What is VPN?
Also known as: Virtual Private Network
VPN (Virtual Private Network) creates an encrypted tunnel from a remote device to a private network, making the remote endpoint appear as if it is directly connected to that network.
A Virtual Private Network (VPN) is a technology that establishes a secure, encrypted communication tunnel between a remote host and a private network gateway. Traffic sent through this tunnel is encapsulated and encrypted, preventing eavesdropping and tampering by anyone on the intermediate networks, such as the public internet. The remote endpoint is assigned an IP address from the private network's address space, and services on that network treat the VPN client as a local device.
Modern VPNs typically use protocols such as IPsec (RFC 4301), OpenVPN (SSL/TLS-based), or WireGuard (RFC 8446-based). The tunnel is established after an authentication handshake; both the client and the gateway verify each other's identity, often using certificates, pre-shared keys, or username/password credentials. Once the tunnel is active, all or selected traffic from the remote device is routed through it. The gateway decapsulates the traffic, forwards it to the intended internal destination, and routes return traffic back through the same encrypted channel.
VPNs sit in the network layer (Layer 3) or occasionally the transport layer (Layer 4) of the OSI model, depending on the protocol. They are a core component of enterprise remote-access architectures, site-to-site connectivity between branch offices, and consumer privacy services. While a VPN does not guarantee anonymity on its own (it only changes which network endpoint is visible to the server), it is the primary method for securely extending a private network across an untrusted public medium like the internet.
Key facts
- VPN creates an encrypted tunnel between a client and a VPN gateway.
- Remote devices appear as local nodes on the private network's LAN.
- Common protocols: IPsec (RFC 4301), OpenVPN, WireGuard.
- Authentication uses certificates, pre-shared keys, or passwords.
- VPN operates at Layer 3 (network) or Layer 4 (transport) of the OSI model.
How it works in practice
Related terms
References
More in Security
2FA
Two-factor authentication (2FA) is a security method that requires a user to present two distinct types of evidence to verify their identity, typically a password and a time-based one-time code from an authenticator app or hardware key.
Bot Management
Bot management detects automated web traffic and distinguishes it from human users, using behavioral fingerprinting and other signals to block malicious bots while allowing benign ones.
Credential Stuffing
Credential stuffing is a cyberattack in which automated tools use username-password pairs leaked from one site to try logging into other sites, exploiting password reuse.
DDoS
A DDoS (Distributed Denial of Service) attack overwhelms a target server, service, or network with massive traffic from many compromised computers, making it unavailable to legitimate users.
DDoS Scrubbing
DDoS scrubbing diverts attack traffic to a specialized filtering facility that removes malicious packets and forwards only legitimate traffic to the target network.
Firewall
A network security device or software that monitors and controls incoming and outgoing traffic based on predetermined security rules, acting as a barrier between trusted and untrusted networks.
IDS
An Intrusion Detection System (IDS) monitors network traffic or host activity for signs of malicious behavior or policy violations and generates alerts for security personnel.
IPS
An Intrusion Prevention System (IPS) is a network security device that monitors traffic inline and actively blocks malicious packets before they reach their target.
OAuth 2.0
OAuth 2.0 is an authorization framework that allows a user to grant a third-party application limited access to their resources on another service without revealing their password.
OpenID Connect
OpenID Connect (OIDC) is an identity authentication layer built on OAuth 2.0 that provides a signed ID token containing verified user identity claims.