VPN Types by Purpose
Remote access VPN: connects individual remote users to the corporate network over the internet. The user's device runs a VPN client that establishes an encrypted tunnel to a VPN concentrator/gateway. Traffic from the user's device travels through the tunnel to the corporate network — the user appears to be locally connected. Enables secure home working and travel access.
Site-to-site VPN: connects two or more network sites over the internet as if they were directly connected via a private WAN link. The VPN tunnel is established between router/firewall appliances at each site — no client software required on user devices. Common use: connecting branch offices to headquarters. Traffic from branch users to HQ resources flows through the tunnel.
Split tunneling: only traffic destined for corporate networks travels through the VPN; internet-bound traffic goes directly to the internet. Reduces VPN bandwidth and latency for internet access. Full tunnel: all traffic (including internet) routes through the VPN — provides additional security/inspection but increases VPN load.
VPN Protocols
IPsec (Internet Protocol Security): the most widely used VPN protocol suite. Two modes: Tunnel mode (encrypts entire original packet — used for VPNs, adds new IP header) and Transport mode (encrypts only payload — used for host-to-host). Two protocols: AH (Authentication Header) provides integrity and authentication only — no encryption. ESP (Encapsulating Security Payload) provides encryption, integrity, and authentication — used for VPNs. IKE (Internet Key Exchange) handles key negotiation and SA (Security Association) establishment. Ports: IKE uses UDP 500; NAT traversal uses UDP 4500.
SSL VPN (TLS-based): uses standard HTTPS (TCP 443) — works through firewalls that allow HTTPS. Two types: clientless (browser-based, no software install) for portal access, and client-based (full-tunnel requiring software). Common in enterprise remote access. Examples: Cisco AnyConnect, Pulse Secure, Palo Alto GlobalProtect.
OpenVPN: open-source VPN using SSL/TLS, highly configurable, can use TCP or UDP. WireGuard: modern VPN protocol designed for simplicity and performance — uses state-of-the-art cryptography, UDP-based, much faster than OpenVPN or IPsec in practice.
PPTP (Point-to-Point Tunneling Protocol): legacy, uses MPPE encryption — considered insecure and deprecated. L2TP (Layer 2 Tunneling Protocol): provides tunneling but no encryption alone — combined with IPsec (L2TP/IPsec) for security. GRE (Generic Routing Encapsulation): tunneling without encryption — often combined with IPsec.