Virtual Private Networks: Tunneling Protocols, IPsec & WireGuard

In a distributed computing world where remote workers connect from untrusted coffee shop Wi-Fi and corporate data centers bridge across cloud regions, transmitting unencrypted data across the public internet is catastrophic. A Virtual Private Network (VPN) creates an encrypted, authenticated communications tunnel over an untrusted physical network, ensuring confidentiality, data integrity, and sender authentication.

VPN Architectures: Remote Access vs. Site-to-Site

Remote Access VPN (Client-to-Gateway): Individual remote employees run software on their laptops (e.g. WireGuard or Cisco AnyConnect) to establish an encrypted tunnel to the corporate gateway router, accessing internal file shares securely.
Site-to-Site VPN (Gateway-to-Gateway): Connects two entire branch office LANs across the internet transparently. Individual office computers need no client software; perimeter routers handle encryption automatically.

Deep Dive: The IPsec Protocol Suite

IPsec (Internet Protocol Security) operates at Layer 3 (Network Layer), encrypting all protocols above it (TCP, UDP, ICMP). IPsec consists of two primary protocols and two operational modes:

IPsec Component	Operational Functionality	Security Services Provided
Authentication Header (AH)	Calculates a cryptographic hash across the IP header and payload.	Provides Integrity & Authentication ONLY. Zero Encryption / No Confidentiality!
Encapsulating Security Payload (ESP)	Encrypts the packet payload using AES-GCM and appends authentication data.	Provides Confidentiality, Integrity, and Authentication. Industry standard!
Transport Mode	Encrypts only the IP payload; keeps the original IP header visible.	Used primarily for direct host-to-host communications on a private network.
Tunnel Mode	Encrypts the entire original IP packet and wraps it inside a brand new IP header.	Mandatory standard for Site-to-Site VPNs; hides internal subnet addressing.

Comparing Modern VPN Technologies: IPsec vs OpenVPN vs WireGuard

Metric	IPsec (IKEv2)	OpenVPN	WireGuard
OSI Layer	Layer 3 (Network)	Layer 4 (Transport / SSL-TLS)	Layer 3 (Kernel module)
Codebase Size	100,000+ lines of C code	120,000+ lines of code	~4,000 lines of code!
Cryptographic Primitives	Negotiable (supports legacy DES, 3DES, AES)	Negotiable via OpenSSL library	Opinionated Modern: ChaCha20, Poly1305, Curve25519, BLAKE2s
Performance & Speed	High (Kernel-level)	Moderate (User-space context switches)	Blazing Fast (Instant connection handshake)

Sample WireGuard Server Configuration (wg0.conf)

[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = aAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
SaveConfig = true

[Peer]
PublicKey = bBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=
AllowedIPs = 10.0.0.2/32

Frequently Asked Questions (FAQ) - Student & Interview Review

Q1. Why is WireGuard considered revolutionary compared to OpenVPN?

WireGuard contains only ~4,000 lines of code (compared to 100,000+ lines in OpenVPN), making security audits dramatically easier, reducing vulnerabilities, and achieving massive throughput performance because it runs directly inside the Linux kernel.

Q2. Does IPsec Authentication Header (AH) work with NAT routers?

No! AH calculates a cryptographic checksum across the entire IP header, including the source and destination IP addresses. Because NAT modifies the source IP address during transit, the AH integrity check fails, breaking the connection.