Virtual private network: Difference between revisions

From Wikipedia, the free encyclopedia
Jump to navigation Jump to search
VisualWikitext
imported>Kvng
review: heading improvements. rm overly specific and unsourced.
 
imported>Apparition11
m Reverted edit by ~2025-34802-85 (talk) to last version by Rasptae
 
(One intermediate revision by one other user not shown)
Line 1: Line 1:
{{short description|Extension of a private network across a public one}}
{{More citations needed|date=September 2025}}{{short description|Extension of a private network across a public one}}
{{Redirect|VPN|other uses|VPN (disambiguation)|commercial services|VPN service}}
{{Redirect|VPN|other uses|VPN (disambiguation)|commercial services|VPN service}}
{{Use dmy dates|date=August 2017}}
{{Use dmy dates|date=August 2017}}
{{Use American English|date=April 2021}}
{{Use American English|date=April 2021}}[[File:Virtual Private Network overview.svg|thumb|upright=1.5|VPN connectivity overview, showing intranet site-to-site and remote-work configurations used together]]


'''Virtual private network''' ('''VPN''') is a [[network architecture]] for virtually extending a [[private network]] (i.e. any [[computer network]] which is not the public [[Internet]]) across one or multiple other networks which are either untrusted (as they are not controlled by the entity aiming to implement the VPN) or need to be isolated (thus making the lower network invisible or not directly usable).<ref name="NIST">{{Cite web |title=virtual private network |url=https://csrc.nist.gov/glossary/term/virtual_private_network |url-status=live |archive-url=https://web.archive.org/web/20230102230546/https://csrc.nist.gov/glossary/term/virtual_private_network |archive-date=2 January 2023 |access-date=2 January 2023 |website=NIST Computer Security Resource Center Glossary}}</ref>  
A '''virtual private network''' ('''VPN''') is an [[overlay network]] that uses [[network virtualization]] to extend a [[private network]] across a public network, such as the [[Internet]], via the use of [[encryption]] and [[tunneling protocol]]s.<ref name="NIST">{{Cite web |title=virtual private network |url=https://csrc.nist.gov/glossary/term/virtual_private_network |url-status=live |archive-url=https://web.archive.org/web/20230102230546/https://csrc.nist.gov/glossary/term/virtual_private_network |archive-date=2 January 2023 |access-date=2 January 2023 |website=NIST Computer Security Resource Center Glossary}}</ref> In a VPN, a tunneling protocol is used to transfer network messages from one [[Host (network)|network host]] to another.


A VPN can extend access to a private network to users who do not have direct access to it, such as an office network allowing secure access from off-site over the Internet.<ref name="Cisco">{{Cite web|title=What Is a VPN? - Virtual Private Network|url=https://www.cisco.com/c/en/us/products/security/vpn-endpoint-security-clients/what-is-vpn.html|access-date=2021-09-05|website=Cisco|language=en|archive-date=31 December 2021|archive-url=https://web.archive.org/web/20211231100706/https://www.cisco.com/c/en/us/products/security/vpn-endpoint-security-clients/what-is-vpn.html|url-status=live}}</ref> This is achieved by creating a link between [[computing device]]s and computer networks by the use of network [[tunneling protocol]]s.
Host-to-network VPNs are commonly used by organisations to allow off-site users secure access to an office network over the internet.<ref name="Cisco">{{Cite web |title=What Is a VPN? - Virtual Private Network |url=https://www.cisco.com/c/en/us/products/security/vpn-endpoint-security-clients/what-is-vpn.html |url-status=live |archive-url=https://web.archive.org/web/20211231100706/https://www.cisco.com/c/en/us/products/security/vpn-endpoint-security-clients/what-is-vpn.html |archive-date=31 December 2021 |access-date=2021-09-05 |website=Cisco |language=en}}</ref><ref>{{cite book |author=Mason, Andrew G. |url=https://archive.org/details/ciscosecurevirtu00andr |title=Cisco Secure Virtual Private Network |date=2002 |publisher=Cisco Press |isbn=978-1-58705-033-6 |page=[https://archive.org/details/ciscosecurevirtu00andr/page/7 7] |url-access=registration}}</ref> Site-to-site VPNs connect two networks, such as an office network and a datacenter. [[provider-provisioned VPN|Provider-provisioned VPNs]] isolate parts of the provider's own network infrastructure in virtual segments, in ways that make the contents of each segment private with respect to the others. Individuals also use VPNs to encrypt and [[Anonymous proxy|anonymize]] their [[network traffic]], with [[VPN service]]s selling access to their own private networks.


It is possible to make a VPN secure to use on top of insecure communication medium (such as the public internet) by choosing a tunneling protocol that implements [[encryption]]. This kind of VPN implementation has the benefit of reduced costs and greater flexibility, with respect to dedicated communication lines, for [[remote work]]ers.<ref>{{cite book |author= Mason, Andrew G. |title=Cisco Secure Virtual Private Network |url= https://archive.org/details/ciscosecurevirtu00andr |url-access= registration |publisher= Cisco Press |date= 2002 |page= [https://archive.org/details/ciscosecurevirtu00andr/page/7 7]|isbn=9781587050336 }}</ref>
VPNs can enhance usage privacy by making an ISP unable to access the private data exchanged across the VPN. Through [[encryption]], VPNs enhance [[Information security#Confidentiality|confidentiality]] and reduce the risk of successful [[Packet analyzer|data sniffing]] attacks.  


The term ''VPN'' is also used to refer to [[VPN service]]s which sell access to their own private networks for internet access by connecting their customers using VPN tunneling protocols.
== Background ==
{{Main|Computer network}}
A [[Computer network|network]] is a group of communicating [[Computer|computers]] known as [[Host (network)|hosts]], which [[Data communication|communicate data]] to other hosts via [[Communication protocol|communication protocols]], as facilitated by [[networking hardware]]. Within a computer network, computers are identified by [[Network address|network addresses]], which allow rule-based systems such as [[Internet Protocol]] to locate and identify hosts. Hosts may also have [[Hostname|hostnames]], memorable labels for the host [[Vertex (graph theory)|nodes]], which are rarely changed after initial assignment. The [[transmission medium]] that supports [[information exchange]] includes [[Wire|wired media]] like copper cables, [[optical fibers]], and wireless [[radio-frequency]] media. The arrangement of hosts and hardware within a [[network architecture]] is known as the [[network topology]].<ref>{{cite book |last1=Peterson |first1=Larry |url=https://book.systemsapproach.org/index.html |title=Computer Networks: A Systems Approach |last2=Davie |first2=Bruce |date=2000 |publisher=Harcourt Asia |isbn=978-981-4066-43-3 |location=Singapore |access-date=May 24, 2025}}</ref><ref>{{cite book |last=Anniss |first=Matthew |title=Understanding Computer Networks |date=2015 |publisher=Capstone |isbn=978-1-4846-0907-1 |location=United States}}</ref>


== Motivation ==
Apart from physical transmission media, networks comprise [[Node (networking)|network nodes]] such as [[Network interface controller|network interface controllers]], [[Repeater|repeaters]], [[Ethernet hub|hubs]], [[Network bridge|bridges]], [[Network switch|switches]], [[Router (computing)|routers]], and [[Modem|modems]]:
The goal of a virtual private network is to allow [[network host]]s to exchange network messages across another network to access private content, as if they were part of the same network. This is done in a way that makes crossing the intermediate network transparent to network applications. Users of a network connectivity service may consider such an intermediate network to be untrusted, since it is controlled by a third-party, and might prefer a VPN implemented via protocols that protect the privacy of their communication.


In the case of a [[Provider-provisioned VPN]], the goal is not to protect against untrusted networks, but to isolate parts of the provider's own network infrastructure in virtual segments, in ways that make the contents of each segment private with respect to the others. This situation makes many other tunneling protocols suitable for building PPVPNs, even with weak or no security features (like in [[VLAN]]).
* The [[network interface controller]] (NIC) is [[computer hardware]] that connects the computer to the [[network media]]. In Ethernet networks, each NIC has a unique [[MAC address|Media Access Control (MAC) address]], usually stored in the controller's permanent memory.
* A [[repeater]] is an electronic device that receives a network [[signal]], cleans it of unnecessary noise and regenerates it. The signal is [[Retransmission (data networks)|retransmitted]] at a higher power level, or to the other side of obstruction so that the signal can cover longer distances without degradation.
* An Ethernet repeater with multiple ports is known as an [[Ethernet hub]]. In addition to reconditioning and distributing network signals, a hub assists with collision detection and fault isolation for the network. Hubs and repeaters in LANs have been largely obsoleted by modern network switches.
* Unlike hubs, which forward communication to all ports, [[Network switch|network switches]] forward frames only to the ports involved in the communication. Switches normally have numerous ports, facilitating a star topology for devices, and for cascading additional switches. [[Network bridge|Network bridges]] are analogous to a two-port switch.
** Bridges and switches operate at the [[data link layer]] of the [[OSI model]] and bridge traffic between two or more [[Network segment|network segments]] to form a single local network. Both are devices that forward [[Frame (networking)|frames]] of data between [[Computer port (hardware)|ports]] based on the destination MAC address in each frame. [[Network segmentation]] through bridging and switching helps break down a large, congested network into an aggregation of smaller, more efficient networks.
* A [[Router (computing)|router]] is an internetworking device that forwards packets between networks by processing the addressing or routing information included in the packet.
* [[Modem|Modems]] (modulator-demodulator) are used to connect network nodes via wire not originally designed for digital network traffic, or for wireless.  


== Operation ==
=== Network communication ===
How a VPN works depends on which technologies and protocols the VPN is built upon. A [[tunneling protocol]] is used to transfer the network messages from one side to the other. The goal is to take network messages from applications on one side of the tunnel and replay them on the other side. Applications do not need to be modified to let their messages pass through the VPN, because the virtual network or link is made available to the OS.
A [[communication protocol]] is a set of rules for exchanging information over a network. Communication protocols have various characteristics, such as being [[connection-oriented]] or [[connectionless]], or using [[circuit switching]] or [[packet switching]].


Applications that do implement tunneling or [[Proxy pattern|proxying]] features for themselves without making such features available as a network interface, are not to be considered VPN implementations but may achieve the same or similar end-user goal of exchanging private contents with a remote network.
In a [[protocol stack]], often constructed per the [[OSI model]], communications functions are divided into protocol layers, where each layer leverages the services of the layer below it until the lowest layer controls the hardware that sends information across the media. The use of protocol layering is ubiquitous across the field of computer networking. An important example of a protocol stack is [[HTTP]], the [[World Wide Web]] protocol. HTTP runs over [[Transmission control protocol|TCP]] over [[Internet Protocol|IP]], the Internet protocols, which in turn run over [[IEEE 802.11]], the Wi-Fi protocol. This stack is used between a [[wireless router]] and a personal computer when accessing the web.


