VPN (Virtual Private Network)

A VPN (Virtual Private Network) creates a secure, encrypted communication tunnel between networks or devices across a public network.

To provide privacy, confidentiality, and secure connectivity over untrusted networks such as the internet.

Tunneling encapsulates one network packet inside another so it can travel securely across a different network.

Encryption scrambles data so it cannot be read by unauthorized parties while in transit.

A VPN tunnel is the secure path or connection created between endpoints.

An endpoint is the device or gateway that participates in the VPN tunnel, such as a client or server.

A remote access VPN lets individual users connect securely to a private network from remote locations.

A site-to-site VPN connects entire networks, such as branch offices to a headquarters network.

Client-to-site is another name for remote access VPN.

Because employees often need secure access to internal systems while using public or untrusted networks.

IPsec is a protocol suite used to secure IP communications through authentication and encryption.

OpenVPN is an open-source VPN protocol that can run over UDP or TCP and supports strong encryption.

WireGuard is a modern, lightweight VPN protocol designed for speed and simplicity.

L2TP is a tunneling protocol often paired with IPsec for secure VPNs.

PPTP is an older VPN protocol that is generally considered insecure and outdated.

Because it has known security vulnerabilities and weaker protections than modern protocols.

A TLS-based VPN uses SSL/TLS to secure connections, often for remote user access via a browser or client.

A VPN concentrator is a device or service that accepts and manages many VPN connections.

A client configuration includes credentials, certificates, addresses, and options needed to connect to a VPN.

A server configuration defines the VPN endpoints, authentication mode, encryption, and routes.

A shared secret is a pre-shared key used in some VPN authentication schemes.

A public key and private key pair is used in modern asymmetric cryptography for authentication and encryption.

A certificate binds an identity to a public key and is often used in VPN authentication.

Mutual TLS (mTLS) requires both client and server to authenticate using certificates.

A pre-shared key (PSK) is a secret value known to both peers in a VPN connection.

Because certificates scale better and allow stronger identity verification.

Network privacy means protecting the confidentiality of traffic as it moves over shared or public networks.

It means the contents of traffic are not visible to unauthorized parties.

Integrity means data is not altered in transit.

A handshake is the initial exchange used to establish a secure VPN connection and negotiate keys.

A key exchange is the process of securely establishing the keys used for encryption.

IKE (Internet Key Exchange) is a protocol used by IPsec to negotiate security associations and keys.

A security association is a set of negotiated security parameters for a VPN connection.

An SA is a Security Association, containing keys, algorithms, and connection parameters.

Traffic encryption protects the payload while it is in transit across the network.

Tunnel mode encapsulates the entire IP packet inside a new IP packet for VPN transport.

Transport mode encrypts only the payload and some headers of the IP packet instead of the whole packet.

It is used when both peers are directly routing traffic in IPsec without a full tunnel.

It is the common mode for VPNs, where the entire packet is encapsulated in a new IP packet.

Authentication verifies that each endpoint is the one it claims to be.

Without it, an attacker could impersonate the VPN gateway or client.

A VPN gateway is a device or service that terminates VPN tunnels and routes traffic.

Split tunneling sends only some traffic through the VPN while allowing other traffic directly to the internet.

It can reduce bandwidth usage and latency for local internet traffic.

It may allow sensitive traffic to bypass the corporate VPN.

Full tunneling sends all traffic through the VPN tunnel.

It enforces policy and keeps traffic inside the organization’s security domain.

A VPN client is software or a device that initiates a VPN connection to a VPN server.

A VPN server accepts incoming connections from VPN clients or peers.

Routing is the process of directing traffic to the correct network destination.

Because packets must be sent through the tunnel and reach internal networks correctly.

A route table contains rules that tell a system where to send packets.

A default route is the route used when no specific route matches.

Because users or branches need to access internal services via the tunnel.

A subnet is a range of IP addresses in a network.

Because private networks can be reached through the tunnel.

A private IP is an address in a reserved range such as 10.0.0.0/8 or 192.168.0.0/16.

NAT (Network Address Translation) translates private IPs to public IPs or vice versa.

Because VPN traffic may need to traverse NAT devices or public networks.

UDP is a lightweight transport protocol often used for VPN data because of low overhead.

TCP is a reliable transport protocol that can add overhead but is more resilient to interruption.

UDP is usually faster and suitable for real-time traffic; TCP may be better in restrictive or lossy networks.

