VPN Protocols: IPsec, WireGuard, and OpenVPN
A virtual private network creates a protected path across a network that is not fully trusted. An employee can reach an internal service from a hotel network, two offices can exchange private traffic over the internet, or workloads in different environments can communicate as though a controlled network connected them.
The word VPN, however, describes a purpose rather than one protocol. IPsec, WireGuard, and OpenVPN can all carry IP traffic through encrypted tunnels, but they make very different choices about authentication, key management, packet encapsulation, routing, and deployment.
Those choices affect much more than configuration syntax. They determine:
- What a firewall sees on the outer network
- How peers prove their identities
- Which packets are eligible to enter the tunnel
- How the tunnel behaves through NAT
- What state an operator must inspect when communication fails
This chapter develops a practical model for all three protocol families and then applies the same troubleshooting method to each.