== Topology ==
Most modern computer networks use protocols based on [[Statistical time-division multiplexing|packet-mode]] transmission. A [[network packet]] is a formatted unit of [[data]] carried by a [[Packet switching|packet-switched]] network. Packets consist of two types of data: control information and user data (payload). The control information provides data the network needs to deliver the user data, for example, source and destination [[Network address|network addresses]], [[error detection]] codes, and sequencing information. Typically, control information is found in [[Header (computing)|packet headers]] and [[Trailer (computing)|trailers]], with [[payload data]] in between.
[[File:VPN classification-en.svg|thumb|upright=1.5|VPN classification tree based on the topology first, then on the technology used]]
 
[[File:Virtual Private Network overview.svg|thumb|upright=1.5|VPN connectivity overview, showing intranet site-to-site and remote-work configurations used together]]
The [[Internet protocol suite]], also called TCP/IP, is the foundation of all modern networking and the defining set of protocols for the Internet. It offers connection-less and connection-oriented services over an inherently unreliable network traversed by datagram transmission using Internet protocol (IP). At its core, the protocol suite defines the addressing, identification, and routing specifications for [[Internet Protocol Version 4]] (IPv4) and for [[IPv6]], the next generation of the protocol with a much enlarged addressing capability.<ref name="Tanenbaum">{{cite book |last=Tanenbaum |first=Andrew S. |author-link=Andrew S. Tanenbaum |title=Computer Networks |date=2003 |publisher=[[Prentice Hall]] |edition=4th}}</ref>
 
<!--=== Virtualization ===
*[[Open proxy]]
* [[Route distinguisher]]
* [[Virtual private cloud]]
* [[Virtual private server]]
* [[Virtual routing and forwarding]]-->
== Security ==
VPNs do not make connected users anonymous or unidentifiable to the untrusted medium network provider, such as an [[internet service provider]] (ISP). However, VPNs can enhance usage privacy by making an ISP unable to access the private data exchanged across the VPN. Through [[encryption]], VPNs enhance [[Information security#Confidentiality|confidentiality]] and reduce the risk of successful [[Packet analyzer|data sniffing]] attacks. [[Network packet|Data packets]] travelling across a VPN may also be secured by [[tamper proofing]] via a [[message authentication code]], prevents the message from being altered or [[Tamper-evident technology|tampered]] without being rejected, enhancing [[data integrity]].{{Citation needed|date=September 2025}}


Virtual private networks configurations can be classified depending on the purpose of the virtual extension, which makes different tunneling strategies appropriate for different topologies:
A number of other implementations exist to ensure [[authentication]] of connecting parties. [[Endpoint security|Tunnel endpoints]] can be authenticated in various ways during the VPN access initiation, such as by the whitelisting of endpoint [[IP address]]. Authentication may also occur after actual tunnels are already active, for example, with a [[Captive portal|web captive portal]]. Remote-access VPNs may also use [[passwords]], [[biometrics]], [[two-factor authentication]], or other [[cryptographic]] methods. Site-to-site VPNs often use passwords ([[Pre-shared key|pre-shared keys]]) or [[digital certificates]].{{Citation needed|date=September 2025}}


;Remote access
=== Split tunneling ===
: A ''host-to-network'' configuration is analogous to joining one or more computers to a network to which they cannot be directly connected. This type of extension provides that computer access to [[local area network]] of a remote site, or any wider enterprise networks, such as an [[intranet]]. Each computer is in charge of activating its own tunnel towards the network it wants to join. The joined network is only aware of a single remote host for each tunnel. This may be employed for [[remote work]]ers, or to enable people accessing their private home or company resources without exposing them on the public Internet. Remote access tunnels can be either on-demand or always-on. Because the remote host location is usually unknown to the central network until the former tries to reach it, proper implementations of this configuration require the remote host to initiate the communication towards the central network it is accessing.
[[Split tunneling]] allows a user to access distinct [[Security domain|security domains]] at the same time, using the same or different network connections.<ref>{{Cite web |title=What is VPN Split Tunneling? |url=https://www.fortinet.com/resources/cyberglossary/vpn-split-tunneling |access-date=2025-06-11 |website=Fortinet |language=en}}</ref> This connection state is usually facilitated through the simultaneous use of a LAN [[network interface controller]] (NIC), radio NIC, [[Wireless LAN]] NIC, and virtual private network client software application. Split tunneling is most commonly configured via the use of a remote-access VPN client, which allows the user to simultaneously connect to a nearby [[wireless network]], resources on an off-site [[Campus network|corporate network]], as well as websites over the internet.


;Site-to-site
Not every VPN allows split tunneling.<ref>{{Cite web |title=VPN split tunneling |url=https://nordvpn.com/features/split-tunneling/ |website=NordVPN}}</ref><ref>{{Cite web |last=Long |first=Moe |date=2021-07-22 |title=Best VPN for Split Tunneling |url=https://techuplife.com/best-vpn-split-tunneling |access-date=2021-10-21 |website=Tech Up Your Life |language=en-US}}</ref><ref>{{Cite web |title=What is VPN split tunneling? All you need to know |url=https://surfshark.com/features/split-tunneling |access-date=2025-06-11 |website=Surfshark |language=en-US}}</ref> Advantages of split tunneling include alleviating [[Bottleneck (network)|bottlenecks]], conserving [[Bandwidth (computing)|bandwidth]] (as internet traffic does not have to pass through the VPN server), and enabling a user to not have to continually connect and disconnect when remotely accessing resources..{{Citation needed|date=September 2025}} Disadvantages include [[DNS leak|DNS leaks]] and potentially bypassing gateway-level security that might be in place within the company infrastructure.<ref>{{citation |title=Remote Access VPN and a Twist on the Dangers of Split Tunneling |date=May 10, 2005 |url=http://techgenix.com/2004fixipsectunnel/ |access-date=2017-12-05}}</ref> [[Internet service provider|Internet service providers]] often use split tunneling to that implement for [[DNS hijacking]] purposes.
: A ''site-to-site'' configuration connects two networks. This configuration expands a network across geographically disparate locations. Tunneling is only done between gateway devices located at each network location. These devices then make the tunnel available to other local network hosts that aim to reach any host on the other side. This is useful to keep sites connected to each other in a stable manner, like office networks to their headquarters or datacenter. In this case, any side may be configured to initiate the communication as long as it knows how to reach the other.  


In the context of site-to-site configurations, the terms ''[[intranet]]'' and ''[[extranet]]'' are used to describe two different use cases.<ref>{{Cite IETF|title=RFC 3809 - Generic Requirements for Provider Provisioned Virtual Private Networks|rfc=3809|section=1.1}}</ref> An ''intranet'' site-to-site VPN describes a configuration where the sites connected by the VPN belong to the same organization, whereas an ''extranet'' site-to-site VPN joins sites belonging to multiple organizations.
== Classification ==
[[File:VPN classification-en.svg|thumb|upright=1.5|VPN classification tree based on the topology first, then on the technology used]]


Typically, individuals interact with remote access VPNs, whereas businesses tend to make use of site-to-site connections for [[business-to-business]], cloud computing, and [[branch office]] scenarios. However, these technologies are not mutually exclusive and, in a significantly complex business network, may be combined.
=== Topology ===
A ''host-to-network'' configuration is analogous to joining one or more computers to a network to which they cannot be directly connected. This type of extension provides computer access to a [[local area network]] of a remote site, or any wider enterprise networks, such as an [[intranet]]. Each computer is in charge of activating its own tunnel towards the network it wants to join. The joined network is only aware of a single remote host for each tunnel. This may be employed for [[remote work]]ers, or to enable people accessing their private home or company resources without exposing them on the public Internet. {{Citation needed|date=September 2025}}


Apart from the general topology configuration, a VPN may also be characterized by:
A ''site-to-site'' configuration connects two networks. This configuration expands a network across geographically disparate locations. Tunneling is only done between gateway devices located at each network location. These devices then make the tunnel available to other local network hosts that aim to reach any host on the other side. This is useful to keep sites connected to each other in a stable manner, like office networks to their headquarters or datacenter. In this case, any side may be configured to initiate the communication as long as it knows how to reach the other. In the context of site-to-site configurations, the terms ''[[intranet]]'' and ''[[extranet]]'' are used to describe two different use cases.<ref>{{Cite IETF|title=RFC 3809 - Generic Requirements for Provider Provisioned Virtual Private Networks|rfc=3809|section=1.1}}</ref> An ''intranet'' site-to-site VPN describes a configuration where the sites connected by the VPN belong to the same organization, whereas an ''extranet'' site-to-site VPN joins sites belonging to multiple organizations.{{Citation needed|date=September 2025}}
* the tunneling protocol used to [[IP tunnel|tunnel]] the traffic,
* the tunnel's termination point location, e.g., on the customer [[Edge device|edge]] or network-provider edge,
* the security features provided,
* the [[OSI model|OSI layer]] they present to the connecting network, such as [[Layer 2]] link/circuit or [[Layer 3]] network connectivity,
* the number of simultaneous allowed tunnels,
* the relationship between the actor implementing the VPN and the network infrastructure provider, and whether the former trusts the medium of the former or not


A variety of VPN technics exist to adapt to the above characteristics, each providing different network tunneling capabilities and different security model coverage or interpretation.
A limitation of traditional VPNs is that they are [[Point-to-point (telecommunications)|point-to-point]] connections and do not tend to support [[broadcast domain]]s. Therefore, communication, software, and networking that are based on [[OSI layer|layer 2]] and broadcast [[Network packet|packets]] (such as [[NetBIOS]] used in [[My Network Places|Windows networking]]) may not be fully supported as on a [[local area network]]. Variants on VPN such as [[Virtual Private LAN Service]] (VPLS) and layer 2 tunneling protocols are designed to overcome this limitation.<ref>{{Cite web |last=Sowells |first=Julia |date=2017-08-07 |title=Virtual Private Network (VPN): What VPN Is And How It Works |url=https://hackercombat.com/virtual-private-network/ |url-status=live |archive-url=https://web.archive.org/web/20220617083903/https://hackercombat.com/virtual-private-network/ |archive-date=17 June 2022 |access-date=2021-11-07 |website=Hackercombat}}</ref>


== Native and third-party support ==
=== Trusted and secure delivery networks ===
[[Operating system]]s vendors and developers do typically offer native support to a selection of VPN protocols. These are subject to change over the years, as some have been proven to be unsecure with respect to modern requirements and expectations, and others have emerged.
Trusted VPNs do not use cryptographic tunneling; instead, they rely on the security of a single provider's network to protect the traffic.<ref>{{Cite book |last=Cisco Systems, Inc. |url=https://books.google.com/books?id=3Dn9KlIVM_EC |title=Internetworking Technologies Handbook |publisher=Cisco Press |year=2004 |isbn=978-1-58705-119-7 |edition=4 |series=Networking Technology Series |page=233 |quote=<nowiki>[...] VPNs using dedicated circuits, such as Frame Relay [...] are sometimes called </nowiki>''trusted VPN''s, because customers trust that the network facilities operated by the service providers will not be compromised. |access-date=2013-02-15}}
</ref> [[Multiprotocol Label Switching]] (MPLS) often overlays trusted VPNs, often with quality-of-service control over a trusted delivery network. A secure VPN either trusts the underlying delivery network or enforces security with an internal mechanism. Unless the trusted delivery network runs among physically secure sites only, both trusted and secure models need an authentication mechanism for users to gain access to the VPN.{{fact|date=June 2023}}


=== Support in consumer operating systems ===
== Types ==
Desktop, smartphone and other end-user device operating systems usually support configuring remote access VPN from their [[Graphical user interface|graphical]] or [[Command-line interface|command-line]] tools.<ref>{{Cite web |title=Connect to a VPN in Windows - Microsoft Support |url=https://support.microsoft.com/en-us/windows/connect-to-a-vpn-in-windows-3d29aeb1-f497-f6b7-7633-115722c1009c |access-date=2024-07-11 |website=support.microsoft.com}}</ref><ref>{{Cite web |title=Connect to a virtual private network (VPN) on Android |url=https://support.google.com/android/answer/9089766?hl=en |access-date=11 July 2024}}</ref><ref>{{Cite web |title=VPN settings overview for Apple devices |url=https://support.apple.com/guide/deployment/vpn-settings-overview-dep2d2adb35d/web |access-date=2024-07-11 |website=Apple Support |language=en}}</ref> However, due to the variety of, often non standard, VPN protocols there exists many third-party applications that implement additional protocols not yet or no longer natively supported by the OS.


