Virtual Private Networks (VPNs): Types, Protocols (IPsec, SSL/TLS), and Secure Configuration

Imagine for a moment that you are a spy in a foreign city. You need to send a secret report back to your headquarters. You cannot simply drop a letter in the local postbox, because anyone could pick it up and read it. You cannot shout your message across the street, because the whole neighbourhood would hear you. Instead, your organisation has prepared something clever. There is a hidden tunnel running beneath the city streets, from your location all the way to headquarters. You place your report inside a locked metal box, hand it to a trusted courier, and the courier carries it through that tunnel. Nobody on the surface knows the tunnel exists. Nobody who sees the courier knows what is inside the box. Only the person at the other end holds a key that opens it. That story describes, almost perfectly, what a Virtual Private Network does. A VPN is a system that creates a secret, protected passageway for your data as it travels across the internet. The internet itself is a public space, open to everyone. When you send information across it without protection, that information passes through many different computers and routers owned by people and organisations you have never met. Any one of those points could, in theory, be used to spy on your data. A VPN wraps your data in strong encryption, which means it scrambles the data into unreadable nonsense, and sends it through a dedicated channel called a tunnel. By the time it arrives at its destination, it has been unscrambled and read only by the intended recipient. Before we go further, it is worth understanding the three main jobs that a VPN performs. The first job is confidentiality, which simply means keeping your information secret. The VPN encrypts your data so that anyone who intercepts it sees only a meaningless jumble of characters, not your actual message or file. The second job is integrity, which means making sure your data has not been secretly changed while it was travelling. To do this, the VPN creates something called a hash, which you can think of as a unique fingerprint of the data. If someone tampered with your data midway through its journey, even changing a single character, the fingerprint would no longer match, and the receiving system would immediately know something was wrong. The third job is authentication, which means proving that both sides of the connection are genuinely who they say they are. This stops an attacker from pretending to be your company's VPN server and tricking you into connecting to them instead. With those three foundations in mind, let us explore the different shapes that VPNs come in. The first major type is called a Remote Access VPN. This is the kind most people have encountered personally. It is designed to connect a single person, using a single device, to a remote private network. Think of an employee called Maria who works for a bank. The bank's internal systems contain customer records, financial software, and confidential documents. These systems are deliberately not available on the open internet, because putting them there would be dangerous. Maria is working from home on a Tuesday and needs to access those systems. She opens a small piece of software on her laptop called a VPN client, which is a programme that knows how to build the secure tunnel. She enters her login details, the client connects to the bank's VPN gateway, which is a powerful server sitting at the edge of the bank's network, and within seconds a tunnel is established. From that moment, Maria's laptop behaves exactly as if she had physically walked into the bank and plugged her computer into the office wall. She can open files, use software, and send data, all of it encrypted and protected. There is a variation on this called a clientless VPN, sometimes known as an SSL Portal VPN. The word clientless means the user does not need to install any special software. Instead, they simply open their web browser, navigate to a secure web address, and log into a portal, which is essentially a secure web page that acts as a doorway. From that portal, they can reach specific internal web applications, emails, or remote desktop services. The limitation is that this approach usually only works for a defined set of applications, not the entire network. For a travelling sales representative who simply needs to check the internal customer database and nothing else, this is a clean and straightforward solution. The second major type is a Site-to-Site VPN. Where a Remote Access VPN connects one person to a network, a Site-to-Site VPN connects two entire networks together. Imagine a clothing company with its headquarters in Milan and a manufacturing partner in Istanbul. The company in Milan needs to share inventory data, purchase orders, and design files with Istanbul every single day. Rather than having each employee individually connect with their own VPN, the company installs a VPN gateway at the edge of the Milan office network and another at the edge of the Istanbul network. These two gateways establish a permanent, always-on tunnel between themselves. Neither the employees in Milan nor the workers in Istanbul need to do anything special. When a design file leaves Milan heading for Istanbul, the Milan gateway automatically encrypts it, sends it through the tunnel, and the Istanbul gateway automatically decrypts it when it arrives. It is invisible to the users, which is what makes it so powerful. This type of VPN is also used between branches of the same company, which is called an intranet-based site-to-site VPN, where intranet simply means the internal network of a single organisation. When the VPN connects two different organisations, like our clothing company and its manufacturing partner, it is called an extranet-based VPN, where extranet means a controlled connection shared between separate organisations. Now that we understand the shapes of VPNs, we need to understand the rules that govern how they work. These rules are called protocols, and they are sets of technical standards that determine how the tunnel is built, how the data is encrypted, and how the two