common), and disabling compression (as it can be a vector for VORACLE attacks). - File locations: You should know standard paths. OpenVPN config files are often in /etc/openvpn/. SSH configs are per-user in ~/.ssh/config or system-wide in /etc/ssh/ssh_config. - Common exam scenario: You have a remote server that can only be accessed via SSH. You need to route your web browser traffic through it to bypass a local content filter. The correct answer is dynamic port forwarding with ssh -D 8080 user@remote-server.
SSH tunnelling uses the -L flag for local forwarding, -R for remote forwarding, and -D for dynamic SOCKS proxy forwarding.
OpenVPN operates in two modes: TUN for layer 3 routing and TAP for layer 2 bridging, depending on whether you need to transport non-IP protocols.
The default UDP port for OpenVPN is 1194, which is often used to avoid TCP-over-TCP performance issues.
SSH tunnelling is best for secure, one-off access to a single service, while OpenVPN is designed for persistent network-wide access.
OpenVPN uses TLS certificates for scalable client authentication, which is preferred over static key mode for production environments with many users.
For the LPIC-2 exam, always match the SSH forwarding flag to the direction of the traffic: local means the client listens, remote means the server listens.
These come up on the exam all the time. Here's how to tell them apart.
SSH Tunnelling
Secures a single port or application at a time
Uses the SSH protocol for encryption and authentication
Best for ad-hoc, temporary access to remote services
OpenVPN
Creates a virtual network interface for all traffic
Uses TLS for control channel and symmetric cipher for data channel
Best for persistent, network-wide remote access
Local Port Forwarding (-L)
Client listens on a local port
Traffic is forwarded to a destination host reachable from the server
Used to access a service behind a firewall from your machine
Remote Port Forwarding (-R)
Server listens on a remote port
Traffic is forwarded back to a destination on your local machine
Used to expose a local service to the remote network
OpenVPN TUN Mode
Operates at layer 3 (IP routing)
Only transports IP packets
More efficient and commonly used for most VPN setups
OpenVPN TAP Mode
Operates at layer 2 (bridging)
Can transport non-IP protocols like NetBIOS
Required for certain legacy applications and network configurations
Mistake
SSH tunnelling encrypts all traffic on my computer.
Correct
SSH tunnelling only encrypts traffic that is specifically sent to the tunnel's local port. Other applications and traffic on your computer are not affected.
People see the word 'secure' in SSH and assume it protects everything, but SSH is application-specific unless you use dynamic forwarding with a proxy.
Mistake
OpenVPN and SSH use the same encryption for the data channel.
Correct
SSH uses a single encrypted channel managed by the SSH protocol. OpenVPN uses a TLS handshake for authentication and key exchange, then a separate data channel with a symmetric cipher like AES.
Both use encryption, so beginners lump them together. But the protocol design and configuration options differ significantly.
Mistake
A VPN always makes your internet faster.
Correct
A VPN adds overhead due to encryption and routing, so it typically makes your internet slower or at least no faster. It is for security, not speed.
Many consumer VPN services market themselves as speed enhancers, which creates a false expectation for enterprise IT contexts.
Mistake
Dynamic port forwarding with SSH requires the remote server to have a special proxy software installed.
Correct
Dynamic forwarding creates a SOCKS proxy on the SSH client side. The remote server only needs an SSH server running, no additional proxy software.
The term 'proxy' makes people think of dedicated proxy servers like Squid, so they assume the remote end needs special setup.
Mistake
You cannot use SSH tunnelling if the SSH server is behind NAT.
Correct
You can use remote port forwarding (-R) to punch through NAT, assuming the SSH client initiates the connection and the server is reachable from the client.
NAT is often seen as a blocker for all incoming connections, but SSH's reverse tunnelling is specifically designed to work around it.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
SSH tunnelling secures a single application's port by forwarding it through an encrypted SSH connection. A VPN like OpenVPN creates a virtual network adapter on your machine and routes all your network traffic through an encrypted tunnel to the remote network.
OpenVPN uses UDP port 1194 by default. It can be configured to use TCP on port 443 to mimic HTTPS traffic and bypass firewalls.
The -L flag enables local port forwarding. Traffic sent to a specified port on your computer is encrypted and tunnelled through the SSH connection to a destination host and port on the remote side.
The -R flag enables remote port forwarding. Traffic sent to a specified port on the remote server is tunnelled back through the SSH connection to a destination on your local machine.
The -D flag enables dynamic port forwarding, which creates a SOCKS proxy. Applications can be configured to use this proxy to route all their traffic through the SSH tunnel.
Yes, you need a machine running OpenVPN server software. The server holds the configuration and certificate authority. Clients connect to this server to access the protected network.
You've finished OpenVPN and SSH Tunneling. Continue through the LPIC-2 study guide to build a complete picture of the exam.
Done with this chapter?