Tunneling SSL VPN Based on PF_RING

A traditional tunnel type SSL VPN gateway uses a virtual network card to establish a VPN tunnel, and reads and writes a virtual network card to complete the transmission and reception of tunnel payload data packets. However, the maximum packet length that the virtual network card can read and write at a time is the MTU value of the link layer, which limits the data throughput of the gateway. In addition, the data packets written by the virtual network card are more than once transferred in the system protocol stack than the normal data packets. Reduce the data transmission rate of the gateway and increase the delay of data transmission. In response to the above problems and combined with development practices, the paper proposes a high-performance tunnel SSL VPN implementation based on PF_RING. A tunnel-type SSL VPN gateway framework using PF_RING instead of a virtual NIC is designed. The framework uses the data capture interface provided by PF_RING to complete the transmission and reception of existing SSL packets by means of the system protocol stack, and implements the connection forwarding function of the VPN gateway in the user mode. The experimental results show that the tunnel SSL VPN gateway implemented by PF_RING high-speed packet capture technology achieves a performance improvement of 30% in terms of network delay data throughput and file download rate..