sides authenticate each other. The two most important protocol families are IPsec and SSL/TLS. IPsec, which stands for Internet Protocol Security, is a mature and powerful suite of protocols. The word suite here simply means a collection of related tools working together. IPsec works at what engineers call the Network Layer, which is the part of the system responsible for addressing and routing packets of data across the internet. An analogy helps here. Think of a postal system. The Network Layer is like the address written on the envelope that tells the postal worker where to deliver it. Because IPsec works at this foundational level, it can protect all kinds of traffic simultaneously, whether you are sending an email, browsing a website, or transferring a file, because all of those activities ultimately rely on the same underlying network layer. IPsec has several important components. The first is called the Authentication Header, often written as AH. This component confirms that the sender is genuine and that the data was not changed in transit. It is like a wax seal on a letter, proving who sent it and that nobody broke into the envelope. However, the Authentication Header does not scramble the contents of the letter. It verifies, but it does not hide. The second and more commonly used component is called the Encapsulating Security Payload, or ESP. This one does both jobs: it encrypts the data to keep it secret, and it also checks for tampering to maintain integrity. Most modern IPsec systems rely on ESP rather than AH, precisely because confidentiality is such a critical requirement. The third component is called IKE, which stands for Internet Key Exchange. Before two systems can begin encrypting data, they need to agree on which encryption methods to use and they need to securely exchange the keys that will lock and unlock the data. Doing this securely is a significant technical challenge, because the two systems must negotiate without an attacker being able to intercept the keys. IKE manages this negotiation. The modern version, called IKEv2, is faster, more reliable, and better suited to mobile users who frequently switch between networks, such as moving from a home Wi-Fi connection to a mobile data connection. IPsec can operate in two different modes. In Tunnel Mode, the entire original data packet, including the addressing information on its envelope, is completely encrypted and wrapped inside a new packet. It is like taking your original sealed letter, putting it inside a plain brown box with a completely different address on the outside, and then sending that box. Nobody who sees the box knows what is inside, who originally sent the original letter, or even what the internal address is. This mode is the standard choice for site-to-site VPNs. In Transport Mode, only the contents of the packet are encrypted, while the original addressing information on the outside remains visible. This is like encrypting the letter inside the envelope but leaving the envelope's address uncovered. This is used for direct, host-to-host communication rather than for building network tunnels. One practical challenge with IPsec is that it can sometimes be blocked by strict firewalls. A firewall is a system that controls what network traffic is allowed in and out, and some firewalls do not permit the specific network ports and protocols that IPsec uses. This is where SSL/TLS VPNs have a significant advantage. SSL and TLS are closely related protocols. SSL, which stands for Secure Sockets Layer, was the original technology but is now considered outdated and insecure. TLS, which stands for Transport Layer Security, is its modern replacement and is what actually runs when you see the padlock symbol in your web browser's address bar when visiting a secure website. When people say SSL VPN today, they almost always mean a VPN that uses TLS underneath, but the older name has stuck out of habit. The reason SSL/TLS VPNs are so useful for remote access is simple: they use the same network door that web browsers use to access secure websites. That door is called TCP port 443. A port, in this context, is like a numbered gate in an airport. Different types of traffic are sent through different numbered gates. HTTPS web traffic uses gate number 443. Because almost every firewall in the world, in every hotel, coffee shop, and airport, leaves gate 443 open so that people can browse the web, an SSL VPN can almost always get through even when IPsec cannot. This makes SSL VPNs extremely reliable for travelling employees. There are two main ways an SSL VPN operates. The portal approach, which we touched on earlier, gives the user access through a web browser to a specific set of applications. The tunnel approach goes further, allowing all network traffic to flow through the SSL tunnel, giving the user full network access just like an IPsec VPN. The tunnel approach often requires a small piece of software to be downloaded, but because it can be delivered through the browser itself, the installation process is typically very smooth. Alongside IPsec and SSL/TLS, two other protocols deserve mention. OpenVPN is an open-source solution, meaning its code is publicly available for anyone to examine, test, and improve. It uses the TLS library to build its tunnels and is highly configurable, meaning it can be customised extensively to fit different security requirements. Its openness is actually a security strength, because thousands of expert eyes have reviewed its code looking for weaknesses. WireGuard is a newer protocol that has attracted enormous attention in recent years. It was designed to be simple. Its entire codebase, which is the collection of programming instructions that make it work, is dramatically smaller than that of OpenVPN or IPsec implementations. A smaller codebase is harder to hide mistakes in, which makes security auditing, the process of checking for flaws, easier and more reliable. WireGuard also delivers excellent performance, meaning it is fast. It is now included directly in the Linux operating system, which is a significant sign of trust from the technical community. Understanding the tools is only half the story. The other