Reliable Virtual Private Networks with MASQUE

Abstract

Providing secure and reliable end-to-end connectivity for distributed applications in wide area networks remains a major challenge. However, the support for reliability mechanisms in common virtual private network (VPN) solutions is limited. In our work, we investigate retransmissions, forward error correction (FEC), multipath connections, and overlay networks to improve VPN reliability. In this context, we showcase the specific potentials and limitations of these mechanisms. Our MASQUE-based VPN prototype, implements these reliability measures. We conduct a measurement campaign to assess the behavior of various configurations under different path impairments. As a baseline comparison, we include the common VPN solutions WireGuard and OpenVPN and evaluate throughput, end-to-end loss, and one-way delay. MASQUE uses congestion control also in the unreliable mode, which can lead to problems when the available bandwidth is misjudged. Retransmissions eliminate end-to-end loss but introduce significant long-tail delay. With FEC-based recovery, the long-tail delay is decreased. Multipath VPNs improve resilience in deteriorated network conditions. Further, we nest multipath MASQUE connections and form overlay networks. They increase path diversity, and, hence, circumvent unreliable path segments.