MTU (Maximum Transmission Unit) is the maximum packet size that can be transmitted without fragmentation.

Because tunneling adds overhead and can cause packet fragmentation or performance issues.

Fragmentation breaks large packets into smaller units for transmission.

Because it adds complexity and reduces performance and reliability.

A client certificate is a certificate that identifies a VPN client.

A trust store contains trusted certificates or root CAs used to validate peers.

Because they need to trust the certificate authorities issuing certificates.

Transport mode protects the payload; tunnel mode protects the full packet.

A VPN without encryption is not secure and may expose traffic.

A VPN proxy may route traffic or provide a tunnel but not necessarily full network-level security.

It is the server or appliance that remote users connect to before reaching internal resources.

A firewall may enforce rules on incoming or outgoing VPN traffic.

A connection profile stores the settings needed to establish a VPN connection.

Because they simplify configuration for many users and devices.

An IPsec policy defines the security parameters and traffic selectors for an IPsec tunnel.

It determines what traffic is allowed, which authentication methods are used, and how the connection is created.

A VPN log tracks connection attempts, errors, and events for troubleshooting.

A VPN failure is any error preventing a secure tunnel from being established or maintained.

It happens when the client or server identity does not match the trusted certificate.

A handshake failure means the tunnel could not negotiate the secure parameters.

A dead peer detection mechanism monitors whether the peer remains reachable.

It helps detect stale tunnels and recover from failed peers.

Rekeying renegotiates keys to maintain security and freshness.

Because long-lived keys are more susceptible to compromise over time.

Perfect forward secrecy ensures compromise of a long-term key does not reveal past session keys.

It improves security by limiting the impact of key compromise.

A privacy VPN hides the user’s traffic from local network observers or some public network nodes.

A corporate VPN allows employees to access internal resources securely from external locations.

A private network is an internal network that is not exposed directly to the public internet.

A public network is a widely shared network like the internet.

Because the tunnel creates a secure path that can be treated as private.

A remote site is a network branch or office connected through a site-to-site VPN.

A branch office is a smaller satellite office connected to the main network.

It means creating separate secure network paths or trust zones through VPNs.

A tunnel broker is a service used to create tunnels, typically in IPv6 or custom tunneling scenarios.

To allow only appropriate VPN traffic and prevent unauthorized network access.

NAT traversal happens when packets must cross a NAT device to reach the peer endpoint.

Because they protect remote access and inter-site communication over untrusted networks.

Phase 1 in IKE establishes the initial security association and authenticates peers.

Phase 2 negotiates the actual tunnel parameters for protected traffic.

It separates peer authentication and tunnel policy negotiation for clarity and flexibility.

It stores the active IPsec rules and parameters for the tunnel.

It holds selectors that define which traffic is encrypted or passed through the tunnel.

A tunnel selector defines which traffic is associated with a given VPN tunnel.

A policy group may define multiple peers, subnets, and phases for configuration.

Because regulated environments require secure remote access and data confidentiality.

A bypass route allows certain traffic to avoid the VPN tunnel.

Because traffic escaping the tunnel may not be protected by company security policies.

It contains the settings for a phone or laptop to connect to a VPN gateway.

Because mobile users often need secure, trusted, and manageable connectivity.

A VPN for IoT allows remote devices to connect securely to a private network or cloud environment.

Because many IoT devices are resource-constrained and may be exposed to untrusted networks.

A NAT traversal protocol helps tunnel traffic cross NAT devices and firewalls.

They improve compatibility with NAT and firewall environments.

Some VPNs support multicast traffic for routing protocols or broadcast services.

It adds complexity and may not be required for standard remote access VPNs.

A point-to-point tunnel connects exactly two peers.

A mesh VPN connects multiple peers in a more distributed network design.

For network redundancy or private communication across many locations.

A hub-and-spoke model connects many sites to a central gateway.

It can simplify configuration and centralize policy enforcement.

A tunnel interface is a virtual network interface used to route VPN traffic.

A virtual interface is a software device used for networking, such as a tunnel interface.

It lets the OS route packets through the VPN as if it were a physical network connection.

Split DNS is a DNS configuration where traffic uses different DNS servers depending on network path.

Because devices need to resolve internal hostnames through the VPN path.

A DNS leak occurs when DNS queries bypass the VPN and reveal traffic to a local network or ISP.

Because it can reveal which internal services or domains are being visited.

