What Are Virtual private networks?

Virtual private networks (VPNs) are secure communication overlays that establish encrypted, authenticated connections between endpoints across public networks such as the Internet. A VPN creates the appearance of a private, dedicated link between two parties by encapsulating traffic in encrypted tunnels, shielding the content and metadata of communications from intermediate network nodes. The technology draws on cryptographic protocols developed in the 1990s and has become a standard tool for extending private local area networks (LANs) across wide area networks (WANs) without requiring dedicated leased-line infrastructure.

VPNs serve two primary use cases in enterprise and consumer contexts. In site-to-site deployments, they connect the networks of geographically separate offices as if they shared a common LAN, allowing systems at each location to communicate over Internet transport with the same security properties as a physical private network. In remote-access deployments, individual clients connect to an organization's internal network from outside, authenticating themselves and receiving an address on the private network for the duration of the session.

Tunneling and Encapsulation

The fundamental mechanism of a VPN is tunneling: the original IP packet, including its headers, is encrypted and wrapped inside a new packet addressed to the VPN gateway or remote endpoint. This outer packet traverses the public Internet using ordinary routing; only the endpoints know the content of the inner packet. The tunneling protocol determines how encapsulation and de-encapsulation are performed at each end. IPsec, the most widely deployed enterprise tunneling protocol, operates at the network layer in either transport mode, which encrypts only the payload, or tunnel mode, which encrypts the entire original IP packet and is standard for site-to-site VPNs. WireGuard, a more recent protocol, uses a simplified handshake based on Curve25519 key exchange and ChaCha20-Poly1305 authenticated encryption, achieving lower latency and smaller code size than IPsec implementations. The Cloudflare explanation of IPsec describes how IPsec's two-phase negotiation establishes session keys and security associations before data transfer begins.

Encryption and Authentication

Data confidentiality in a VPN rests on symmetric encryption of the tunnel payload after a key exchange phase. AES-256 in GCM mode is the dominant cipher in current deployments, chosen for its combination of high throughput on modern processors and strong authenticated-encryption properties. Key exchange typically relies on the Diffie-Hellman algorithm or its elliptic-curve variant (ECDH), allowing two parties to derive a shared secret over an untrusted channel without transmitting the key itself. Authentication verifies that both endpoints are who they claim to be, using digital certificates issued by a certificate authority in enterprise PKI deployments, or pre-shared keys in simpler configurations. The IETF has standardized the IKEv2 protocol for IPsec key exchange, documented in RFC 7296 on the datatracker, which defines the negotiation process for cipher suites, authentication methods, and session lifetimes.

VPN Architectures and Deployment Models

Enterprise VPN architectures distinguish between managed VPN services, where a service provider operates the tunnel infrastructure, and self-managed deployments using open-source or vendor software on the organization's own gateways. SSL/TLS-based VPNs, often delivered as clientless web portals, allow remote users to reach internal applications through a browser without installing dedicated software. Layer 2 VPN technologies such as MPLS-based pseudowires extend virtual LAN segments across service provider networks, giving enterprises traffic-engineering capabilities not available over plain Internet paths. A Palo Alto Networks overview of VPN tunnel types outlines how organizations select architectures based on the sensitivity of the data, the performance requirements of the applications, and the administrative complexity they can sustain.

Applications

Virtual private networks have applications across enterprise, government, and consumer contexts, including:

• Remote workforce access to corporate intranets and file servers
• Secure interconnection of branch offices and data centers
• Protection of communications on untrusted public Wi-Fi networks
• Regulated data transfer compliant with healthcare and financial privacy requirements
• Research network access and academic collaboration across institutional boundaries