<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-vpn-traffic
description: >-
  Analyze VPN tunnel traffic for security issues including configuration weaknesses, tunnel leaks, split tunneling risks, and anomalous usage patterns in IPsec, WireGuard, and OpenVPN deployments.
domain: cybersecurity
subdomain: network-security
tags:
  - vpn
  - ipsec
  - wireguard
  - openvpn
  - tunnel-analysis
  - split-tunneling
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1572", "T1090"]
  nist-csf: ["PR.AC-3", "PR.DS-2", "DE.CM-1"]
  uuid: 086359dd-9185-4451-9909-59f9b913e7b8
---

# Analyzing VPN Traffic

## Overview

VPN security extends beyond encryption — it includes configuration hardening, tunnel integrity
verification, split-tunnel risk assessment, and monitoring for anomalous usage. This skill covers
analyzing IPsec, WireGuard, and OpenVPN deployments for misconfigurations, detecting VPN tunnel
abuse, and auditing cipher/authentication settings.

Mode: `[MODE: BLUE]` for audit; `[MODE: ARCHITECT]` for VPN design.

## Prerequisites

| Requirement | Details |
|---|---|
| Access to VPN server configuration files | Required |
| Network capture capability (tcpdump/tshark) | Required |
| strongSwan (IPsec), WireGuard, or OpenVPN installed | Required |
| Understanding of IKE, ESP, and tunnel modes | Required |
| VPN server logs access | Required |

## Key Concepts

### VPN Configuration Audit

```bash
# OpenVPN — check for weak settings
grep -E "(cipher|auth|tls-cipher|proto)" /etc/openvpn/server.conf
# Ensure: cipher AES-256-GCM, auth SHA256+, tls-cipher TLS-ECDHE-*
# Red flags: BF-CBC, DES, MD5, proto udp without tls-auth

# WireGuard — verify configuration
wg show
# Check: endpoint IPs, allowed IPs (split vs full tunnel), handshake recency

# IPsec (strongSwan) — verify IKE/ESP settings
cat /etc/ipsec.conf
# Ensure: ike=aes256gcm16-sha384-ecp384!, esp=aes256gcm16-sha384!
# Red flags: 3des, md5, modp1024 (DH group 2)
```

### Tunnel Traffic Analysis

```bash
# Capture VPN tunnel interface
tcpdump -i tun0 -w vpn_traffic.pcap -s 0

# Wireshark filters for VPN protocols
# IKE negotiation
udp.port == 500 or udp.port == 4500

# ESP encrypted traffic
esp

# WireGuard
udp.port == 51820

# OpenVPN
udp.port == 1194 or tcp.port == 1194
```

### VPN Leak Detection

```bash
# Check for DNS leaks (queries outside tunnel)
tcpdump -i eth0 port 53 -n  # Should see NO DNS if full tunnel

# Check for WebRTC/IPv6 leaks
tcpdump -i eth0 ip6 -n  # IPv6 bypassing tunnel

# Verify all traffic goes through tunnel
ip route show
# Default route should be via tun0/wg0
```

### Suricata VPN Detection Rules

```yaml
# Detect unauthorized VPN tunnels
alert udp any any -> $EXTERNAL_NET 1194 (msg:"Unauthorized OpenVPN detected"; \
  content:"|00 0e|"; depth:2; \
  sid:7000001; rev:1;)

# Detect WireGuard on non-standard port
alert udp any any -> $EXTERNAL_NET !51820 (msg:"WireGuard on non-standard port"; \
  content:"|01 00 00 00|"; depth:4; \
  sid:7000002; rev:1;)
```

## Workflow

### Step 1: Configuration Audit

```bash
# Audit OpenVPN
grep -nE "(cipher|auth|tls-version|proto)" /etc/openvpn/*.conf

# Audit WireGuard
wg show all
```

### Step 2: Tunnel Integrity Check

```bash
# Verify no traffic leaks outside tunnel
tcpdump -i eth0 -c 100 not port 51820 and not arp -n
# Should only see VPN-encapsulated traffic
```

### Step 3: Usage Analysis

```bash
# OpenVPN connected clients
cat /var/log/openvpn/status.log

# WireGuard peer status
wg show | grep -E "(peer|latest handshake|transfer)"
```

### Step 4: Monitor for Anomalies

Watch for unusual data volumes, connections from unexpected locations, or off-hours usage.

## Detection

```yaml
title: Vpn Traffic Detection
id: b20f1c20-37f5-4ff1-afc6-a3edc1d067d7
status: experimental
description: Detects suspicious activity related to analyzing vpn traffic techniques in network security context
logsource:
  category: firewall
  product: linux
detection:
  selection:
    Action: blocked
  condition: selection
level: medium
tags:
  - attack.t1572
  - attack.t1090
  - attack.command_and_control
falsepositives:
  - Network monitoring tools performing scheduled connectivity checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Vpn Traffic Detection | linux/firewall | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1572, T1090 |

## Verification

- [ ] VPN uses strong cipher suites (AES-256-GCM, ChaCha20-Poly1305)
- [ ] Perfect Forward Secrecy enabled (ECDHE/DHE)
- [ ] No DNS leaks detected outside tunnel
- [ ] Split tunneling disabled or justified and documented
- [ ] VPN logs forwarded to SIEM
- [ ] Certificate-based authentication preferred over PSK
- [ ] MFA enforced for VPN connections
- [ ] Dead peer detection / keepalive configured

## References

- [WireGuard Documentation](https://www.wireguard.com/)
- [OpenVPN Hardening Guide](https://community.openvpn.net/openvpn/wiki/Hardening)
- NIST SP 800-77 Rev 1: Guide to IPsec VPNs
- MITRE ATT&CK T1572 — Protocol Tunneling
