01The idea
Organizations once linked offices with leased lines: private, but expensive and inflexible. A VPN gets the same effect over the internet by giving each packet two properties it lacks on a shared network, confidentiality and integrity in transit, and by placing remote hosts logically inside the private address space.
02Tunneling and encapsulation
Tunneling places one complete packet inside another. The inner packet carries private addresses the internet cannot route; the outer packet carries the two gateways' public addresses so it can cross the internet. Encryption of the inner packet is what makes the tunnel private, not the tunneling itself. GRE, for example, tunnels without encrypting anything.
- RFC 2784 — GRE, an unencrypted tunnel, for contrast
- RFC 3948 — UDP encapsulation of IPsec ESP (NAT traversal)
- Wireshark sample captures — compare a plain flow with ESP and WireGuard captures
03Site-to-site vs remote access
| Site-to-site | Remote access | |
|---|---|---|
| Endpoints | Two fixed gateways | Individual device to a concentrator |
| Who authenticates | The gateways (certs or PSK) | The user and ideally the device |
| Main risk | One compromised site reaches every other site | Stolen credentials, infected or unmanaged endpoints |
| Key control | Firewall rules between sites, not just a flat tunnel | MFA, device posture checks, least-privilege access |
04IPsec, TLS, and WireGuard VPNs
IPsec / IKEv2
Network layer, transparent to applications. Standard for site-to-site and built into most OSes. Powerful but complex to configure; NAT needs UDP encapsulation.
TLS ("SSL") VPN
Rides on TLS, often over TCP/UDP 443, so it passes most firewalls. Either a full tunnel client (OpenVPN, AnyConnect) or a clientless browser portal to specific apps.
WireGuard
Roughly 4,000 lines of kernel code, one fixed modern cipher suite, keys tied to peers like SSH. Fast, auditable, formally analyzed, but no negotiation and no built-in user directory.
| IPsec | TLS VPN | WireGuard | |
|---|---|---|---|
| Layer | 3 (IP) | 4–7 | 3 (over UDP) |
| Crypto agility | Negotiated suites | Negotiated suites | Fixed: Curve25519, ChaCha20-Poly1305 |
| Firewall traversal | UDP 500/4500, ESP | 443, rarely blocked | One UDP port |
| Granular app access | Network-wide | Per app (portal mode) | Network-wide |
| Code size / audit | Large | Medium | Small |
PPTP and L2TP without IPsec are legacy options: PPTP's MS-CHAPv2 authentication can be broken offline and should never be used.
- WireGuard quick start · OpenVPN community documentation · strongSwan
- pfSense VPN documentation — IPsec, OpenVPN, and WireGuard in one lab box
- Donenfeld, J. (2017). WireGuard: next generation kernel network tunnel. NDSS.
- Dowling, B. & Paterson, K. (2018). A cryptographic analysis of the WireGuard protocol. ACNS.
- Schneier, B. & Mudge (1998). Cryptanalysis of Microsoft's Point-to-Point Tunneling Protocol (PPTP). ACM CCS.
05Authentication: the real perimeter
A VPN with a stolen password is a private network for the attacker. The tunnel's encryption is rarely what fails; the login is.
Remote-access VPN credentials are among the most targeted assets on the internet. The 2021 Colonial Pipeline ransomware intrusion began with a legacy VPN account protected only by a password and no MFA.
Phishing-resistant MFA
FIDO2/WebAuthn or certificate-based login. Push and SMS codes help but can be phished or fatigued.
Device identity
A machine certificate in a TPM proves the connection comes from a managed laptop, not just someone with the password.
Posture checks
Verify patch level, disk encryption, and endpoint protection before granting access.
Account hygiene
Disable dormant accounts, centralize identity (SAML/RADIUS), log and alert on unusual logins.
06Split tunneling and leaks
A full tunnel sends all traffic through the VPN. A split tunnel sends only corporate destinations through it and everything else straight to the internet. Split tunneling saves bandwidth and latency, but it makes the laptop a bridge between an untrusted network and the corporate one.
