VPN

A VPN (virtual private network) is a logical network built on top of a shared or untrusted network, usually the internet, in which traffic between authenticated endpoints is encapsulated and encrypted so that it behaves as if it crossed a private link. In network security, a VPN protects the confidentiality and integrity of data in transit and extends a trusted network to remote users, branch offices or cloud environments.

A VPN is not a complete security architecture. It secures the path between two tunnel endpoints, but it does not inspect what travels inside the tunnel, does not make an infected laptop safe and does not by itself decide which internal resources a connected user may reach. Those questions belong to access control, segmentation and endpoint security.

How a VPN tunnel carries traffic

A VPN works by wrapping each original packet inside a new outer packet that is addressed between the two tunnel endpoints. The inner packet keeps its private addresses, while the outer header carries public addresses that the internet can route. This process is called encapsulation, and the receiving endpoint removes the outer header and forwards the original packet into its local network.

Before any data flows, the endpoints run a key exchange and authentication phase. Each side proves its identity with certificates, pre-shared keys or public keys, and both derive fresh symmetric session keys, typically through an ephemeral Diffie-Hellman exchange. Data packets are then protected with an authenticated encryption algorithm such as AES-GCM or ChaCha20-Poly1305, which provides both secrecy and tamper detection.

Because ephemeral keys are discarded after use, a well-configured VPN offers perfect forward secrecy: an attacker who later steals a long-term private key still cannot decrypt traffic recorded earlier. Keys are also rotated periodically, often every few minutes or after a set volume of data, which limits the exposure of any single key.

The following table summarizes the building blocks that every VPN implementation combines in some form.

Site-to-site and remote access VPN types

VPNs fall into two main deployment models that differ in who the endpoints are. A site-to-site VPN connects whole networks, such as a branch office and a headquarters, through gateways at each location; users behind the gateways need no client software. A remote access VPN connects an individual device to a corporate network through a client application and a central concentrator.

A third pattern, often marketed as a consumer VPN, routes a user’s internet traffic through a commercial provider’s servers. Its purpose is different: it hides traffic from the local network and changes the apparent source address, but it shifts trust to the provider rather than removing the need for trust.

VPN protocols and their trade-offs

The choice of VPN protocol determines performance, compatibility and the size of the attack surface. IPsec operates at the network layer and is the standard for interoperable site-to-site links between different vendors. TLS-based VPNs, including OpenVPN and many commercial SSL VPN products, work over TCP or UDP port 443 and pass through restrictive firewalls easily. WireGuard uses a small, fixed set of modern cryptographic primitives and a codebase of a few thousand lines, which makes it fast and easier to audit.

Every VPN adds encapsulation overhead of roughly 50 to 80 bytes per packet, depending on the protocol and IP version. On a standard 1500-byte Ethernet path, this reduces the usable MTU to about 1420 bytes for WireGuard and often around 1400 bytes for IPsec. Ignoring this causes fragmentation or silently dropped large packets, a classic source of connections that open but then stall.

VPN versus related network security controls

A VPN is often confused with controls that solve neighboring problems. The VPN answers how traffic travels safely, while network segmentation, network ACLs and RADIUS answer who may reach what and how identities are verified. In practice they work together: a remote access VPN commonly authenticates users against a RADIUS server and then applies ACLs to limit what each user group can reach.

The last row reflects a significant shift. Traditional remote access VPNs place a user on the internal network, which grants broad reachability once connected. Zero trust network access (ZTNA) instead brokers each connection to a specific application after checking identity and device posture, which reduces lateral movement after a credential compromise.

Configuring a VPN securely

Secure VPN design starts with strong authentication: certificates or hardware-backed keys for gateways, and multi-factor authentication for every remote user. Gateways should accept only current cipher suites, with IKEv1, PPTP and legacy algorithms such as 3DES and SHA-1 disabled.

The routing policy is the second key decision. A full tunnel sends all client traffic through the corporate network, which allows central inspection but adds latency and bandwidth load. A split tunnel sends only internal destinations through the VPN, which improves performance but leaves internet traffic outside corporate controls.

• Patch VPN gateways promptly, because internet-facing VPN appliances are among the most exploited devices in enterprise networks.
• Log and monitor connections, including source addresses, failed logins and unusual session durations.
• Restrict post-connection access with segmentation and ACLs instead of trusting every tunnel user.
• Set the tunnel MTU or MSS clamping to avoid fragmentation problems.

Common VPN misconceptions and failure modes

The most widespread misconception is that a VPN makes a user anonymous. It only hides traffic from parties between the client and the tunnel endpoint; the endpoint operator still sees source addresses and destinations, and websites can still identify users through logins, cookies and browser fingerprinting.

Stripped to the essentials

A VPN is like sending a letter inside a locked, opaque envelope through the ordinary postal system. The mail carriers still move the envelope, but nobody along the way can read or change what is inside. Only the recipient holds the key to open it.

For a company, this means an employee at home or a branch office can use the public internet as if they were plugged into the office network. The key point is that a VPN protects the journey, not the destination: once the envelope is opened, other safeguards must decide what the sender is allowed to do.

Where it is applied

A regional accounting firm with a head office and three branch offices needs every branch to reach the central file server and accounting database. Leased private lines would cost far more than ordinary business internet connections, so the firm installs a firewall at each site and builds site-to-site IPsec tunnels with IKEv2 from every branch to the head office, using certificates for authentication and AES-256-GCM for encryption.

For about 40 staff who work from home during tax season, the firm adds a remote access VPN with multi-factor authentication. Users authenticate against a RADIUS server, and ACLs place them in a segment that can reach only the accounting application and file shares, not the server management network. The tunnel MTU is set to 1400 bytes after early tests showed large file transfers stalling.

The result is encrypted connectivity for all sites and remote staff over inexpensive internet links, with access limited to what each role needs.