What VPNs Solve

A Virtual Private Network creates a secure tunnel between two endpoints over an untrusted network (the internet). Inside the tunnel: your private network. Outside: encrypted bytes.

Why?

• Remote access: laptops at home access company intranet.
• Site-to-site: branch offices connected as one network.
• Privacy: hide traffic from local network (coffee shop, ISP).
• Geo unblock: appear to be in a different country.
• Cloud: connect on-prem to AWS VPC.

Two layers of confusion:

1. VPN = encrypted tunnel.
2. Inside the tunnel: IP packets routed as if you're inside the remote network.

Real VPN protocols:

• WireGuard: modern, simple, kernel-level fast (Linux kernel 5.6+).
• OpenVPN: TLS-based, mature, slower.
• IPsec: standardized, complex, hardware-accelerated.
• Tailscale: WireGuard + coordination layer (zero-config NAT traversal).
• PPTP: legacy, broken, don't use.

Architecture:

Client                                Server
  |                                     |
  | --- Encapsulated packets ---------> | (decrypt, route to internal net)
  | <-- Encapsulated reply -----------  |
  |                                     |

Each side has a TUN/TAP virtual interface. Packets sent to the TUN are encapsulated, encrypted, sent over UDP/TCP to the peer, decrypted, and "delivered" to the peer's TUN.

We'll build a WireGuard-style VPN: simplest cryptography, best performance.