Browse
VPNs & Tunneling
Encapsulating traffic inside another protocol to create a private, often encrypted path across an untrusted network.
What it is
Tunneling encapsulates one network protocol's traffic inside another, creating a logical path across an underlying network that the tunnel itself doesn't need to trust — VPNs are the most common application, adding encryption to that tunnel for privacy and integrity.
Key points
- Site-to-site vs. remote-access VPNs: site-to-site VPNs connect two networks (e.g. an office and a cloud VPC) continuously; remote-access VPNs let an individual device connect into a private network on demand.
- IPsec vs. TLS-based VPNs: IPsec operates at the network layer and is common for site-to-site connections; TLS-based VPNs (like WireGuard or OpenVPN) operate higher up and are often simpler to deploy for remote access.
- What a VPN actually guarantees: confidentiality and integrity of traffic between the two tunnel endpoints — it doesn't make either endpoint itself more secure, which is a common misunderstanding of what a VPN protects against.
- Modern zero-trust network architectures increasingly replace traditional "VPN into the whole internal network" with per-application access — reducing the blast radius of a compromised VPN credential.