Networking
VPN — Virtual Private Network
IP's own applications section mentions this in one line: "encapsulating one IP packet inside another is the basic trick behind most VPN implementations." This page is that one line, expanded — how wrapping a whole packet, encrypted, inside another one makes a device on the other side of the internet behave as if it's plugged directly into a private network.
- What it is
- An encrypted, authenticated tunnel across an untrusted network, making a remote device appear as if it's directly on a private network.
- Mental model
- A private, armored corridor built through a public building — you're still physically inside the same building (the internet), but nothing outside the corridor can see or touch what's moving through it.
- Key numbers
- Common protocols: WireGuard (modern, minimal), OpenVPN (older, built on TLS), IPsec (network-layer, common for site-to-site links).
- Reach for it when
- A remote device needs to behave like it's on a private network, or two private networks need to be joined together across the public internet.
Encapsulation — a packet inside a packet
A VPN client doesn't send its traffic to the internet directly. Instead, it takes each entire original IP packet — headers and all — encrypts it, and wraps it inside a brand new outer IP packet addressed to the VPN server. That outer packet travels the public internet normally; only the VPN server can decrypt and unwrap it, recovering the original packet and forwarding it onward exactly as if it had originated from inside the private network all along.
Site-to-site vs. remote-access
- Site-to-site
- Permanently joins two entire office/site networks together, router-to-router — no individual client software involved; every device at either site simply reaches the other site transparently.
- Remote-access
- An individual device (a laptop, a phone) connects into a private network from wherever it happens to be, running client software that establishes the tunnel on demand.
Real-world applications
- Remote work access — connecting a laptop into a company's internal network from home, making internal-only resources reachable exactly as if physically in the office.
- Joining separate office networks — a site-to-site VPN linking two branch offices' LANs together over the public internet, avoiding the cost of a dedicated private line.
- IoT fleet management — some IoT platforms put every deployed device on a private VPN mesh regardless of its physical network, giving the management backend a single consistent way to reach any device securely.
- Consumer privacy VPN services — routing all of a device's traffic through a third-party VPN provider, hiding its real IP address from the sites and services it connects to.
Gotchas
- A VPN only protects traffic between the client and the VPN server/endpoint — it does nothing for the connection beyond that point. A site visited over plain HTTP (not HTTPS) through a VPN is still sent in plaintext for the last leg; VPN and HTTPS solve different, complementary problems, and conflating them is a common misconception.
- A VPN adds real latency and reduces throughput — every packet takes a genuine detour through the VPN server plus pays encryption overhead, a cost worth measuring, not assuming away.
- A "kill switch" feature exists specifically because a dropped VPN connection can otherwise let traffic silently fall back to the normal, unprotected connection without any obvious signal that protection has lapsed.