For instance, [[Android (operating system)|Android]] lacked native [[IPsec IKEv2]] support until version 11,<ref>{{Cite web |title=IPsec/IKEv2 Library |url=https://source.android.com/docs/core/ota/modular-system/ipsec |access-date=2024-07-11 |website=Android Open Source Project |language=en}}</ref> and users needed to install third-party apps in order to connect that kind of VPN. Conversely, Windows does not natively support plain IPsec IKEv1 remote access native VPN configuration (commonly used by [[Cisco Systems VPN Client|Cisco]] and [[Fritz!Box]] VPN solutions).
=== Mobile VPN ===
[[Mobile virtual private network]]s are used in settings where an endpoint of the VPN is not fixed to a single [[IP address spoofing|IP address]], but instead roams across various networks such as data networks from cellular carriers or between multiple [[Wi-Fi]] access points without dropping the secure VPN session or losing application sessions.<ref name="Phifer">Phifer, Lisa. [http://searchmobilecomputing.techtarget.com/tip/0,289483,sid40_gci1210989_mem1,00.html "Mobile VPN: Closing the Gap"] {{Webarchive|url=https://web.archive.org/web/20200706084816/https://searchmobilecomputing.techtarget.com/tip/Mobile-VPN-Closing-the-gap|date=6 July 2020}}, ''SearchMobileComputing.com'', 16 July 2006. <!--accessed November 10, 2009--></ref> Mobile VPNs are widely used in [[public safety]] where they give law-enforcement officers access to applications such as [[computer-assisted dispatch]] and criminal databases,<ref>Willett, Andy. [http://www.officer.com/print/Law-Enforcement-Technology/Solving-the-Computing-Challenges-of-Mobile-Officers/1$30992 "Solving the Computing Challenges of Mobile Officers"] {{Webarchive|url=https://web.archive.org/web/20200412161947/https://www.officer.com/print/Law-Enforcement-Technology/Solving-the-Computing-Challenges-of-Mobile-Officers/1$30992|date=12 April 2020}}, ''www.officer.com'', May, 2006. <!--accessed November 10, 2009--></ref> and in other organizations with similar requirements such as [[field service management]] and healthcare.<ref name="Cheng">Cheng, Roger. [https://www.wsj.com/articles/SB119717610996418467 "Lost Connections"] {{Webarchive|url=https://web.archive.org/web/20180328101055/https://www.wsj.com/articles/SB119717610996418467|date=28 March 2018}}, ''The Wall Street Journal'', 11 December 2007. <!--accessed November 10, 2009--></ref>{{qn|date=June 2018}}


=== Support in network devices ===
=== DMVPN ===
Network appliances, such as firewalls, often include VPN gateway functionality for either remote access or site-to-site configurations. Their administration interfaces often facilitate setting up virtual private networks with a selection of supported protocols. In some cases, like in the open source operating systems devoted to firewalls and network devices (like [[OpenWrt]], [[IPFire]], [[PfSense]] or [[OPNsense]]) it is possible to add support for additional VPN protocols by installing missing software components or third-party apps.<!--[[User:Kvng/RTH]]-->
[[Dynamic Multipoint Virtual Private Network]] (DMVPN)<ref name="Cisco2006">{{cite web |last1=Cisco engineers |title=Dynamic Multipoint IPsec VPNs (Using Multipoint GRE/NHRP to Scale IPsec VPNs) |url=https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/41940-dmvpn.html |access-date=24 September 2017 |website=Cisco |publisher=Cisco |language=en}}</ref> is a dynamic [[Tunneling protocol|tunneling]] form of a virtual private network supported on [[Cisco IOS]]-based [[Router (computing)|routers]], Huawei AR G3 routers,<ref>[http://support.huawei.com/enterprise/docinforeader.action?contentId=DOC1000019452&partNo=10092 Huawei DSVPN Configuration]</ref> and [[Unix]]-like operating systems.


Commercial appliances with VPN features based on proprietary hardware/software platforms, usually support a consistent VPN protocol across their products but do not open up for customizations outside the use cases they intended to implement. This is often the case for appliances that rely on hardware acceleration of VPNs to provide higher throughput or support a larger amount of simultaneously connected users.
DMVPN provides the capability for creating a [[Dynamic Mesh Communication|dynamic-mesh]] VPN network without having to statically pre-configure all possible tunnel end-point peers, such as [[IPsec]] and [[ISAKMP]] peers.<ref>{{Cite journal |last=Kurniadi |first=S. H. |last2=Utami |first2=E. |last3=Wibowo |first3=F. W. |date=Dec 2018 |title=Building Dynamic Mesh VPN Network using MikroTik Router |journal=Journal of Physics: Conference Series |language=en |volume=1140 |article-number=012039 |doi=10.1088/1742-6596/1140/1/012039 |issn=1742-6596 |doi-access=free}}</ref> DMVPN is initially configured to build a [[Spoke–hub distribution paradigm|hub-and-spoke network]] by statically configuring the hubs (VPN headends) on the spokes; no change in the configuration on the hub is required to accept new spokes. Using this initial hub-and-spoke network, tunnels between spokes are dynamically built on demand without additional configuration on the hubs or spokes. This dynamic-mesh capability alleviates the need for any load on the hub to route data between the spoke networks.{{Citation needed|date=June 2025}}


==Security mechanisms==
=== EVPN ===
Whenever a VPN is intended to virtually extend a private network over a third-party untrusted medium, it is desirable that the chosen protocols match the following security model:
[[Ethernet VPN]] (EVPN) is a technology for carrying [[Data link layer|OSI layer 2]] [[Ethernet]] traffic as a virtual private network using [[wide area network]] protocols. EVPN technologies include ''Ethernet over Multiprotocol Label Switching (MPLS)'' and ''Ethernet over [[Virtual Extensible LAN]].''<ref>{{Cite web |title=EVPN Overview - TechLibrary - Juniper Networks |url=https://www.juniper.net/documentation/en_US/junos/topics/concept/evpns-overview.html |archive-url=https://web.archive.org/web/20170511093441/http://www.juniper.net/documentation/en_US/junos/topics/concept/evpns-overview.html |archive-date=May 11, 2017 |access-date=2019-12-19 |website=www.juniper.net}}</ref><ref>{{Cite web |title=Understanding EVPN with VXLAN Data Plane Encapsulation - TechLibrary - Juniper Networks |url=https://www.juniper.net/documentation/en_US/junos/topics/concept/evpn-vxlan-data-plane-encapsulation.html |archive-url=https://web.archive.org/web/20170513024302/http://www.juniper.net/documentation/en_US/junos/topics/concept/evpn-vxlan-data-plane-encapsulation.html |archive-date=May 13, 2017 |access-date=2019-12-19 |website=www.juniper.net}}</ref>
* [[Information security#Confidentiality|confidentiality]] to prevent disclosure of private information or [[Packet analyzer|data sniffing]], such that even if the network traffic is sniffed at the packet level (see network sniffer or [[deep packet inspection]]), an attacker would see only [[Encryption|encrypted data]], not the raw data
* message [[Data integrity|integrity]] to detect and reject any instances of tampering with transmitted messages, [[Network packet|data packets]] are secured by [[Tamperproofing|tamper proofing]] via a [[message authentication code]] (MAC), which prevents the message from being altered or [[Tamper-evident technology|tampered]] without being rejected due to the MAC not matching with the altered data packet.
VPN are not intended to make connecting users anonymous or unidentifiable from the untrusted medium network provider perspective. If the VPN makes use of protocols that do provide those confidentiality features, their usage can increase user [[privacy]] by making the untrusted medium owner unable to access the private data exchanged across the VPN.


===Authentication===
=== MPLS VPN ===
In order to prevent unauthorized users from accessing the VPN, most protocols can be implemented in ways that also enable [[authentication]] of connecting parties. This secures the joined remote network confidentiality, integrity and availability.
[[Multiprotocol Label Switching]] (MPLS) is a routing technique in [[Telecommunications network|telecommunications networks]] that directs data from one [[Node (networking)|node]] to the next based on labels rather than network addresses.<ref>{{cite web |last1=Sturt |first1=Robert |last2=Rosencrance |first2=Linda |last3=Scarpati |first3=Jessica |date=28 March 2023 |title=What is Multiprotocol Label Switching (MPLS)? |url=https://searchnetworking.techtarget.com/definition/Multiprotocol-Label-Switching-MPLS |access-date=21 July 2025 |website=techtarget.com}}</ref> Whereas network addresses identify [[Communication endpoint|endpoints]], MPLS labels identify established paths between endpoints. MPLS can encapsulate packets of various [[Network protocol|network protocols]].


Tunnel endpoints can be authenticated in various ways during the VPN access initiation. Authentication can happen immediately on VPN initiation (e.g. by simple whitelisting of endpoint IP address), or very lately after actual tunnels are already active (e.g. with a [[Captive portal|web captive portal]]).
In practice, MPLS is mainly used to forward [[Internet Protocol|IP]] [[Protocol data unit|protocol data units]] and [[Virtual Private LAN Service]] Ethernet traffic. Major applications of MPLS are telecommunications traffic engineering and [[MPLS VPN]]. MPLS works in conjunction with the [[Internet Protocol]] (IP) and its routing protocols, usually [[Interior gateway protocol|interior gateway protocols]] (IGPs) and supports the creation of dynamic, transparent virtual networks with support for traffic engineering, the ability to transport layer VPNs with overlapping address spaces, and for layer-2 [[Pseudowire|pseudowires]] that are capable of transporting a variety of transport payloads ([[IPv4]], [[IPv6]], ATM, Frame Relay, etc.).<ref>{{IETF RFC|3031}}</ref>{{Ref RFC|3985}}


Remote-access VPNs, which are typically user-initiated, may use [[passwords]], [[biometrics]], [[two-factor authentication]], or other [[cryptographic]] methods. People initiating this kind of VPN from unknown arbitrary network locations are also called "road-warriors". In such cases, it is not possible to use originating network properties (e.g. IP addresses) as secure authentication factors, and stronger methods are needed.
=== VPLS ===
[[Virtual Private LAN Service]] (VPLS) is a virtual private network technology that provides Ethernet-based multipoint-to-multipoint communication over [[Internet protocol suite|IP]] or [[MPLS]] networks. It allows geographically dispersed sites to share an Ethernet [[broadcast domain]] by connecting sites (including both servers and clients) through [[Pseudowire|pseudowires]].<ref>{{cite web |author=H. Shah (Cisco Systems) |date=January 2015 |title=RFC 7436: IP‑Only LAN Service (IPLS) |url=https://www.ietf.org/rfc/rfc7436.html |access-date=2025-08-07 |publisher=IETF}}</ref> The technologies that can be used as pseudo-wire can be [[Carrier Ethernet#Ethernet over MPLS|Ethernet over MPLS]], [[L2TPv3]] or even [[Generic Routing Encapsulation|GRE]]. There are two [[IETF]] standards-track [[Request for Comments|RFCs]] (RFC 4761 and RFC 4762) describing VPLS establishment. In contrast to L2TPv3, which allows only [[Point-to-point (telecommunications)|point-to-point]] [[Data link layer|OSI layer 2]] tunnels, VPLS allows any-to-any (multipoint) connectivity.<ref>{{Cite report |url=https://datatracker.ietf.org/doc/rfc4761/ |title=Virtual Private LAN Service (VPLS) Using BGP for Auto-Discovery and Signaling |last=Rekhter |first=Yakov |last2=Kompella |first2=Kireeti |date=January 2007 |publisher=Internet Engineering Task Force |issue=RFC 4761}}</ref><ref>{{Cite report |url=https://datatracker.ietf.org/doc/rfc4762/ |title=Virtual Private LAN Service (VPLS) Using Label Distribution Protocol (LDP) Signaling |last=Lasserre |first=Marc |last2=Kompella |first2=Vach |date=January 2007 |publisher=Internet Engineering Task Force |issue=RFC 4762}}</ref>


Site-to-site VPNs often use passwords ([[Pre-shared key|pre-shared keys]]) or [[digital certificates]]. Depending on the VPN protocol, they may store the key to allow the VPN tunnel to establish automatically, without intervention from the administrator.
=== PPVPN ===
A [[provider-provisioned VPN]] (PPVPN) is a virtual private network (VPN) implemented by a connectivity service provider or large enterprise on a network they operate on their own, as opposed to a "customer-provisioned VPN" where the VPN is implemented by the customer who acquires the connectivity service on top of the technical specificities of the provider.


