What is VPN?

A VPN (Virtual Private Network) carries private traffic across a public network, usually in an encrypted tunnel, as if the ends were directly connected.

The router or client at each end takes packets meant for the private network, wraps them in a new outer packet addressed to the other end of the tunnel, and usually encrypts and authenticates them. The internet in between sees only traffic between the two tunnel endpoints, not the private addresses inside. Common protocols are IPsec, WireGuard and OpenVPN; WireGuard, for example, runs over UDP and is configured with public keys and, for each peer, the list of addresses that may be routed through that peer (AllowedIPs). VPNs come in two broad shapes:

• Site-to-site: two routers join whole networks, such as a branch office's LAN and the head office's.
• Remote access: a laptop or phone joins an organisation's network from anywhere.

The word covers more than encrypted tunnels. A provider's L3VPN over MPLS, or EVPN, keeps customers' traffic separated using labels and VRFs, without encrypting it, and consumer "VPN services" are mostly about hiding your traffic from the local network. For engineers, the usual problems with tunnel VPNs are routing and size: both ends need routes for the remote networks pointing into the tunnel, the allowed-address lists must match those routes, and the tunnel's extra headers reduce the MTU, which can break large packets unless MSS clamping is in place. If one side sits behind NAT, the tunnel must be able to cross it. The Site-to-site VPN with WireGuard on VyOS lesson joins two sites across the internet, including the AllowedIPs mistake and the tunnel's smaller MTU.