half, and in practice perhaps the more critical half, is using those tools correctly. A VPN built on strong protocols but configured carelessly is like a bank vault with a state-of-the-art door but a broken lock. The principles of secure configuration are what transform a potentially powerful tool into one that actually keeps your data safe. The first principle is strong authentication. Authentication means proving your identity when you connect to the VPN. For many years, organisations relied on a simple username and password. This is no longer considered sufficient on its own. Passwords can be stolen through phishing, which is when an attacker tricks a user into revealing their credentials on a fake website. They can be guessed if users choose weak ones. They can be leaked through data breaches at unrelated websites where users reused the same password. The modern standard is called Multi-Factor Authentication, or MFA. Multi-factor simply means requiring more than one type of proof. The common categories are something you know, like a password, something you have, like a physical device, and something you are, like a fingerprint. A typical MFA setup asks for a password and then a six-digit code generated by an app on the user's phone. Even if an attacker steals the password, they cannot connect without also having access to that physical phone. For site-to-site VPNs and corporate-managed devices, digital certificates are also used. A digital certificate is an electronic document that proves the identity of a device, rather like a passport for a computer, and it is much harder to steal than a password. The second principle concerns the specific encryption settings used. Not all encryption is equally strong. Some older encryption algorithms, which are the mathematical methods used to scramble data, have been found to have weaknesses over time. DES, which stands for Data Encryption Standard, was once the global standard but is now completely broken and can be cracked rapidly with modern computers. Triple DES, or 3DES, was created to extend the life of DES but is also now considered weak. MD5 and SHA-1 are hashing algorithms used for integrity checking and are also no longer considered safe for security purposes. A properly configured VPN today should use AES-256 for encryption. AES stands for Advanced Encryption Standard, and the 256 refers to the length of the key used to lock the data. A 256-bit key means there are more possible key combinations than there are atoms in the observable universe, making brute-force guessing, which means simply trying every possible key, completely impractical with current technology. For integrity checking, SHA-256 or stronger should be used. For the key exchange process handled by IKE, the configuration should use modern Diffie-Hellman groups, specifically group 14 or higher, or a more modern approach called Elliptic Curve Diffie-Hellman, often written as ECDH. These govern how the two ends of the VPN tunnel negotiate their shared secret keys without sending those keys across the network in a way that could be intercepted. The third principle is the idea of least privilege. Privilege here means access rights. The principle says that a user or system should be given access only to what it genuinely needs to do its job, and nothing more. In the context of VPNs, this means that connecting to the VPN should not automatically give a user access to every single server and resource on the entire corporate network. A customer service representative needs access to the customer database and the ticketing system. They almost certainly do not need access to the engineering team's code repositories or the finance team's payroll systems. Granting them unrestricted access creates unnecessary risk. If their VPN account were compromised, an attacker would have access to far more than they should. The secure approach is to create different user groups, each with a defined access policy that permits only what is necessary. Related to this principle is an important configuration choice called split-tunneling. This is worth examining in detail because it represents a genuine and ongoing debate in the security community. When a user connects to a VPN, one of two things can happen with their internet traffic. In the first approach, called a full tunnel, all of the user's traffic goes through the VPN. If they browse a news website, watch a streaming video, or send a personal email, all of that traffic first flows through the encrypted tunnel to the company's network, and then the company's network sends it out to the internet on their behalf. The security advantage of this is significant. The company's security systems, such as firewalls and malware detection tools, can inspect all of the user's traffic, including personal browsing, and catch threats before they reach the user's device or the corporate network. The disadvantage is that this consumes a great deal of the company's bandwidth, which is its internet capacity, and it can make the user's connection feel slower. In the second approach, called split-tunneling, only the traffic destined for the company's internal resources goes through the VPN tunnel. Everything else, personal web browsing, streaming video, social media, goes straight to the internet directly from the user's device without passing through the VPN. This gives the user a faster, more pleasant experience and saves significant corporate bandwidth. The security risk is that the user's device is simultaneously connected to both the trusted corporate network and the open, untrusted internet. If malware infects the user's device through their personal browsing, that malware could potentially use the open VPN tunnel to reach the corporate network. Security professionals who lean toward caution tend to disable split-tunneling and require full tunnels. Network engineers and users often push back because of the performance impact. Neither position is universally correct. The right answer depends on how sensitive the organisation's data is, the level of security controls on user devices, and how much performance degradation is acceptable. This is a decision each organisation must make deliberately, based