==Protocols==
==Protocols==
[[File:IPSec VPN-en.svg|300px|thumb|The life cycle phases of an IPSec tunnel in a virtual private network]]
[[File:IPSec VPN-en.svg|300px|thumb|The life cycle phases of an IPSec tunnel in a virtual private network]]
A virtual private network is based on a tunneling protocol, and may be possibly combined with other network or application protocols providing extra capabilities and different security model coverage.
A virtual private network is based on a [[tunneling protocol]], and may be combined with other [[Communication protocol|network]] or [[Application layer|application protocols]] to provide additional security and capabilities.


* [[Internet Protocol Security]] ([[Internet Protocol Security|IPsec]]) was initially developed by the [[Internet Engineering Task Force]] (IETF) for [[IPv6]], and was required in all standards-compliant implementations of IPv6 before RFC 6434 made it only a recommendation.{{ref RFC|6434|quote=Previously, IPv6 mandated implementation of IPsec and recommended the key management approach of IKE.  This document updates that recommendation by making support of the IPsec Architecture RFC4301 a SHOULD for all IPv6 nodes. |p=17}} This standards-based security protocol is also widely used with [[IPv4]]. Its design meets most security goals: [[Information security#Key concepts|availability, integrity, and confidentiality]]. IPsec uses encryption, [[Encapsulation (networking)|encapsulating]] an IP packet inside an IPsec packet. De-encapsulation happens at the end of the tunnel, where the original IP packet is decrypted and forwarded to its intended destination. IPsec tunnels are set up by [[Internet Key Exchange|Internet Key Exchange (IKE)]] protocol. IPsec tunnels made with IKE version 1 (also known as IKEv1 tunnels, or often just "IPsec tunnels") can be used alone to provide VPN, but have been often combined to the [[Layer 2 Tunneling Protocol|Layer 2 Tunneling Protocol (L2TP)]]. Their combination made possible to reuse existing L2TP-related implementations for more flexible authentication features (e.g. [[XAUTH|Xauth]]), desirable for remote-access configurations. IKE version 2, which was created by Microsoft and Cisco, can be used alone to provide IPsec VPN functionality. Its primary advantages are the native support for authenticating via the [[Extensible Authentication Protocol|Extensible Authentication Protocol (EAP)]] and that the tunnel can be seamlessly restored when the IP address of the associated host is changing, which is typical of a roaming mobile device, whether on [[3G]] or [[4G]] [[LTE (telecommunication)|LTE]] networks. IPsec is also often supported by network hardware accelerators,<ref>{{Cite web |title=Security for VPNs with IPsec Configuration Guide, Cisco IOS Release 15S - VPN Acceleration Module [Support] |url=https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnips/configuration/15-s/sec-sec-for-vpns-w-ipsec-15-s-book/sec-vam.html |access-date=2024-07-09 |website=Cisco |language=en}}</ref> which makes IPsec VPN desirable for low-power scenarios, like always-on remote access VPN configurations.<ref>{{Cite web |title=VPN overview for Apple device deployment |url=https://support.apple.com/guide/deployment/vpn-overview-depae3d361d0/web |access-date=2024-07-09 |website=Apple Support |language=en}}</ref><ref>{{Cite web |last= |date=2023-05-22 |title=About Always On VPN for Windows Server Remote Access |url=https://learn.microsoft.com/en-us/windows-server/remote/remote-access/overview-always-on-vpn |access-date=2024-07-09 |website=learn.microsoft.com |language=en-us}}</ref>
=== IPSec (1996) ===
* [[Transport Layer Security]] ([[Transport Layer Security|SSL/TLS]]) can tunnel an entire network's traffic (as it does in the [[OpenVPN]] project and [[SoftEther VPN]] project<ref>{{Cite web |title=1. Ultimate Powerful VPN Connectivity |url=https://www.softether.org/1-features/1._Ultimate_Powerful_VPN_Connectivity#SoftEther_VPN's_Solution:_Using_HTTPS_Protocol_to_Establish_VPN_Tunnels |website=www.softether.org |publisher=SoftEther VPN Project |access-date=8 October 2022 |archive-date=8 October 2022 |archive-url=https://web.archive.org/web/20221008211349/https://www.softether.org/1-features/1._Ultimate_Powerful_VPN_Connectivity#SoftEther_VPN's_Solution:_Using_HTTPS_Protocol_to_Establish_VPN_Tunnels |url-status=live }}</ref>) or secure an individual connection. A number of vendors provide remote-access VPN capabilities through TLS. A VPN based on TLS can connect from locations where the usual TLS web navigation ([[HTTPS]]) is supported without special extra configurations,
[[IPsec|Internet Protocol Security]] (IPsec) is a standards-based security protocol, initially developed by the [[Internet Engineering Task Force]] (IETF) for [[IPv6]], and was required in all standards-compliant implementations of IPv6 before RFC 6434 made it only a recommendation.{{ref RFC|6434|quote=Previously, IPv6 mandated implementation of IPsec and recommended the key management approach of IKE.  This document updates that recommendation by making support of the IPsec Architecture RFC4301 a SHOULD for all IPv6 nodes. |p=17}} It is also widely used with [[IPv4]].  
 
The design of IPSec meets most security goals: [[Information security#Key concepts|availability, integrity, and confidentiality]]. IPsec uses encryption, [[Encapsulation (networking)|encapsulating]] an IP packet inside an IPsec packet. De-encapsulation happens at the end of the tunnel, where the original IP packet is decrypted and forwarded to its intended destination. IPsec is also often supported by network hardware accelerators,<ref>{{Cite web |title=Security for VPNs with IPsec Configuration Guide, Cisco IOS Release 15S - VPN Acceleration Module [Support] |url=https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnips/configuration/15-s/sec-sec-for-vpns-w-ipsec-15-s-book/sec-vam.html |access-date=2024-07-09 |website=Cisco |language=en}}</ref> which makes IPsec VPN desirable for low-power scenarios, like always-on remote access VPN configurations.<ref>{{Cite web |title=VPN overview for Apple device deployment |url=https://support.apple.com/guide/deployment/vpn-overview-depae3d361d0/web |access-date=2024-07-09 |website=Apple Support |language=en}}</ref><ref>{{Cite web |last= |date=2023-05-22 |title=About Always On VPN for Windows Server Remote Access |url=https://learn.microsoft.com/en-us/windows-server/remote/remote-access/overview-always-on-vpn |access-date=2024-07-09 |website=learn.microsoft.com |language=en-us}}</ref>
 
IPsec tunnels are set up by the [[Internet Key Exchange|Internet Key Exchange (IKE)]] protocol. IPsec tunnels made with IKE version 1 (also known as IKEv1 tunnels, or often just "IPsec tunnels") can be used alone to provide VPN but are often combined with the [[Layer 2 Tunneling Protocol|Layer 2 Tunneling Protocol (L2TP)]] to reuse existing L2TP-related implementations for more flexible authentication features (e.g. [[X Window authorization|Xauth]]).
 
IKE version 2, which was created by Microsoft and Cisco, can be used alone to provide IPsec VPN functionality. Its primary advantages are the native support for authenticating via the [[Extensible Authentication Protocol|Extensible Authentication Protocol (EAP)]] and that the tunnel can be seamlessly restored when the IP address of the associated host is changing, which is typical of a roaming mobile device, whether on [[3G]] or [[4G]] [[LTE (telecommunication)|LTE]] networks.
 
=== TLS/SSL (1999) ===
[[Transport Layer Security]] (SSL/TLS) can tunnel an entire network's traffic (as it does in the [[OpenVPN]] project and [[SoftEther VPN]] project<ref>{{Cite web |title=1. Ultimate Powerful VPN Connectivity |url=https://www.softether.org/1-features/1._Ultimate_Powerful_VPN_Connectivity#SoftEther_VPN's_Solution:_Using_HTTPS_Protocol_to_Establish_VPN_Tunnels |website=www.softether.org |publisher=SoftEther VPN Project |access-date=8 October 2022 |archive-date=8 October 2022 |archive-url=https://web.archive.org/web/20221008211349/https://www.softether.org/1-features/1._Ultimate_Powerful_VPN_Connectivity#SoftEther_VPN's_Solution:_Using_HTTPS_Protocol_to_Establish_VPN_Tunnels |url-status=live }}</ref>) or secure an individual connection. A number of vendors provide remote-access VPN capabilities through TLS. A VPN based on TLS can connect from locations where the usual TLS web navigation ([[HTTPS]]) is supported without requiring additional configuration.
 
=== OpenSSH (1999) ===
[[OpenSSH]] offers VPN tunneling (distinct from [[port forwarding]]) to secure{{ambiguous|reason=unclear whether "secure" is a verb or adjective|date=March 2023}} remote connections to a network, inter-network links, and remote systems. OpenSSH server provides a limited number of concurrent tunnels. The VPN feature itself does not support personal authentication.<ref>{{Cite web |title=ssh(1) – OpenBSD manual pages |url=https://man.openbsd.org/ssh.1#SSH-BASED_VIRTUAL_PRIVATE_NETWORKS |url-status=live |archive-url=https://web.archive.org/web/20220705224554/https://man.openbsd.org/ssh.1#SSH-BASED_VIRTUAL_PRIVATE_NETWORKS |archive-date=5 July 2022 |access-date=4 February 2018 |website=man.openbsd.org}}
 
* {{Cite web |last=Barschel |first=Colin |title=Unix Toolbox |url=http://cb.vu/unixtoolbox.xhtml#vpn |archive-url=https://web.archive.org/web/20190528153959/http://cb.vu/unixtoolbox.xhtml#vpn |archive-date=28 May 2019 |access-date=2 August 2009 |website=cb.vu}}
* {{Cite web |title=SSH_VPN – Community Help Wiki |url=https://help.ubuntu.com/community/SSH_VPN |url-status=live |archive-url=https://web.archive.org/web/20220702025833/https://help.ubuntu.com/community/SSH_VPN |archive-date=2 July 2022 |access-date=28 July 2009 |website=help.ubuntu.com}}</ref> SSH is more often used to remotely connect to machines or networks instead of a site to site VPN connection.
 
=== OpenVPN (2001) ===
[[OpenVPN]] is a [[Free and open-source software|free and open-source]] VPN protocol based on the TLS protocol. It supports perfect [[Forward secrecy|forward-secrecy]], and most modern secure cipher suites, like [[Advanced Encryption Standard|AES]], [[Serpent (cipher)|Serpent]], [[Twofish|TwoFish]], etc. It is currently{{Current event inline|date=March 2023}} being developed and updated by OpenVPN Inc., a [[Nonprofit organization|non-profit]] providing secure VPN technologies.
 
=== SSTP (2007) ===
[[Secure Socket Tunneling Protocol|Secure Socket Tunneling Protocol (SSTP)]] is a form of VPN tunnel that provides a mechanism to transport [[Point-to-Point Protocol]] (PPP) traffic through an [[Transport Layer Security|SSL/TLS]] channel.
 
