Software-Defined Perimeter as a Cost-Effective Alternative to VPN for Small Educational Institutions

Hlib Kolesnichenko

Bakalářská práce

Abstract:

In small educational institutions there is most often a problem that the IT component, i.e. IT support is handled by one person, and as a rule, of course, it is impossible to demand from this person a mega-cool qualification, because there is most likely an extremely limited budget and so on. This creates a difficult task, because due to the lack of people, as well as the lack of funding, it is still necessary to provide protected, secure remote access to employees, students who study or teach there. Historically, since the 2000s, such institutions have used VPN gateways for a number of reasons. Because these gateways are most often a box that you just buy and forget. And also most often it is just a legacy, because the system for example in some educational institution has not changed since 2000, and every new person who comes in is just maintaining it. They do not want to change them because it is easy to find a person who knows IPSec, OpenVPN and so on. However, it is important to understand that VPN gateways open listening ports on the regular Internet, applying rough routing of subnets, which creates a heavy load on the network, because the open port is a constant flow of traffic and scans, a lot of scanning by bots, because of routing of whole subnets there is a lot of unnecessary traffic, VPN pulls a lot of large subnets like /24, /16 and as a result there are broadcast packets, unnecessary service traffic and Administrator manually destroys collisions, accesses and routes. And static rules require constant rights and maintenance, adding new employees, new servers, moving servers and so on, all this requires manually updating NAT, ACLs, routes. At the same time, if you look at SDP software-defined perimeter, following the official architectural model developed by CSA, it will eliminate at least three major problems, there will be no open ports on the Internet, so there will be no listening ports, there will be no fingerprinting, there will be no DDoS on the service, the service will exist only for the “chosen”. And also SDP will make the access policy more dynamic, because it will be tied to the user's identity, so the operational load will be radically reduced. The undergraduate paper will investigate the feasibility of replacing VPN with SDP. From the point of view of ultimately achieving economic benefits as well as simplifying the basic processes that make VPNs in today's small educational institutions not as efficient as they could be. A Docker virtual lab will be built with an OpenZiti controller that will provide authentication, and with the help of an edge gateway, encrypted tunnels on demand, two containerized services mimicking the secure resources of the institution. WireGuard will be used as an example VPN. For objective testing and research it will be necessary to provide simulation of workloads, such as web browsing, cloud storage synchronization and so on. Also to build objective conclusions it will be necessary to make performance measurements, I will measure latency, throughput, CPU load. The above-mentioned data will be collected with the help of Prometheus. For completeness of the picture it is necessary to make a simulation of the load on this will be used “tc netem” in order to simulate a realistic delay, packet loss and so on. Also basic security will be tested using SYN and UDP flooding. In addition, port scanning, bruteforce will be performed.

Keywords

secure remote access, Docker-based laboratory, VPN replacement, Total Cost of Ownership, Software-Defined Perimeter, Zero Trust architecture, small educational institutions, network performance measurement

Jazyk práce: angličtina

Datum vytvoření / odevzdání či podání práce: 16. 3. 2026

Obhajoba závěrečné práce

• Obhajoba proběhla 21. 5. 2026
• Vedoucí: Ing. Tomáš Vokoun
• Oponent: Pavel Ambruz, Ing.

Česká zemědělská univerzita v Praze

Provozně ekonomická fakulta

Bakalářský studijní program:
Informatics