VPN 技术#

flowchart LR
    subgraph 传统网络
        A1[远程用户] -->|公网| A2[防火墙]
        A2 --> A3[内网服务器]
    end
    
    subgraph VPN 网络
        B1[远程用户] -->|加密隧道| B2[VPN 服务器]
        B2 --> B3[内网服务器]
        B2 -.->|隧道加密| B4[公网传输]
    end

flowchart TD
    subgraph "原始数据包"
        IP1[IP 头] --> H1[TCP 头] --> D[数据]
    end
    
    subgraph "隧道模式"
        IP2_1[新 IP 头] --> ESP_H[ESP 头]
        ESP_H --> IP1_T[原 IP 头]
        IP1_T --> H1_T[TCP 头]
        H1_T --> D_T[数据]
        D_T --> ESP_T[ESP Trailer]
        ESP_T --> ESP_A[ESP Auth]
        style ESP_H fill:#ffcccc
        style ESP_A fill:#ffcccc
    end
    
    subgraph "传输模式"
        IP1_O[原 IP 头] --> ESP_H_O[ESP 头]
        ESP_H_O --> H1_O[TCP 头]
        H1_O --> D_O[数据]
        D_O --> ESP_T_O[ESP Trailer]
        ESP_T_O --> ESP_A_O[ESP Auth]
    end

sequenceDiagram
    participant Client
    participant VPNServer as VPN 服务器
    
    Note over Client: 第一阶段：建立 IKE SA
    Client->>VPNServer: HDR, SAi1, KEi, Ni
    VPNServer->>Client: HDR, SAr1, KEr, Nr, {IDir, Cert, [Certreq,]} SK {IDir, Cert, [Certreq,]} SK {Auth, ...}
    
    Note over Client: 第二阶段：建立 IPsec SA
    Client->>VPNServer: HDR, SK {IDi, IDr, <NonceNi, SAi2, TSi, TSr>}
    VPNServer->>Client: HDR, SK {IDi, IDr, <NonceNr, SAr2, TSi, TSr>}
    
    Note over Client: 隧道建立完成
    Client->>VPNServer: ESP 加密流量

flowchart TD
    A[用户设备] -->|HTTPS/SSL| B[SSL VPN 网关]
    B --> C{访问模式}
    
    C -->|Web 代理模式| D[Web 应用]
    C -->|端口转发| E[TCP 应用]
    C -->|隧道模式| F[全网访问]
    
    style B fill:#ffcccc