=== Wireguard (2015) ===
[[WireGuard]] is a protocol. In 2020, WireGuard support was added to both the Linux<ref>{{Cite web |last=Salter |first=Jim |date=2020-03-30 |title=WireGuard VPN makes it to 1.0.0—and into the next Linux kernel |url=https://arstechnica.com/gadgets/2020/03/wireguard-vpn-makes-it-to-1-0-0-and-into-the-next-linux-kernel/ |url-status=live |archive-url=https://web.archive.org/web/20200331182738/https://arstechnica.com/gadgets/2020/03/wireguard-vpn-makes-it-to-1-0-0-and-into-the-next-linux-kernel/ |archive-date=31 March 2020 |access-date=2020-06-30 |website=Ars Technica |language=en-us}}</ref> and Android<ref>{{Cite web |title=Diff - 99761f1eac33d14a4b1613ae4b7076f41cb2df94^! - kernel/common - Git at Google |url=https://android.googlesource.com/kernel/common/+/99761f1eac33d14a4b1613ae4b7076f41cb2df94%5E! |url-status=live |archive-url=https://web.archive.org/web/20220629213243/https://android.googlesource.com/kernel/common/+/99761f1eac33d14a4b1613ae4b7076f41cb2df94%5E! |archive-date=29 June 2022 |access-date=2020-06-30 |website=android.googlesource.com}}</ref> kernels, opening it up to adoption by VPN providers. By default, WireGuard utilizes the [[Curve25519]] protocol for [[key exchange]] and [[ChaCha20-Poly1305]] for encryption and message authentication, but also includes the ability to pre-share a [[Symmetric-key algorithm|symmetric key]] between the client and server.<ref>{{Cite journal |last=Younglove |first=R. |date=December 2000 |title=Virtual private networks - how they work |url=https://ieeexplore.ieee.org/document/892887 |journal=Computing & Control Engineering Journal |volume=11 |issue=6 |pages=260–262 |doi=10.1049/cce:20000602 |doi-broken-date=12 July 2025 |issn=0956-3385 |url-access=subscription}}{{dead link|date=July 2024|bot=medic}}{{cbignore|bot=medic}}
 
* {{Cite journal |last=Benjamin Dowling, and Kenneth G. Paterson |date=12 June 2018 |title=A cryptographic analysis of the WireGuard protocol |journal=International Conference on Applied Cryptography and Network Security |isbn=978-3-319-93386-3}}</ref>
 
=== Other ===
* [[Datagram Transport Layer Security]] ([[Datagram Transport Layer Security|DTLS]]) – used in Cisco [[AnyConnect]] VPN and in [[OpenConnect]] VPN<ref>{{Cite web |title=OpenConnect |url=https://www.infradead.org/openconnect/index.html |access-date=2013-04-08 |quote=<nowiki>OpenConnect is a client for Cisco's AnyConnect SSL VPN [...] OpenConnect is not officially supported by, or associated in any way with, Cisco Systems. It just happens to interoperate with their equipment.</nowiki> |archive-date=29 June 2022 |archive-url=https://web.archive.org/web/20220629202852/https://www.infradead.org/openconnect/index.html |url-status=live }}</ref> to solve the issues [[Transport Layer Security|TLS]] has with tunneling over [[Transmission Control Protocol|TCP]] (SSL/TLS are TCP-based, and tunneling TCP over TCP can lead to big delays and connection aborts<ref>{{Cite web |title=Why TCP Over TCP Is A Bad Idea |url=http://sites.inka.de/~W1011/devel/tcp-tcp.html |access-date=2018-10-24 |website=sites.inka.de |archive-date=6 March 2015 |archive-url=https://web.archive.org/web/20150306050429/http://sites.inka.de/~W1011/devel/tcp-tcp.html |url-status=live }}</ref>).
* [[Datagram Transport Layer Security]] ([[Datagram Transport Layer Security|DTLS]]) – used in Cisco [[AnyConnect]] VPN and in [[OpenConnect]] VPN<ref>{{Cite web |title=OpenConnect |url=https://www.infradead.org/openconnect/index.html |access-date=2013-04-08 |quote=<nowiki>OpenConnect is a client for Cisco's AnyConnect SSL VPN [...] OpenConnect is not officially supported by, or associated in any way with, Cisco Systems. It just happens to interoperate with their equipment.</nowiki> |archive-date=29 June 2022 |archive-url=https://web.archive.org/web/20220629202852/https://www.infradead.org/openconnect/index.html |url-status=live }}</ref> to solve the issues [[Transport Layer Security|TLS]] has with tunneling over [[Transmission Control Protocol|TCP]] (SSL/TLS are TCP-based, and tunneling TCP over TCP can lead to big delays and connection aborts<ref>{{Cite web |title=Why TCP Over TCP Is A Bad Idea |url=http://sites.inka.de/~W1011/devel/tcp-tcp.html |access-date=2018-10-24 |website=sites.inka.de |archive-date=6 March 2015 |archive-url=https://web.archive.org/web/20150306050429/http://sites.inka.de/~W1011/devel/tcp-tcp.html |url-status=live }}</ref>).
* [[Microsoft Point-to-Point Encryption]] ([[Microsoft Point-to-Point Encryption|MPPE]]) works with the [[Point-to-Point Tunneling Protocol]] and in several compatible implementations on other platforms.
* [[Microsoft Point-to-Point Encryption]] ([[Microsoft Point-to-Point Encryption|MPPE]]) works with the [[Point-to-Point Tunneling Protocol]] and in several compatible implementations on other platforms.
* Microsoft [[Secure Socket Tunneling Protocol]] ([[Secure Socket Tunneling Protocol|SSTP]]) tunnels [[Point-to-Point Protocol]] (PPP) or Layer 2 Tunneling Protocol traffic through an [[Transport Layer Security|SSL/TLS]] channel (SSTP was introduced in [[Windows Server 2008]] and in [[Windows Vista]] Service Pack 1).
* Microsoft [[Secure Socket Tunneling Protocol]] ([[Secure Socket Tunneling Protocol|SSTP]]) tunnels [[Point-to-Point Protocol]] (PPP) or Layer 2 Tunneling Protocol traffic through an [[Transport Layer Security|SSL/TLS]] channel (SSTP was introduced in [[Windows Server 2008]] and in [[Windows Vista]] Service Pack 1).
* Multi Path Virtual Private Network (MPVPN). Ragula Systems Development Company owns the registered [[trademark]] "MPVPN".{{relevance inline|date=March 2023}}<ref>{{Cite web |title=Trademark Status & Document Retrieval |url=https://tarr.uspto.gov/servlet/tarr?regser=serial&entry=78063238&action=Request+Status |website=tarr.uspto.gov |access-date=8 October 2022 |archive-date=21 March 2012 |archive-url=https://web.archive.org/web/20120321221027/http://tarr.uspto.gov/servlet/tarr?regser=serial&entry=78063238&action=Request+Status |url-status=live }}</ref>
* Multi Path Virtual Private Network (MPVPN). Ragula Systems Development Company owns the registered [[trademark]] "MPVPN".{{relevance inline|date=March 2023}}<ref>{{Cite web |title=Trademark Status & Document Retrieval |url=https://tarr.uspto.gov/servlet/tarr?regser=serial&entry=78063238&action=Request+Status |website=tarr.uspto.gov |access-date=8 October 2022 |archive-date=21 March 2012 |archive-url=https://web.archive.org/web/20120321221027/http://tarr.uspto.gov/servlet/tarr?regser=serial&entry=78063238&action=Request+Status |url-status=live }}</ref>
* Secure Shell (SSH) VPN – [[OpenSSH]] offers VPN tunneling (distinct from [[port forwarding]]) to secure{{ambiguous|reason=unclear whether "secure" is a verb or adjective|date=March 2023}} remote connections to a network, inter-network links, and remote systems. OpenSSH server provides a limited number of concurrent tunnels. The VPN feature itself does not support personal authentication.<ref>{{Cite web |title=ssh(1) – OpenBSD manual pages |url=https://man.openbsd.org/ssh.1#SSH-BASED_VIRTUAL_PRIVATE_NETWORKS |website=man.openbsd.org |access-date=4 February 2018 |archive-date=5 July 2022 |archive-url=https://web.archive.org/web/20220705224554/https://man.openbsd.org/ssh.1#SSH-BASED_VIRTUAL_PRIVATE_NETWORKS |url-status=live }}
*{{Cite web |last=Barschel |first=Colin |title=Unix Toolbox |url=http://cb.vu/unixtoolbox.xhtml#vpn |website=cb.vu |access-date=2 August 2009 |archive-date=28 May 2019 |archive-url=https://web.archive.org/web/20190528153959/http://cb.vu/unixtoolbox.xhtml#vpn |url-status=dead }}
*{{Cite web |title=SSH_VPN – Community Help Wiki |url=https://help.ubuntu.com/community/SSH_VPN |website=help.ubuntu.com |access-date=28 July 2009 |archive-date=2 July 2022 |archive-url=https://web.archive.org/web/20220702025833/https://help.ubuntu.com/community/SSH_VPN |url-status=live }}</ref> SSH is more often used to remotely connect to machines or networks instead of a site to site VPN connection.
* [[WireGuard]] is a protocol. In 2020, WireGuard support was added to both the Linux<ref>{{Cite web |last=Salter |first=Jim |date=2020-03-30 |title=WireGuard VPN makes it to 1.0.0—and into the next Linux kernel |url=https://arstechnica.com/gadgets/2020/03/wireguard-vpn-makes-it-to-1-0-0-and-into-the-next-linux-kernel/ |access-date=2020-06-30 |website=Ars Technica |language=en-us |archive-date=31 March 2020 |archive-url=https://web.archive.org/web/20200331182738/https://arstechnica.com/gadgets/2020/03/wireguard-vpn-makes-it-to-1-0-0-and-into-the-next-linux-kernel/ |url-status=live }}</ref> and Android<ref>{{Cite web |title=Diff - 99761f1eac33d14a4b1613ae4b7076f41cb2df94^! - kernel/common - Git at Google |url=https://android.googlesource.com/kernel/common/+/99761f1eac33d14a4b1613ae4b7076f41cb2df94%5E! |access-date=2020-06-30 |website=android.googlesource.com |archive-date=29 June 2022 |archive-url=https://web.archive.org/web/20220629213243/https://android.googlesource.com/kernel/common/+/99761f1eac33d14a4b1613ae4b7076f41cb2df94%5E! |url-status=live }}</ref> kernels, opening it up to adoption by VPN providers. By default, WireGuard utilizes the [[Curve25519]] protocol for [[key exchange]] and [[ChaCha20-Poly1305]] for encryption and message authentication, but also includes the ability to pre-share a symmetric key between the client and server.<ref>{{Cite journal|last=Younglove|first=R.|date=December 2000|title=Virtual private networks - how they work|url=https://ieeexplore.ieee.org/document/892887|journal=Computing & Control Engineering Journal|volume=11|issue=6|pages=260–262|doi=10.1049/cce:20000602|doi-broken-date=7 December 2024 |issn=0956-3385|url-access=subscription}}{{dead link|date=July 2024|bot=medic}}{{cbignore|bot=medic}}
*{{Cite journal|last=Benjamin Dowling, and Kenneth G. Paterson|title=A cryptographic analysis of the WireGuard protocol|journal=International Conference on Applied Cryptography and Network Security|date=12 June 2018|isbn=978-3-319-93386-3}}</ref>
*[[OpenVPN]] is a [[Free and open-source software|free and open-source]] VPN protocol based on the TLS protocol. It supports perfect [[Forward secrecy|forward-secrecy]], and most modern secure cipher suites, like [[Advanced Encryption Standard|AES]], [[Serpent (cipher)|Serpent]], [[Twofish|TwoFish]], etc. It is currently{{Current event inline|date=March 2023}} being developed and updated by OpenVPN Inc., a [[Nonprofit organization|non-profit]] providing secure VPN technologies.
*Crypto IP Encapsulation (CIPE) is a free and open-source VPN implementation for tunneling [[IPv4 packet]]s over [[User Datagram Protocol|UDP]] via [[Encapsulation (networking)|encapsulation]].<ref>{{cite book |last1=Fuller |first1=Johnray |last2=Ha |first2=John |date=2002 |title=Red Hat Linux 9: Red Hat Linux Security Guide |url=https://archive.download.redhat.com/pub/redhat/linux/9/en/doc/RH-DOCS/pdf-en/rhl-sg-en.pdf |location=United States |publisher=[[Red Hat|Red Hat, Inc.]] |pages=48–53 |access-date=8 September 2022 |archive-date=14 October 2022 |archive-url=https://web.archive.org/web/20221014101152/https://archive.download.redhat.com/pub/redhat/linux/9/en/doc/RH-DOCS/pdf-en/rhl-sg-en.pdf |url-status=live }}
*Crypto IP Encapsulation (CIPE) is a free and open-source VPN implementation for tunneling [[IPv4 packet]]s over [[User Datagram Protocol|UDP]] via [[Encapsulation (networking)|encapsulation]].<ref>{{cite book |last1=Fuller |first1=Johnray |last2=Ha |first2=John |date=2002 |title=Red Hat Linux 9: Red Hat Linux Security Guide |url=https://archive.download.redhat.com/pub/redhat/linux/9/en/doc/RH-DOCS/pdf-en/rhl-sg-en.pdf |location=United States |publisher=[[Red Hat|Red Hat, Inc.]] |pages=48–53 |access-date=8 September 2022 |archive-date=14 October 2022 |archive-url=https://web.archive.org/web/20221014101152/https://archive.download.redhat.com/pub/redhat/linux/9/en/doc/RH-DOCS/pdf-en/rhl-sg-en.pdf |url-status=live }}
*{{cite book |last=Petersen |first=Richard |date=2004 |title=Red Hat - The Complete Reference Enterprise Linux & Fedora Edition |url=http://litux.nl/Reference/index.html?page=books%2F7213%2Fddu0001.html |location=United States |publisher=[[McGraw-Hill Osborne|McGraw-Hill/Osborne]] |chapter=Chapter 17: Internet Protocol Security: IPsec, Crypto IP Encapsulation for Virtual Private Networks |chapter-url=http://litux.nl/Reference/index.html?page=books/7213/ddu0125.html |isbn=0-07-223075-4 |access-date=17 January 2023 |archive-date=17 January 2023 |archive-url=https://web.archive.org/web/20230117215057/http://litux.nl/Reference/index.html?page=books%2F7213%2Fddu0001.html |url-status=live }}</ref> CIPE was developed for [[GNU/Linux|Linux]] operating systems by Olaf Titz, with a [[Windows 2000|Windows]] [[Port (software)|port]] implemented by Damion K. Wilson.<ref>{{cite web |url=http://sites.inka.de/sites/bigred/devel/cipe.html |title=CIPE - Crypto IP Encapsulation |last=Titz |first=Olaf |date=2011-12-20 |website=CIPE - Crypto IP Encapsulation |access-date=2022-09-08 |archive-date=18 May 2022 |archive-url=https://web.archive.org/web/20220518123239/http://sites.inka.de/sites/bigred/devel/cipe.html |url-status=live }}</ref> Development for CIPE ended in 2002.<ref>{{cite web |url=https://sourceforge.net/projects/cipe-linux/ |title=CIPE - encrypted IP in UDP tunneling |last=Titz |first=Olaf |date=2013-04-02 |website=[[SourceForge]] |access-date=2022-09-08 |archive-date=8 September 2022 |archive-url=https://web.archive.org/web/20220908122718/https://sourceforge.net/projects/cipe-linux/ |url-status=live }}
*{{cite book |last=Petersen |first=Richard |date=2004 |title=Red Hat - The Complete Reference Enterprise Linux & Fedora Edition |url=http://litux.nl/Reference/index.html?page=books%2F7213%2Fddu0001.html |location=United States |publisher=[[McGraw-Hill Osborne|McGraw-Hill/Osborne]] |chapter=Chapter 17: Internet Protocol Security: IPsec, Crypto IP Encapsulation for Virtual Private Networks |chapter-url=http://litux.nl/Reference/index.html?page=books/7213/ddu0125.html |isbn=0-07-223075-4 |access-date=17 January 2023 |archive-date=17 January 2023 |archive-url=https://web.archive.org/web/20230117215057/http://litux.nl/Reference/index.html?page=books%2F7213%2Fddu0001.html |url-status=live }}</ref> CIPE was developed for [[GNU/Linux|Linux]] operating systems by Olaf Titz, with a [[Windows 2000|Windows]] [[Port (software)|port]] implemented by Damion K. Wilson.<ref>{{cite web |url=http://sites.inka.de/sites/bigred/devel/cipe.html |title=CIPE - Crypto IP Encapsulation |last=Titz |first=Olaf |date=2011-12-20 |website=CIPE - Crypto IP Encapsulation |access-date=2022-09-08 |archive-date=18 May 2022 |archive-url=https://web.archive.org/web/20220518123239/http://sites.inka.de/sites/bigred/devel/cipe.html |url-status=live }}</ref> Development for CIPE ended in 2002.<ref>{{cite web |url=https://sourceforge.net/projects/cipe-linux/ |title=CIPE - encrypted IP in UDP tunneling |last=Titz |first=Olaf |date=2013-04-02 |website=[[SourceForge]] |access-date=2022-09-08 |archive-date=8 September 2022 |archive-url=https://web.archive.org/web/20220908122718/https://sourceforge.net/projects/cipe-linux/ |url-status=live }}
*{{cite web |url=https://cipe-win32.sourceforge.net/ |title=CIPE-Win32 - Crypto IP Encapsulation for Windows NT/2000 |last=Wilson |first=Damion |date=2002-10-19 |website=[[SourceForge]] |access-date=2022-09-08 |archive-date=8 September 2022 |archive-url=https://web.archive.org/web/20220908122719/http://cipe-win32.sourceforge.net/ |url-status=live }}</ref>
*{{cite web |url=https://cipe-win32.sourceforge.net/ |title=CIPE-Win32 - Crypto IP Encapsulation for Windows NT/2000 |last=Wilson |first=Damion |date=2002-10-19 |website=[[SourceForge]] |access-date=2022-09-08 |archive-date=8 September 2022 |archive-url=https://web.archive.org/web/20220908122719/http://cipe-win32.sourceforge.net/ |url-status=live }}</ref>
*L2TP<ref>[https://www.ietf.org/rfc/rfc2661.txt Layer Two Tunneling Protocol "L2TP"] {{Webarchive|url=https://web.archive.org/web/20220630094743/https://www.ietf.org/rfc/rfc2661.txt|date=30 June 2022}}, {{IETF RFC|2661}}, W. Townsley ''et al.'', August 1999</ref> which is a standards-based replacement for two proprietary VPN protocols: Cisco's [[L2F|Layer 2 Forwarding (L2F)]]<ref>[https://www.ietf.org/rfc/rfc2341.txt IP Based Virtual Private Networks] {{Webarchive|url=https://web.archive.org/web/20220709081725/https://www.ietf.org/rfc/rfc2341.txt|date=9 July 2022}}, {{IETF RFC|2341}}, A. Valencia ''et al.'', May 1998</ref> (obsolete {{As of | 2009 | alt =as of 2009}}) and Microsoft's [[Point-to-Point Tunneling Protocol|Point-to-Point Tunneling Protocol (PPTP)]].<ref>[https://www.ietf.org/rfc/rfc2637.txt Point-to-Point Tunneling Protocol (PPTP)] {{Webarchive|url=https://web.archive.org/web/20220702054527/https://www.ietf.org/rfc/rfc2637.txt|date=2 July 2022}}, {{IETF RFC|2637}}, K. Hamzeh ''et al.'', July 1999</ref>