It happens when traffic is not forced through the secure tunnel and instead goes directly to the internet.

To safely resolve internal hostnames for private networks.

It is a route that directs traffic for private IP ranges through the tunnel.

Because it reduces the surface and prevents unnecessary external access.

A policy engine decides which traffic is allowed or denied through the tunnel.

It maps users or roles to allowed network access.

A client install packages the VPN configuration, credentials, and certificates for deployment.

Because it reduces drift, misconfiguration, and security issues.

Failover switches to a backup tunnel or gateway if the primary VPN fails.

It helps maintain availability when the primary path becomes unavailable.

It ensures the VPN service continues operating despite a node or gateway failure.

Active-active means multiple VPN gateways handle traffic at the same time.

Active-passive means one gateway is active and another is standby.

It preserves connection state during failover so sessions continue without interruption.

Because stronger encryption may reduce throughput, which matters in remote access environments.

It allows remote users to connect with a browser, often via a web portal.

Because they reduce client installation requirements and support easier access.

Zero-trust focuses on explicit verification and minimized trust; VPN remains one of many access controls.

It ties VPN access decisions to user identity and authorization rather than only device or network.

It can enforce network access control but should be complemented by identity and application-level controls.

Using VPN plus MFA strengthens user identity and reduces unauthorized access.

Because password-only remote access is often vulnerable to theft or brute force.

It verifies that a connecting device complies with security policy before allowing VPN access.

It reduces the risk of compromised or unmanaged devices connecting to a private network.

It ties access to device security state, OS version, patch level, or compliance status.

It grants or denies access based on identity, location, device health, or policy.

It combines the secure tunnel with centralized login and identity management.

Because remote users are a common target for phishing and credential theft.

A secure internal network uses VPNs, segmentation, identity controls, and monitoring.

An anomaly could be unexpected tunnel connections, repeated failed handshakes, or unusual routing behavior.

Because they are key security and networking chokepoints.

Telemetry includes connection counts, throughput, authentication logs, packet loss, and tunnel health.

A stateful firewall tracks the state of connections and can enforce policy on VPN traffic.

To apply security rules to connections once they enter the secure tunnel.

A DMZ is a network segment used to expose services to external connections more safely than the internal network.

To reduce the blast radius and limit the impact of a compromise.

A load balancer may distribute VPN sessions across multiple gateways.

Because remote-user load can spike and require more capacity.

A cluster of gateways that handles many VPN connections.

It rotates certs so they remain valid and secure over time.

Because expired certs cause tunnel failures.

A CA (Certificate Authority) signs and validates certificates.

Because it underpins certificate trust in the VPN.

A session timeout ends an idle or stale tunnel after a certain period.

They reduce stale sessions and exposure.

Reconnecting automatically after a disconnect or failover.

It is insecure and vulnerable to interception or unauthorized access.

It enforces that users only access authorized resources and not the whole internal network.

Because users should only reach the assets they need.

It allows secure remote access to internal infrastructure while preserving confidentiality and trust.

It is the set of exposure points such as the gateway, certificates, clients, and routing rules.

Because gateways are high-value entry points into private networks.

It includes patching, hardening, and secure configuration of the gateway and client software.

It aims to overwhelm a VPN gateway with connection attempts or traffic to disrupt service.

Because remote access services often become primary targets during attacks.

IPsec uses anti-replay to prevent attackers from replaying old packets inside the tunnel.

Because replayed packets can be used in session hijacking or denial-of-service attacks.

It refreshes encryption keys on a schedule or after a security event.

Because long-lived keys weaken security over time.

Perfect Forward Secrecy ensures one key compromise does not reveal past session keys.

Because it is stable, efficient, and supports strong security and mobility.

WireGuard uses modern cryptographic primitives, including Noise Protocol framework and Curve25519.

Because it has a smaller codebase and clearer security model than older VPN stacks.

It occurs when peers do not agree on key exchange, selectors, or security parameters.

Because tunnels can fail if both peers are not configured consistently.

A dead tunnel is a stale or nonfunctional VPN connection that remains in a broken state.

Because network routes may change as branches, services, or subnets are updated.

BGP can be used to advertise routes across site-to-site VPNs.

A VPN extends a private network to a remote client; zero-trust network access is more identity- and policy-centric and often does not assume network trust.

VPNs are secure network tunnels that protect remote access and inter-site communication, but they must be combined with strong identity, policy, encryption, routing discipline, and monitoring to be effective.