VPN Deep-Dive
IntermediateA VPN (Virtual Private Network) creates an encrypted tunnel over a public network, allowing remote devices to securely access private resources as if they were on the same local network.
Overview
A VPN encrypts and encapsulates IP packets inside another protocol, routing them through a secure tunnel. Site-to-site VPNs connect entire office networks; remote-access VPNs let individual users connect to a corporate network. Modern VPN protocols include IPsec (used extensively in enterprise and cloud), OpenVPN (flexible, open-source), and WireGuard (modern, minimal, very fast). In cloud architectures, VPNs are used to connect on-premise data centres to VPCs (AWS VPN Gateway, Azure VPN). Understanding VPN is critical for cloud networking and hybrid architecture interviews.
How a VPN Tunnel Works
A VPN client encapsulates the original IP packet inside a new packet destined for the VPN server. The inner packet is encrypted. The VPN server decapsulates and decrypts the inner packet, then forwards it to the private network. From the private network's perspective, the traffic originates from the VPN server's IP.
// VPN encapsulation (IPsec Tunnel Mode):
//
// Original packet:
// [ IP Header: 192.168.1.5 → 10.0.0.20 | TCP | HTTP data ]
//
// After IPsec encapsulation (ESP Tunnel Mode):
// [ Outer IP Header: 203.0.113.5 → 198.51.100.1 | ESP Header | ENCRYPTED: [ IP | TCP | HTTP ] | ESP Trailer ]
// ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
// VPN client's public IP → VPN gateway IP IPsec header Original packet, encrypted
//
// Steps:
// 1. VPN client intercepts packet destined for 10.0.0.20
// 2. Encrypts it with shared IPsec session key
// 3. Wraps in new IP packet to VPN gateway (198.51.100.1)
// 4. Gateway receives, decrypts inner packet
// 5. Forwards to 10.0.0.20 on private networkIPsec: IKE & ESP
IPsec uses two sub-protocols: IKE (Internet Key Exchange) to negotiate cryptographic parameters and establish shared keys, and ESP (Encapsulating Security Payload) to encrypt and authenticate the actual data. IKEv2 is the modern standard — it supports MOBIKE (seamless roaming between networks) and is faster to establish than IKEv1.
// IPsec two phases:
// Phase 1 (IKE_SA_INIT): establish secure channel for key negotiation
// - Diffie-Hellman key exchange
// - Agree on encryption/auth algorithms
// - Authenticate peers (certificates or PSK)
//
// Phase 2 (IKE_AUTH + CREATE_CHILD_SA): establish ESP tunnel
// - Derive IPsec session keys (AES-256-GCM)
// - Create Security Associations (SA) for each direction
//
// Security Association (SA) — stored in Security Association Database (SAD):
// {
// SPI: 0xA3F2..., // Security Parameter Index
// destination: 10.0.0.20,
// protocol: ESP,
// encryption: AES-256-GCM,
// key: <session key>,
// lifetime: 3600 seconds
// }
// AWS Site-to-Site VPN uses IKEv2 with AES-256, SHA-256, DH Group 14+WireGuard vs OpenVPN vs IPsec
WireGuard is a modern VPN protocol built into the Linux kernel (since 5.6). Its codebase is ~4,000 lines vs OpenVPN's ~100,000 — resulting in faster handshake, lower latency, and a much smaller attack surface. OpenVPN is mature, highly configurable, and works on any port. IPsec is the enterprise/cloud standard.
// WireGuard configuration (minimal, ~10 lines):
// Server (/etc/wireguard/wg0.conf):
[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <server_private_key>
[Peer]
PublicKey = <client_public_key>
AllowedIPs = 10.8.0.2/32
// Client (/etc/wireguard/wg0.conf):
[Interface]
Address = 10.8.0.2/24
PrivateKey = <client_private_key>
[Peer]
PublicKey = <server_public_key>
Endpoint = 203.0.113.1:51820
AllowedIPs = 0.0.0.0/0 // route all traffic through VPN
// WireGuard uses: Curve25519 (ECDH), ChaCha20-Poly1305, BLAKE2s, SipHash
// Handshake: 1 RTT (much faster than IKEv2 4 messages)Split Tunnelling
Full-tunnel VPN routes ALL traffic through the VPN — maximising security but increasing latency and load on the corporate gateway. Split-tunnel VPN only routes traffic destined for private resources through the VPN; internet traffic goes directly. Split tunnelling reduces latency for general browsing but may bypass corporate security controls.
// Full tunnel: all traffic through VPN
AllowedIPs = 0.0.0.0/0, ::/0 // WireGuard — route everything
// Split tunnel: only private subnets through VPN
AllowedIPs = 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
// Routing table with split tunnel (client):
// Destination Gateway Interface
// 0.0.0.0/0 192.168.1.1 eth0 ← internet via local router
// 10.0.0.0/8 10.8.0.1 wg0 ← corporate via VPN
// 172.16.0.0/12 10.8.0.1 wg0 ← corporate via VPN
// Trade-offs:
// Full tunnel → max security, higher latency, VPN gateway bottleneck
// Split tunnel → better performance, VPN doesn't control internet trafficKey Points to Remember
- 1A VPN encapsulates and encrypts the original IP packet inside a new packet, creating a secure tunnel over an untrusted network.
- 2IPsec uses two phases: IKE for key negotiation and ESP for encrypted data transport.
- 3WireGuard is a modern, minimal VPN protocol (~4,000 lines of kernel code) — faster and simpler than OpenVPN or IPsec.
- 4Split tunnelling routes only private traffic through the VPN, reducing latency for internet browsing at the cost of reduced visibility.
- 5AWS Site-to-Site VPN uses IKEv2 with AES-256 to connect on-premise data centres to VPCs over the public internet.
Interview Questions
Sign in to ask AriaHow does a VPN tunnel work at the packet level?
What are the two phases of IPsec negotiation?
What is split tunnelling and what are its trade-offs?
Compare WireGuard, OpenVPN, and IPsec — when would you choose each?
How would you connect an on-premise data centre to AWS securely?
Ask Aria about VPN Deep-Dive
Your personal AI tutor — ask anything about this concept
Revision Status
Personal Notes
Sign in to save personal notes for this topic.
Discussion
Sign in to join the discussion.