==Trusted delivery networks==
== Native and third-party support ==
Trusted VPNs do not use cryptographic tunneling; instead, they rely on the security of a single provider's network to protect the traffic.<ref>{{Cite book |last=Cisco Systems, Inc. |url=https://books.google.com/books?id=3Dn9KlIVM_EC |title=Internetworking Technologies Handbook |publisher=Cisco Press |year=2004 |isbn=9781587051197 |edition=4 |series=Networking Technology Series |page=233 |quote=<nowiki>[...] VPNs using dedicated circuits, such as Frame Relay [...] are sometimes called </nowiki>''trusted VPN''s, because customers trust that the network facilities operated by the service providers will not be compromised. |access-date=2013-02-15}}
Desktop, smartphone and other end-user device operating systems usually support configuring remote access VPN from their [[Graphical user interface|graphical]] or [[Command-line interface|command-line]] tools.<ref>{{Cite web |title=Connect to a VPN in Windows - Microsoft Support |url=https://support.microsoft.com/en-us/windows/connect-to-a-vpn-in-windows-3d29aeb1-f497-f6b7-7633-115722c1009c |access-date=2024-07-11 |website=support.microsoft.com}}</ref><ref>{{Cite web |title=Connect to a virtual private network (VPN) on Android |url=https://support.google.com/android/answer/9089766?hl=en |access-date=11 July 2024}}</ref><ref>{{Cite web |title=VPN settings overview for Apple devices |url=https://support.apple.com/guide/deployment/vpn-settings-overview-dep2d2adb35d/web |access-date=2024-07-11 |website=Apple Support |language=en}}</ref> However, due to the variety of, often non standard, VPN protocols, there exist many third-party applications that implement additional protocols not yet or no longer natively supported by the OS. For instance, [[Android (operating system)|Android]] lacked native [[IPsec IKEv2]] support until version 11,<ref>{{Cite web |title=IPsec/IKEv2 Library |url=https://source.android.com/docs/core/ota/modular-system/ipsec |access-date=2024-07-11 |website=Android Open Source Project |language=en}}</ref> and users needed to install third-party apps in order to connect that kind of VPN. Conversely, Windows does not natively support plain IPsec IKEv1 remote access native VPN configuration (commonly used by [[Cisco Systems VPN Client|Cisco]] and [[Fritz!Box]] VPN solutions).
</ref>
* [[Multiprotocol Label Switching]] (MPLS) often overlays VPNs, often with quality-of-service control over a trusted delivery network.
* L2TP<ref>[https://www.ietf.org/rfc/rfc2661.txt Layer Two Tunneling Protocol "L2TP"] {{Webarchive|url=https://web.archive.org/web/20220630094743/https://www.ietf.org/rfc/rfc2661.txt |date=30 June 2022 }}, {{IETF RFC|2661}}, W. Townsley ''et al.'', August 1999</ref> which is a standards-based replacement, and a compromise taking the good features from each, for two proprietary VPN protocols: Cisco's [[L2F|Layer 2 Forwarding (L2F)]]<ref>[https://www.ietf.org/rfc/rfc2341.txt IP Based Virtual Private Networks] {{Webarchive|url=https://web.archive.org/web/20220709081725/https://www.ietf.org/rfc/rfc2341.txt |date=9 July 2022 }}, {{IETF RFC|2341}}, A. Valencia ''et al.'', May 1998</ref> (obsolete {{As of | 2009 | alt =as of 2009}}) and Microsoft's [[Point-to-Point Tunneling Protocol|Point-to-Point Tunneling Protocol (PPTP)]].<ref>[https://www.ietf.org/rfc/rfc2637.txt Point-to-Point Tunneling Protocol (PPTP)] {{Webarchive|url=https://web.archive.org/web/20220702054527/https://www.ietf.org/rfc/rfc2637.txt |date=2 July 2022 }}, {{IETF RFC|2637}}, K. Hamzeh ''et al.'', July 1999</ref>


From a security standpoint, a VPN must either trust the underlying delivery network or enforce security with a mechanism in the VPN itself. Unless the trusted delivery network runs among physically secure sites only, both trusted and secure models need an authentication mechanism for users to gain access to the VPN.{{fact|date=June 2023}}
Network appliances, such as firewalls, often include VPN gateway functionality for either remote access or site-to-site configurations. Their administration interfaces often facilitate setting up virtual private networks with a selection of supported protocols. In some cases, like in the open source operating systems devoted to firewalls and network devices (like [[OpenWrt]], [[IPFire]], [[PfSense]] or [[OPNsense]]), it is possible to add support for additional VPN protocols by installing missing software components or third-party apps.{{Citation needed|date=September 2025}}


