eduVPN

eduVPN
Name	eduVPN
Developer	SWITCH
Released	2018
Programming language	Python, Go
Operating system	Windows, macOS, Linux, Android, iOS
License	MIT

eduVPN

eduVPN is an open-source virtual private network solution designed for educational and research institutions to provide secure remote access to network resources. It aims to simplify deployment and management for IT departments while supporting end users across diverse platforms and institutional federations. The project emphasizes interoperability with existing identity providers and network architectures used by universities, research institutes, and associated consortia.

Overview

eduVPN was created to offer a user-friendly client and server stack that integrates with institutional identity providers such as SWITCH, SURFnet, GÉANT, Internet2, and CANARIE. The stack supports protocols and technologies including OpenVPN, WireGuard, SAML 2.0, OAuth 2.0, and RADIUS to bridge institutional authentication systems like Shibboleth, Microsoft Azure Active Directory, Google Workspace for Education, LDAP, and CAS. Target audiences include campuses participating in regional research networks such as JANET (UK), RedCLARA, TEIN, and NORDUnet. eduVPN clients are available for mainstream platforms including Microsoft Windows, Apple macOS, Linux (kernel), Android (operating system), and iOS.

History and Development

The project originated within the context of federated identity projects driven by pan-European initiatives and national research and education networks, building on work from GÉANT, SURFnet, and SWITCH. Early motivations drew on operational experiences from deployments at institutions such as ETH Zurich, Utrecht University, University of Amsterdam, Trinity College Dublin, and Karolinska Institutet. Development has been influenced by standards and collaborations with organizations including IETF, Internet Engineering Task Force, OpenID Foundation, W3C, and the European Commission research programs. Contributors and stakeholders have included commercial and academic partners akin to Red Hat, Canonical, Cisco Systems, Juniper Networks, and independent open-source communities.

Architecture and Features

eduVPN’s architecture separates control plane components (management, authentication, configuration) from data plane components (tunnel servers). The server side leverages technologies such as Docker, Kubernetes, Ansible, and Terraform for deployment automation and scalability; underlying operating systems commonly include Debian, Ubuntu, CentOS, and FreeBSD. Client applications implement cross-platform frameworks and native network stacks compatible with NetworkManager, systemd-resolved, Apple SystemConfiguration, and mobile VPN APIs from Google LLC and Apple Inc.. Features include per-user profile management, split tunneling, multi-factor authentication integrations with Duo Security, Yubico, and Okta, as well as logging and monitoring hooks for systems such as Prometheus and ELK Stack (Elasticsearch, Logstash, Kibana). Protocol support centers on WireGuard for modern cryptographic tunnels and OpenVPN for legacy compatibility, with certificate management using Let's Encrypt and software packaging via Debian packages and Homebrew.

Deployment and Use Cases

Institutions deploy eduVPN to enable remote access to internal services such as library subscriptions, lab equipment management, and research data repositories accessed through platforms like Dataverse, DSpace, Zenodo, and Invenio. Typical deployments occur at universities listed among Russell Group, Universities UK, Ivy League, Group of Eight (Australian universities), and at research infrastructures including CERN, EMBL, and European Space Agency. Use cases span remote students accessing campus resources, remote researchers connecting to high-performance computing clusters like PRACE and XSEDE, and international collaborations linking through regional backbones such as GÉANT and Internet2.

Security and Privacy

Security design draws from cryptographic standards promoted by IETF working groups, with WireGuard offering modern keys and minimal attack surface, and OpenVPN providing tried-and-tested TLS-based connections. Authentication integrations with SAML 2.0 and OAuth 2.0 allow institutions to enforce policies consistent with identity providers such as Shibboleth and Microsoft Entra ID. Privacy practices reflect expectations set by regulatory frameworks including GDPR and institutional review boards at universities like Harvard University and University of Oxford. Operational security often pairs eduVPN with perimeter protections from vendors such as Palo Alto Networks and Fortinet, while auditing uses standards from ISO/IEC 27001 and NIST guidelines.

Governance and Community

The project is governed through collaborative models typical of research and education networking initiatives, with stewardship from organizations similar to SWITCH and community contributions from national research and education networks including SURFnet, NORDUnet, CANARIE, and RedCLARA. The community engages via code repositories, issue trackers, and mailing lists patterned on workflows established by GitHub, GitLab, and Apache Software Foundation projects. Educational outreach and operator training align with events such as TNC (GÉANT) and regional conferences hosted by TERENA and EDUCAUSE.

Adoption and Interoperability

Interoperability is a core goal: eduVPN integrates with identity federations such as eduGAIN and supports connectivity to VPN gateways implemented with commercial technologies from Cisco Systems, Juniper Networks, F5 Networks, and open-source solutions like StrongSwan and OpenSwan. Adoption is observable across European, North American, and Australasian research networks and higher-education institutions, often coordinated through consortia such as GÉANT and Internet2. Packaging and deployment models facilitate integration with campus services like Microsoft 365 Education and Google Workspace for Education while enabling federation-aware access to services such as ORCID, CrossRef, and DataCite.

Category:Virtual private network software