Last updated · reviewed for accuracy
VPN basics
A VPN wraps your traffic inside an encrypted envelope and mails it across a network you do not trust. Simple idea, endless marketing fog: this lesson separates what tunnels really do from what VPN ads claim they do.
Tunneling: a packet inside a packet
A VPN takes your original packet, encrypts it whole, and places it as the payload of a new packet addressed to the VPN endpoint. Routers along the way see only the outer envelope; the inner packet (addresses, ports, contents) is ciphertext.
This is encapsulation once more, with cryptography: the untrusted network carries an outer packet between two tunnel endpoints; at the far end the envelope is opened, the inner packet decrypted and released to continue its journey as if the hostile middle never existed.
The two shapes: site-to-site and remote access
A site-to-site VPN connects two networks through their gateways: every device in both offices benefits without running any VPN software. A remote-access VPN connects one device to a network: the laptop in a cafe reaching the office as if it were there.
| Site-to-site | Remote access | |
|---|---|---|
| Endpoints | Two gateways/routers | One device ↔ a gateway |
| Who runs software | Just the gateways | Every remote device |
| Typical use | Branch ↔ HQ | Working from anywhere |
| Protocols you will meet | IPsec | WireGuard, OpenVPN, IPsec/IKEv2 |
What a VPN protects, and what it cannot
A VPN protects data in transit across the untrusted middle: the cafe Wi-Fi cannot read or alter your traffic, and services see the VPN endpoint address instead of yours. It does not make you anonymous, does not stop phishing or malware, and fully trusts the VPN endpoint itself.
- Protects: confidentiality and integrity between you and the tunnel endpoint; your IP from the services you visit.
- Does not: hide you from the VPN provider (they are the endpoint), stop malicious downloads, or secure traffic after it leaves the tunnel.
- Rule of thumb: a VPN moves your trust, from the network you are on, to the endpoint you tunnel to. Choose the endpoint accordingly.
The protocols in the wild
IPsec is the long-standing standard for site-to-site tunnels and much corporate remote access. WireGuard is the modern favourite: a tiny codebase, modern cryptography and painless configuration. OpenVPN remains everywhere as the battle-tested TLS-based option.
For a home lab, WireGuard is the honest recommendation: a working tunnel is perhaps twenty lines of config across both ends, and watching your own traffic appear inside it in Wireshark (ciphertext on the outside, cleartext on the inside interface) teaches more than any diagram.
See the envelope for yourself
Capture on both a physical and a VPN interface at once in Wireshark: the same traffic appears twice (encrypted UDP on the wire, readable packets inside the tunnel). Encapsulation stops being abstract in about thirty seconds.
Frequently asked questions
Does a VPN make me anonymous online?
No. It moves trust rather than removing it. The local network is blinded, but the VPN endpoint sees what the network used to, and fingerprinting still works.
What is the difference between site-to-site and remote-access VPN?
Site-to-site joins two whole networks at their gateways (no client software anywhere). Remote access joins one device to a network through a client. Branch offices: the first. Cafe laptop: the second.
Is WireGuard better than IPsec?
WireGuard is simpler, fast and easy to audit: the default for new personal/lab tunnels. IPsec stays standard where multi-vendor interoperability and enterprise gear matter. Same problem, different ecosystems.