Cyber Security VPNs
A VPN protects your data in transit by building an encrypted tunnel across a network you don't trust, such as public Wi-Fi or the open internet.
What Problem Does a VPN Solve?
Every time you connect to a website, your traffic passes through a chain of devices you don't control: the coffee shop router, your ISP, and several backbone providers along the way. Any of those hops could, in principle, read or tamper with unencrypted traffic. A VPN (Virtual Private Network) is designed specifically for the case where the network in between is untrusted.
A VPN works by wrapping your original network traffic inside an encrypted tunnel between your device and a VPN gateway. Anyone watching the untrusted network in between sees only sealed, scrambled packets travelling to the VPN server — they cannot see the content, and typically cannot easily see which internal site or service you are actually reaching.
How the Tunnel Actually Works
- Your device and the VPN server perform a handshake, authenticating each other and agreeing on encryption keys.
- Your device takes a normal outgoing packet and encrypts it, then wraps it inside a new outer packet addressed to the VPN server.
- That sealed outer packet travels across the untrusted network (public Wi-Fi, the open internet) as unreadable payload.
- The VPN server strips off the outer wrapper, decrypts the inner packet, and forwards it to its real destination on your behalf.
- Return traffic follows the same path in reverse, getting re-encrypted before it crosses back over the untrusted network to you.
Common VPN Protocols
- IPsec — an older, widely supported standard often used for site-to-site links and built into many routers and firewalls.
- OpenVPN — a flexible, open-source protocol that runs over standard TCP/UDP and is popular with commercial VPN clients.
- WireGuard — a newer, much smaller and simpler protocol that has become the default in many modern operating systems because it's fast and easy to audit.
Site-to-Site vs Remote-Access VPNs
A remote-access VPN connects a single device, like an employee's laptop, into a private network as if it were plugged in locally — this is the everyday case of someone working from home reaching internal company systems. A site-to-site VPN instead permanently joins two whole networks together, for example linking a branch office's network to headquarters, so that every device on either side can reach the other without each one running its own VPN client.