==Mobile environments==
Commercial appliances with VPN features based on proprietary hardware or software platforms usually support a consistent VPN protocol across their products, but do not allow customizations outside the use cases they implement. This is often the case for appliances that rely on hardware acceleration of VPNs to provide higher throughput or support a larger number of simultaneously connected users.{{Citation needed|date=September 2025}}
[[Mobile virtual private network]]s are used in settings where an endpoint of the VPN is not fixed to a single [[IP address spoofing|IP address]], but instead roams across various networks such as data networks from cellular carriers or between multiple [[Wi-Fi]] access points without dropping the secure VPN session or losing application sessions.<ref name="Phifer">Phifer, Lisa. [http://searchmobilecomputing.techtarget.com/tip/0,289483,sid40_gci1210989_mem1,00.html "Mobile VPN: Closing the Gap"] {{Webarchive|url=https://web.archive.org/web/20200706084816/https://searchmobilecomputing.techtarget.com/tip/Mobile-VPN-Closing-the-gap |date=6 July 2020 }}, ''SearchMobileComputing.com'', 16 July 2006. <!--accessed November 10, 2009--></ref> Mobile VPNs are widely used in [[public safety]] where they give law-enforcement officers access to applications such as [[computer-assisted dispatch]] and criminal databases,<ref>Willett, Andy. [http://www.officer.com/print/Law-Enforcement-Technology/Solving-the-Computing-Challenges-of-Mobile-Officers/1$30992 "Solving the Computing Challenges of Mobile Officers"] {{Webarchive|url=https://web.archive.org/web/20200412161947/https://www.officer.com/print/Law-Enforcement-Technology/Solving-the-Computing-Challenges-of-Mobile-Officers/1$30992 |date=12 April 2020 }}, ''www.officer.com'', May, 2006. <!--accessed November 10, 2009--></ref> and in other organizations with similar requirements such as [[field service management]] and healthcare.<ref name="Cheng">Cheng, Roger. [https://www.wsj.com/articles/SB119717610996418467 "Lost Connections"] {{Webarchive|url=https://web.archive.org/web/20180328101055/https://www.wsj.com/articles/SB119717610996418467 |date=28 March 2018 }}, ''The Wall Street Journal'', 11 December 2007. <!--accessed November 10, 2009--></ref>{{qn|date=June 2018}}


==Networking limitations==
== Society and culture ==
A limitation of traditional VPNs is that they are point-to-point connections and do not tend to support [[broadcast domain]]s; therefore, communication, software, and networking, which are based on [[OSI layer|layer 2]] and broadcast [[Network packet|packets]], such as [[NetBIOS]] used in [[My Network Places|Windows networking]], may not be fully supported as on a [[local area network]]. Variants on VPN such as [[Virtual Private LAN Service]] (VPLS) and layer 2 tunneling protocols are designed to overcome this limitation.<ref>{{Cite web |last=Sowells |first=Julia |date=2017-08-07 |title=Virtual Private Network (VPN) : What VPN Is And How It Works |url=https://hackercombat.com/virtual-private-network/ |website=Hackercombat |access-date=2021-11-07 |archive-date=17 June 2022 |archive-url=https://web.archive.org/web/20220617083903/https://hackercombat.com/virtual-private-network/ |url-status=live }}</ref>


{{anchor|Commercial VPNs|Virtual private network services}}
=== Individual users ===
In 2025, 1.75 billion people use VPNs. By 2027, this market is projected to grow to $76 billion.<ref>{{Cite web |last=Hooson |first=Mark |date=2025-03-03 |title=VPN Statistics |url=https://www.forbes.com/uk/advisor/business/vpn-statistics/ |access-date=2025-03-19 |website=Forbes UK |language=en-GB}}</ref>


==See also==
==See also==
{{Portal|Free Software|Internet}}
{{Portal|Free Software|Internet}}
<!-- Please keep entries in alphabetical order & add a short description [[WP:SEEALSO]] -->
{{div col|colwidth=20em|small=yes}}
* [[VPN service]] - list of VPN service providers
* [[Anonymizer]]
* [[Dynamic Multipoint Virtual Private Network]]
* [[Ethernet VPN]]
* [[Internet privacy]]
* [[Internet privacy]]
* [[Mediated VPN]]
* [[Opportunistic encryption]]
* [[Opportunistic encryption]]
* [[Provider-provisioned VPN]]
* [[Split tunneling]]
* [[Virtual private server]]
* [[VPNLab]]
* [[VPNLab]]
{{div col end}}
<!-- please keep entries in alphabetical order -->
<!-- please keep entries in alphabetical order -->


Latest revision as of 15:16, 19 November 2025

Template:More citations neededTemplate:Short description Script error: No such module "redirect hatnote". Template:Use dmy dates

Template:Use American English

File:Virtual Private Network overview.svg
VPN connectivity overview, showing intranet site-to-site and remote-work configurations used together

A virtual private network (VPN) is an overlay network that uses network virtualization to extend a private network across a public network, such as the Internet, via the use of encryption and tunneling protocols.[1] In a VPN, a tunneling protocol is used to transfer network messages from one network host to another.

Host-to-network VPNs are commonly used by organisations to allow off-site users secure access to an office network over the internet.[2][3] Site-to-site VPNs connect two networks, such as an office network and a datacenter. Provider-provisioned VPNs isolate parts of the provider's own network infrastructure in virtual segments, in ways that make the contents of each segment private with respect to the others. Individuals also use VPNs to encrypt and anonymize their network traffic, with VPN services selling access to their own private networks.

VPNs can enhance usage privacy by making an ISP unable to access the private data exchanged across the VPN. Through encryption, VPNs enhance confidentiality and reduce the risk of successful data sniffing attacks.

Background

Script error: No such module "Labelled list hatnote". A network is a group of communicating computers known as hosts, which communicate data to other hosts via communication protocols, as facilitated by networking hardware. Within a computer network, computers are identified by network addresses, which allow rule-based systems such as Internet Protocol to locate and identify hosts. Hosts may also have hostnames, memorable labels for the host nodes, which are rarely changed after initial assignment. The transmission medium that supports information exchange includes wired media like copper cables, optical fibers, and wireless radio-frequency media. The arrangement of hosts and hardware within a network architecture is known as the network topology.[4][5]

Apart from physical transmission media, networks comprise network nodes such as network interface controllers, repeaters, hubs, bridges, switches, routers, and modems:

  • The network interface controller (NIC) is computer hardware that connects the computer to the network media. In Ethernet networks, each NIC has a unique Media Access Control (MAC) address, usually stored in the controller's permanent memory.
  • A repeater is an electronic device that receives a network signal, cleans it of unnecessary noise and regenerates it. The signal is retransmitted at a higher power level, or to the other side of obstruction so that the signal can cover longer distances without degradation.
  • An Ethernet repeater with multiple ports is known as an Ethernet hub. In addition to reconditioning and distributing network signals, a hub assists with collision detection and fault isolation for the network. Hubs and repeaters in LANs have been largely obsoleted by modern network switches.
  • Unlike hubs, which forward communication to all ports, network switches forward frames only to the ports involved in the communication. Switches normally have numerous ports, facilitating a star topology for devices, and for cascading additional switches. Network bridges are analogous to a two-port switch.
    • Bridges and switches operate at the data link layer of the OSI model and bridge traffic between two or more network segments to form a single local network. Both are devices that forward frames of data between ports based on the destination MAC address in each frame. Network segmentation through bridging and switching helps break down a large, congested network into an aggregation of smaller, more efficient networks.
  • A router is an internetworking device that forwards packets between networks by processing the addressing or routing information included in the packet.
  • Modems (modulator-demodulator) are used to connect network nodes via wire not originally designed for digital network traffic, or for wireless.

Network communication

A communication protocol is a set of rules for exchanging information over a network. Communication protocols have various characteristics, such as being connection-oriented or connectionless, or using circuit switching or packet switching.

In a protocol stack, often constructed per the OSI model, communications functions are divided into protocol layers, where each layer leverages the services of the layer below it until the lowest layer controls the hardware that sends information across the media. The use of protocol layering is ubiquitous across the field of computer networking. An important example of a protocol stack is HTTP, the World Wide Web protocol. HTTP runs over TCP over IP, the Internet protocols, which in turn run over IEEE 802.11, the Wi-Fi protocol. This stack is used between a wireless router and a personal computer when accessing the web.

Most modern computer networks use protocols based on packet-mode transmission. A network packet is a formatted unit of data carried by a packet-switched network. Packets consist of two types of data: control information and user data (payload). The control information provides data the network needs to deliver the user data, for example, source and destination network addresses, error detection codes, and sequencing information. Typically, control information is found in packet headers and trailers, with payload data in between.

The Internet protocol suite, also called TCP/IP, is the foundation of all modern networking and the defining set of protocols for the Internet. It offers connection-less and connection-oriented services over an inherently unreliable network traversed by datagram transmission using Internet protocol (IP). At its core, the protocol suite defines the addressing, identification, and routing specifications for Internet Protocol Version 4 (IPv4) and for IPv6, the next generation of the protocol with a much enlarged addressing capability.[6]

Security

VPNs do not make connected users anonymous or unidentifiable to the untrusted medium network provider, such as an internet service provider (ISP). However, VPNs can enhance usage privacy by making an ISP unable to access the private data exchanged across the VPN. Through encryption, VPNs enhance confidentiality and reduce the risk of successful data sniffing attacks. Data packets travelling across a VPN may also be secured by tamper proofing via a message authentication code, prevents the message from being altered or tampered without being rejected, enhancing data integrity.Script error: No such module "Unsubst".

A number of other implementations exist to ensure authentication of connecting parties. Tunnel endpoints can be authenticated in various ways during the VPN access initiation, such as by the whitelisting of endpoint IP address. Authentication may also occur after actual tunnels are already active, for example, with a web captive portal. Remote-access VPNs may also use passwords, biometrics, two-factor authentication, or other cryptographic methods. Site-to-site VPNs often use passwords (pre-shared keys) or digital certificates.Script error: No such module "Unsubst".

Split tunneling

Split tunneling allows a user to access distinct security domains at the same time, using the same or different network connections.[7] This connection state is usually facilitated through the simultaneous use of a LAN network interface controller (NIC), radio NIC, Wireless LAN NIC, and virtual private network client software application. Split tunneling is most commonly configured via the use of a remote-access VPN client, which allows the user to simultaneously connect to a nearby wireless network, resources on an off-site corporate network, as well as websites over the internet.

Not every VPN allows split tunneling.[8][9][10] Advantages of split tunneling include alleviating bottlenecks, conserving bandwidth (as internet traffic does not have to pass through the VPN server), and enabling a user to not have to continually connect and disconnect when remotely accessing resources..Script error: No such module "Unsubst". Disadvantages include DNS leaks and potentially bypassing gateway-level security that might be in place within the company infrastructure.[11] Internet service providers often use split tunneling to that implement for DNS hijacking purposes.

Classification

File:VPN classification-en.svg
VPN classification tree based on the topology first, then on the technology used

Topology

A host-to-network configuration is analogous to joining one or more computers to a network to which they cannot be directly connected. This type of extension provides computer access to a local area network of a remote site, or any wider enterprise networks, such as an intranet. Each computer is in charge of activating its own tunnel towards the network it wants to join. The joined network is only aware of a single remote host for each tunnel. This may be employed for remote workers, or to enable people accessing their private home or company resources without exposing them on the public Internet. Script error: No such module "Unsubst".

A site-to-site configuration connects two networks. This configuration expands a network across geographically disparate locations. Tunneling is only done between gateway devices located at each network location. These devices then make the tunnel available to other local network hosts that aim to reach any host on the other side. This is useful to keep sites connected to each other in a stable manner, like office networks to their headquarters or datacenter. In this case, any side may be configured to initiate the communication as long as it knows how to reach the other. In the context of site-to-site configurations, the terms intranet and extranet are used to describe two different use cases.[12] An intranet site-to-site VPN describes a configuration where the sites connected by the VPN belong to the same organization, whereas an extranet site-to-site VPN joins sites belonging to multiple organizations.Script error: No such module "Unsubst".

