networks//VPN

A **virtual private network** (VPN) is an encrypted tunnel that carries IP packets between devices over a network they do not trust, so that the devices behave as if they shared a private network. Companies use it to reach internal services from outside, and individuals use it to reach their own machines at home or to send their traffic out through another location.

A virtual private network (VPN) is an encrypted tunnel that carries IP packets between devices over a network they do not trust, so that the devices behave as if they shared a private network. Companies use it to reach internal services from outside, and individuals use it to reach their own machines at home or to send their traffic out through another location.

A tunnel is encapsulation. The device takes a complete IP packet addressed to the private side, encrypts it, and wraps it as the payload of an ordinary packet addressed to the other end of the tunnel; the far end unwraps and decrypts it and delivers the inner packet as if it had arrived on a local cable. The operating system sees an extra network interface with its own addresses, and programs use it without knowing a tunnel exists. The price is a few dozen bytes of headers on every packet and a smaller maximum packet size inside.

The classic shape is hub and spoke: every client connects to one VPN server, and traffic between two clients passes through it. A mesh VPN gives every pair of devices its own direct tunnel, with a coordination service that only distributes keys and addresses (control plane); Tailscale is one.

A VPN protects traffic between its ends, not what happens at them: once a packet leaves the tunnel it is as exposed as any other, and a device inside the private network is reachable by every other device inside unless a firewall or access rules say otherwise.

The cryptography differs between protocols, IPsec, OpenVPN and WireGuard being the common ones. They differ less in strength than in how much code and configuration each needs, which is where most VPN failures come from.

Reaching a device behind NAT is the hard part of a mesh VPN, solved with NAT traversal and a relay when that fails.