Wrapping One Network Inside Another

A tunnel takes packets from one network and encapsulates them inside the packets of another. The outer network only sees ordinary traffic; the inner network's addresses and protocols are hidden inside the payload. Tunneling is the basis of VPNs, cloud overlays, and secure site-to-site links.

What a VPN Actually Does

A Virtual Private Network creates an encrypted tunnel between a client and a VPN server. Your device sends all its traffic through the tunnel; the VPN server decrypts it and forwards it to the internet, so websites see the VPN server's IP rather than yours. The connection between you and the VPN server is protected, but the traffic is only as private as the VPN operator is trustworthy—the operator can see everything.

Tunneling Modes

  • Full tunnel: all traffic goes through the VPN. Standard for privacy and remote-work policies.
  • Split tunnel: only traffic to certain networks (e.g., the corporate intranet) uses the VPN; the rest goes directly. Better performance, weaker privacy.
  • Site-to-site: two networks (e.g., an office and a cloud VPC) are joined by a permanent tunnel between their gateways, transparent to end hosts.

The Main Protocols

  • IPsec: the classic enterprise VPN. It has two modes: transport mode (only the payload is encrypted; the original IP header is preserved) and tunnel mode (the entire packet, including its header, is encrypted and wrapped in a new packet). IPsec provides authentication and encryption at the IP layer.
  • WireGuard: a modern, minimalist tunnel. It uses a fixed set of strong cryptography, has a tiny codebase that is easy to audit, and is dramatically faster and simpler to configure than legacy IPsec stacks. It has become the default choice for new deployments.
  • OpenVPN: a mature, flexible TLS-based tunnel that runs over UDP or TCP and works through most firewalls.
  • GRE: a bare encapsulation protocol with no encryption. It is often combined with IPsec (GRE-over-IPsec) to carry routing protocols across a tunnel.

Encapsulation and MTU

Every layer of encapsulation adds header bytes, which reduces the size available for actual payload. If you wrap a 1,500-byte Ethernet packet inside an IPsec packet, the result exceeds the underlying MTU and must be fragmented—or dropped if a firewall forbids fragments. This is the notorious MTU problem: tunnels that work for small requests fail for large ones. The standard fix is MSS clamping or lowering the tunnel interface MTU.

Overlay Networks

Tunneling is not only about privacy. Cloud providers and Kubernetes build overlay networks (VXLAN, Geneve, WireGuard) that make thousands of machines across many data centers appear to be on one flat Layer 2 network. The physical network routes ordinary packets; the overlay provides the logical topology, enabling VM mobility, pod networking, and multi-tenant isolation.

When a VPN Is (and Isn't) the Right Tool

VPNs are excellent for remote access and joining networks. They are not a complete privacy solution: they move trust from your ISP to the VPN provider. For browsing privacy against the sites you visit, a well-configured browser with encrypted DNS and an anti-fingerprinting profile often does more than a VPN alone.