A limitation of traditional VPNs is that they are point-to-point connections and do not tend to support broadcast domains. Therefore, communication, software, and networking that are based on layer 2 and broadcast packets (such as NetBIOS used in Windows networking) may not be fully supported as on a local area network. Variants on VPN such as Virtual Private LAN Service (VPLS) and layer 2 tunneling protocols are designed to overcome this limitation.[13]

Trusted and secure delivery networks

Trusted VPNs do not use cryptographic tunneling; instead, they rely on the security of a single provider's network to protect the traffic.[14] Multiprotocol Label Switching (MPLS) often overlays trusted VPNs, often with quality-of-service control over a trusted delivery network. A secure VPN either trusts the underlying delivery network or enforces security with an internal mechanism. Unless the trusted delivery network runs among physically secure sites only, both trusted and secure models need an authentication mechanism for users to gain access to the VPN.Template:Fact

Types

Mobile VPN

Mobile virtual private networks are used in settings where an endpoint of the VPN is not fixed to a single IP address, but instead roams across various networks such as data networks from cellular carriers or between multiple Wi-Fi access points without dropping the secure VPN session or losing application sessions.[15] Mobile VPNs are widely used in public safety where they give law-enforcement officers access to applications such as computer-assisted dispatch and criminal databases,[16] and in other organizations with similar requirements such as field service management and healthcare.[17]Template:Qn

DMVPN

Dynamic Multipoint Virtual Private Network (DMVPN)[18] is a dynamic tunneling form of a virtual private network supported on Cisco IOS-based routers, Huawei AR G3 routers,[19] and Unix-like operating systems.

DMVPN provides the capability for creating a dynamic-mesh VPN network without having to statically pre-configure all possible tunnel end-point peers, such as IPsec and ISAKMP peers.[20] DMVPN is initially configured to build a hub-and-spoke network by statically configuring the hubs (VPN headends) on the spokes; no change in the configuration on the hub is required to accept new spokes. Using this initial hub-and-spoke network, tunnels between spokes are dynamically built on demand without additional configuration on the hubs or spokes. This dynamic-mesh capability alleviates the need for any load on the hub to route data between the spoke networks.Script error: No such module "Unsubst".

EVPN

Ethernet VPN (EVPN) is a technology for carrying OSI layer 2 Ethernet traffic as a virtual private network using wide area network protocols. EVPN technologies include Ethernet over Multiprotocol Label Switching (MPLS) and Ethernet over Virtual Extensible LAN.[21][22]

MPLS VPN

Multiprotocol Label Switching (MPLS) is a routing technique in telecommunications networks that directs data from one node to the next based on labels rather than network addresses.[23] Whereas network addresses identify endpoints, MPLS labels identify established paths between endpoints. MPLS can encapsulate packets of various network protocols.

In practice, MPLS is mainly used to forward IP protocol data units and Virtual Private LAN Service Ethernet traffic. Major applications of MPLS are telecommunications traffic engineering and MPLS VPN. MPLS works in conjunction with the Internet Protocol (IP) and its routing protocols, usually interior gateway protocols (IGPs) and supports the creation of dynamic, transparent virtual networks with support for traffic engineering, the ability to transport layer VPNs with overlapping address spaces, and for layer-2 pseudowires that are capable of transporting a variety of transport payloads (IPv4, IPv6, ATM, Frame Relay, etc.).[24]Template:Ref RFC

VPLS

Virtual Private LAN Service (VPLS) is a virtual private network technology that provides Ethernet-based multipoint-to-multipoint communication over IP or MPLS networks. It allows geographically dispersed sites to share an Ethernet broadcast domain by connecting sites (including both servers and clients) through pseudowires.[25] The technologies that can be used as pseudo-wire can be Ethernet over MPLS, L2TPv3 or even GRE. There are two IETF standards-track RFCs (RFC 4761 and RFC 4762) describing VPLS establishment. In contrast to L2TPv3, which allows only point-to-point OSI layer 2 tunnels, VPLS allows any-to-any (multipoint) connectivity.[26][27]

PPVPN

A provider-provisioned VPN (PPVPN) is a virtual private network (VPN) implemented by a connectivity service provider or large enterprise on a network they operate on their own, as opposed to a "customer-provisioned VPN" where the VPN is implemented by the customer who acquires the connectivity service on top of the technical specificities of the provider.

Protocols

File:IPSec VPN-en.svg
The life cycle phases of an IPSec tunnel in a virtual private network

A virtual private network is based on a tunneling protocol, and may be combined with other network or application protocols to provide additional security and capabilities.

IPSec (1996)

Internet Protocol Security (IPsec) is a standards-based security protocol, initially developed by the Internet Engineering Task Force (IETF) for IPv6, and was required in all standards-compliant implementations of IPv6 before RFC 6434 made it only a recommendation.Template:Ref RFC It is also widely used with IPv4.

The design of IPSec meets most security goals: availability, integrity, and confidentiality. IPsec uses encryption, encapsulating an IP packet inside an IPsec packet. De-encapsulation happens at the end of the tunnel, where the original IP packet is decrypted and forwarded to its intended destination. IPsec is also often supported by network hardware accelerators,[28] which makes IPsec VPN desirable for low-power scenarios, like always-on remote access VPN configurations.[29][30]

IPsec tunnels are set up by the Internet Key Exchange (IKE) protocol. IPsec tunnels made with IKE version 1 (also known as IKEv1 tunnels, or often just "IPsec tunnels") can be used alone to provide VPN but are often combined with the Layer 2 Tunneling Protocol (L2TP) to reuse existing L2TP-related implementations for more flexible authentication features (e.g. Xauth).

IKE version 2, which was created by Microsoft and Cisco, can be used alone to provide IPsec VPN functionality. Its primary advantages are the native support for authenticating via the Extensible Authentication Protocol (EAP) and that the tunnel can be seamlessly restored when the IP address of the associated host is changing, which is typical of a roaming mobile device, whether on 3G or 4G LTE networks.

TLS/SSL (1999)

Transport Layer Security (SSL/TLS) can tunnel an entire network's traffic (as it does in the OpenVPN project and SoftEther VPN project[31]) or secure an individual connection. A number of vendors provide remote-access VPN capabilities through TLS. A VPN based on TLS can connect from locations where the usual TLS web navigation (HTTPS) is supported without requiring additional configuration.

OpenSSH (1999)

OpenSSH offers VPN tunneling (distinct from port forwarding) to secureScript error: No such module "Unsubst". remote connections to a network, inter-network links, and remote systems. OpenSSH server provides a limited number of concurrent tunnels. The VPN feature itself does not support personal authentication.[32] SSH is more often used to remotely connect to machines or networks instead of a site to site VPN connection.

OpenVPN (2001)

OpenVPN is a free and open-source VPN protocol based on the TLS protocol. It supports perfect forward-secrecy, and most modern secure cipher suites, like AES, Serpent, TwoFish, etc. It is currentlyTemplate:Current event inline being developed and updated by OpenVPN Inc., a non-profit providing secure VPN technologies.

SSTP (2007)

Secure Socket Tunneling Protocol (SSTP) is a form of VPN tunnel that provides a mechanism to transport Point-to-Point Protocol (PPP) traffic through an SSL/TLS channel.

Wireguard (2015)

WireGuard is a protocol. In 2020, WireGuard support was added to both the Linux[33] and Android[34] kernels, opening it up to adoption by VPN providers. By default, WireGuard utilizes the Curve25519 protocol for key exchange and ChaCha20-Poly1305 for encryption and message authentication, but also includes the ability to pre-share a symmetric key between the client and server.[35]

Other

Native and third-party support

Desktop, smartphone and other end-user device operating systems usually support configuring remote access VPN from their graphical or command-line tools.[45][46][47] However, due to the variety of, often non standard, VPN protocols, there exist many third-party applications that implement additional protocols not yet or no longer natively supported by the OS. For instance, Android lacked native IPsec IKEv2 support until version 11,[48] and users needed to install third-party apps in order to connect that kind of VPN. Conversely, Windows does not natively support plain IPsec IKEv1 remote access native VPN configuration (commonly used by Cisco and Fritz!Box VPN solutions).

Network appliances, such as firewalls, often include VPN gateway functionality for either remote access or site-to-site configurations. Their administration interfaces often facilitate setting up virtual private networks with a selection of supported protocols. In some cases, like in the open source operating systems devoted to firewalls and network devices (like OpenWrt, IPFire, PfSense or OPNsense), it is possible to add support for additional VPN protocols by installing missing software components or third-party apps.Script error: No such module "Unsubst".

Commercial appliances with VPN features based on proprietary hardware or software platforms usually support a consistent VPN protocol across their products, but do not allow customizations outside the use cases they implement. This is often the case for appliances that rely on hardware acceleration of VPNs to provide higher throughput or support a larger number of simultaneously connected users.Script error: No such module "Unsubst".

Society and culture

Individual users

In 2025, 1.75 billion people use VPNs. By 2027, this market is projected to grow to $76 billion.[49]

See also

Script error: No such module "Portal".

References

Template:Reflist

Further reading

  • Script error: No such module "Citation/CS1".

Template:VPN Template:Cryptographic software Template:Internet censorship circumvention technologies

  1. ↑ Script error: No such module "citation/CS1".
  2. ↑ Script error: No such module "citation/CS1".
  3. ↑ Script error: No such module "citation/CS1".
  4. ↑ Script error: No such module "citation/CS1".
  5. ↑ Script error: No such module "citation/CS1".
  6. ↑ Script error: No such module "citation/CS1".
  7. ↑ Script error: No such module "citation/CS1".
  8. ↑ Script error: No such module "citation/CS1".
  9. ↑ Script error: No such module "citation/CS1".
  10. ↑ Script error: No such module "citation/CS1".
  11. ↑ Script error: No such module "citation/CS1".
  12. ↑ Template:Cite IETF
  13. ↑ Script error: No such module "citation/CS1".
  14. ↑ Script error: No such module "citation/CS1".
  15. ↑ Phifer, Lisa. "Mobile VPN: Closing the Gap" Template:Webarchive, SearchMobileComputing.com, 16 July 2006.
  16. ↑ Willett, Andy. "Solving the Computing Challenges of Mobile Officers" Template:Webarchive, www.officer.com, May, 2006.
  17. ↑ Cheng, Roger. "Lost Connections" Template:Webarchive, The Wall Street Journal, 11 December 2007.
  18. ↑ Script error: No such module "citation/CS1".
  19. ↑ Huawei DSVPN Configuration
  20. ↑ Script error: No such module "Citation/CS1".
  21. ↑ Script error: No such module "citation/CS1".
  22. ↑ Script error: No such module "citation/CS1".
  23. ↑ Script error: No such module "citation/CS1".
  24. ↑ Template:IETF RFC
  25. ↑ Script error: No such module "citation/CS1".
  26. ↑ Template:Cite report
  27. ↑ Template:Cite report
  28. ↑ Script error: No such module "citation/CS1".
  29. ↑ Script error: No such module "citation/CS1".
  30. ↑ Script error: No such module "citation/CS1".
  31. ↑ Script error: No such module "citation/CS1".
  32. ↑ Script error: No such module "citation/CS1".
    • Script error: No such module "citation/CS1".
    • Script error: No such module "citation/CS1".
  33. ↑ Script error: No such module "citation/CS1".
  34. ↑ Script error: No such module "citation/CS1".
  35. ↑ Script error: No such module "Citation/CS1".Template:Dead linkTemplate:Cbignore
    • Script error: No such module "Citation/CS1".
  36. ↑ Script error: No such module "citation/CS1".
  37. ↑ Script error: No such module "citation/CS1".
  38. ↑ Script error: No such module "citation/CS1".
  39. ↑ Script error: No such module "citation/CS1".
    • Script error: No such module "citation/CS1".
  40. ↑ Script error: No such module "citation/CS1".
  41. ↑ Script error: No such module "citation/CS1".
    • Script error: No such module "citation/CS1".
  42. ↑ Layer Two Tunneling Protocol "L2TP" Template:Webarchive, Template:IETF RFC, W. Townsley et al., August 1999
  43. ↑ IP Based Virtual Private Networks Template:Webarchive, Template:IETF RFC, A. Valencia et al., May 1998
  44. ↑ Point-to-Point Tunneling Protocol (PPTP) Template:Webarchive, Template:IETF RFC, K. Hamzeh et al., July 1999
  45. ↑ Script error: No such module "citation/CS1".
  46. ↑ Script error: No such module "citation/CS1".
  47. ↑ Script error: No such module "citation/CS1".
  48. ↑ Script error: No such module "citation/CS1".
  49. ↑ Script error: No such module "citation/CS1".
Retrieved from "http://debianws.lexgopc.com/wiki143/index.php?title=Virtual_private_network&oldid=3403222"