Leaks
Even "full" tunnels leak when the operating system routes some traffic around them: DNS queries to the local resolver, IPv6 when only IPv4 is tunneled, or routes injected by a hostile local network. Research such as TunnelCrack and TunnelVision showed attackers on the same Wi-Fi can force traffic outside the tunnel on many clients.
- TunnelCrack — leaking traffic outside VPN tunnels
- TunnelVision (CVE-2024-3661) — DHCP option 121 route injection
- Perta, V. et al. (2015). A glance through the VPN looking glass: IPv6 leakage and DNS hijacking in commercial VPN clients. PoPETs.
- Xue, N. et al. (2023). Bypassing tunnels: leaking VPN client traffic by abusing routing tables. USENIX Security.
07Topologies at scale
Modern mesh tools (WireGuard-based overlays and SD-WAN) automate key distribution and NAT traversal, so a mesh no longer means hand-configuring every pair.
- How NAT traversal works — a detailed tutorial on peer-to-peer tunnels through NAT
08The VPN as an attack surface
A VPN concentrator is, by design, an internet-facing device that grants internal network access. That makes it one of the most valuable targets an organization has. Over the past several years, pre-authentication vulnerabilities in widely used commercial VPN and remote-access appliances have been exploited at scale, often within days of disclosure and sometimes before.
Patch fast
Treat the VPN gateway as the highest-priority patch target; subscribe to vendor advisories and the CISA KEV catalog.
Minimize exposure
Disable unused portals and features; restrict the management interface to an internal network.
Assume breach
Segment what VPN users can reach and monitor the gateway's own logs and integrity, not just user sessions.
Consumer VPNs are a different product
Commercial "privacy VPNs" move trust from your ISP to the VPN provider, which sees all your traffic. Measurement studies have found clients that leak traffic, inject content, mislabel server locations, or request excessive permissions.
- CISA Known Exploited Vulnerabilities — search for VPN products
- Khan, M. T. et al. (2018). An empirical analysis of the commercial VPN ecosystem. ACM IMC.
- Ikram, M. et al. (2016). An analysis of the privacy and security risks of Android VPN permission-enabled apps. ACM IMC.
- Xue, D. et al. (2022). OpenVPN is open to VPN fingerprinting. USENIX Security.
09Beyond VPNs: zero-trust access
A traditional VPN authenticates once and then places the user on the network, where they can reach anything routing allows. Zero-trust network access (ZTNA) inverts this: every request to every application is authenticated and authorized, using user identity, device health, and context, and nothing else on the network is reachable.
VPNs remain the right tool for site-to-site links and for protocols that need full network access; ZTNA increasingly replaces them for user-to-application access.
- NIST SP 800-207 — Zero Trust Architecture
- CISA Zero Trust Maturity Model v2 (PDF)
- Ward, R. & Beyer, B. (2014). BeyondCorp: a new approach to enterprise security. ;login:, 39(6).
10Common misconceptions
—References
Peer-reviewed
- Donenfeld, J. (2017). WireGuard: next generation kernel network tunnel. NDSS. doi:10.14722/ndss.2017.23160
- Dowling, B. & Paterson, K. (2018). A cryptographic analysis of the WireGuard protocol. ACNS. doi:10.1007/978-3-319-93387-0_1
- Ikram, M. et al. (2016). An analysis of the privacy and security risks of Android VPN permission-enabled apps. ACM IMC. doi:10.1145/2987443.2987471
- Khan, M. T. et al. (2018). An empirical analysis of the commercial VPN ecosystem. ACM IMC. doi:10.1145/3278532.3278570
- Perta, V. et al. (2015). A glance through the VPN looking glass. PoPETs. doi:10.1515/popets-2015-0006
- Schneier, B. & Mudge (1998). Cryptanalysis of Microsoft's PPTP. ACM CCS. doi:10.1145/288090.288119
- Ward, R. & Beyer, B. (2014). BeyondCorp. ;login:, 39(6). usenix.org
- Xue, D. et al. (2022). OpenVPN is open to VPN fingerprinting. USENIX Security. usenix.org
- Xue, N. et al. (2023). Bypassing tunnels: leaking VPN client traffic by abusing routing tables. USENIX Security. usenix.org