on a clear understanding of the trade-offs. The fourth principle covers ongoing maintenance. VPN gateways are exceptionally attractive targets for attackers. They sit at the very edge of the network, they are internet-facing, and anyone who can compromise one potentially gains access to everything behind it. History has shown this clearly. Several widely publicised cyberattacks have started with attackers exploiting known vulnerabilities, which are security weaknesses, in VPN software from major vendors. These vulnerabilities were often known about and had patches, which are software updates that fix the flaw, available. The organisations that were attacked had simply not applied those patches in time. Keeping VPN software and firmware up to date is not optional. It is a fundamental security responsibility. Regular vulnerability scanning, which means systematically checking systems for known weaknesses, should include VPN gateways as a priority. The fifth principle applies specifically to remote access clients. It is a feature called a kill switch. A kill switch solves a specific problem: what happens if the VPN connection suddenly drops while the user is in the middle of transferring sensitive data? Without a kill switch, the user's operating system might automatically continue sending traffic over the regular, unencrypted internet connection, exposing the data. A kill switch is configured to immediately block all internet traffic from the device the moment the VPN tunnel disconnects. Nothing leaves the device until either the VPN connection is re-established or the user deliberately turns the kill switch off. It acts as a fail-safe, ensuring that an unexpected disconnection does not accidentally leak sensitive information. Before closing, it is worth touching on a contested area that many people encounter in daily life: commercial VPN services marketed to individual consumers. These are services advertised on podcasts, YouTube channels, and social media with promises of total privacy and security. They deserve some careful, measured evaluation. A well-configured commercial VPN does provide genuine privacy benefits. It prevents your internet service provider, which is the company that provides your home internet connection, from monitoring your browsing. It protects your traffic on public Wi-Fi networks in places like airports and coffee shops. It can prevent websites from easily identifying your precise location. However, the claim that most concerns security researchers is the no-logs promise. Many commercial VPN providers assert that they keep no records of what their users do. This is difficult to verify independently. The definition of logs, meaning records, is often vague. A provider might not keep records of which websites you visited but might still record when you connected, for how long, and how much data you used. That kind of metadata, which means data about your activity rather than the content of your activity, can sometimes be enough to link behaviour back to an individual. Additionally, the legal jurisdiction of the VPN provider matters considerably. A VPN company operating under the laws of a country with strong privacy protections is in a very different position from one operating in a country where the government can compel companies to hand over user data or secretly install monitoring tools. Third-party security audits, where independent firms examine a provider's systems and claims, are becoming more common and add some credibility, but they cannot guarantee ongoing compliance. The wise approach to commercial VPNs is to treat them as one useful tool among many for managing privacy online, rather than as an absolute guarantee of anonymity. A brief thought on the future. Much of the security that underpins VPNs today, particularly the key exchange methods and certain encryption algorithms, relies on mathematical problems that are extremely difficult for current computers to solve. The concern in the security research community is that quantum computers, which are a fundamentally different type of computing machine still in early development, could one day solve these mathematical problems much more quickly. If that happens, the encryption protecting today's VPNs could potentially become vulnerable. Researchers are currently working on a field called Post-Quantum Cryptography, which means developing new mathematical methods that would remain secure even against quantum computers. This work is ongoing, and standards organisations are beginning to publish new recommended algorithms. While this threat is not immediate, it is a reminder that cryptography, the science of secret communication that underlies all VPN security, must continuously evolve. To bring everything together, let us revisit the main ideas covered in this lesson. A Virtual Private Network creates a secure, encrypted tunnel for data travelling across the public internet, providing three core services: confidentiality by encrypting data, integrity by detecting tampering, and authentication by verifying identity. VPNs come in two primary shapes: Remote Access VPNs, which connect individual users to a private network, and Site-to-Site VPNs, which connect entire networks together permanently. The two dominant protocol families are IPsec, a powerful suite operating at the network layer that uses AH, ESP, and IKE as its key components, and SSL/TLS, which works through the same secure channel as web browsers and is therefore highly effective in restrictive network environments. OpenVPN and WireGuard are important alternatives, each with distinct strengths. Secure configuration requires strong multi-factor authentication, the exclusive use of modern and proven encryption standards while avoiding broken older ones, the principle of least privilege to limit what users can access, and a deliberate decision about split-tunneling based on the organisation's specific risk tolerance. Ongoing patching and the use of a kill switch are both essential safeguards. Finally, claims by commercial VPN providers should be evaluated critically, and the future challenge of quantum computing is an important horizon for the field to navigate thoughtfully.