VPN

VPNs come in three main forms: remote-access VPNs that connect individual devices to an organisation's network, site-to-site VPNs that join whole networks through gateways, and consumer "privacy" VPNs that route a user's traffic via a commercial provider. The main protocol families are IPsec, TLS-based VPNs and WireGuard. IPsec (architecture in RFC 4301) protects packets with ESP (RFC 4303), in tunnel mode for gateways or transport mode host to host, and negotiates keys with IKEv2 (RFC 7296) on UDP port 500, switching to UDP 4500 with encapsulation when NAT is detected. TLS-based VPNs, including OpenVPN and most vendor "SSL VPN" appliances, carry tunnelled packets over TLS or DTLS, which passes easily through firewalls. WireGuard, built on the Noise protocol framework with Curve25519, ChaCha20-Poly1305 and BLAKE2s, has a deliberately small codebase and was merged into the Linux kernel in version 5.6 (2020). PPTP from the 1990s is broken and should not be used.

On the client, a VPN creates a virtual network interface (tun or tap) and changes the routing table. In a full tunnel all traffic goes through the VPN; in split tunnelling only the organisation's prefixes do, which saves bandwidth but leaves the rest of the device's traffic outside central inspection. Encapsulation overhead lowers the effective MTU and can cause fragmentation problems. DNS must also be steered into the tunnel, or queries leak to the local network. The TunnelVision technique (CVE-2024-3661, 2024) showed that a hostile DHCP server can push classless static routes (option 121) that pull traffic out of the tunnel on most operating systems.

VPN gateways are internet-facing, hold credentials and give network access, which makes them prime targets. Critical, widely exploited vulnerabilities have affected many vendors, among them Pulse Secure (CVE-2019-11510), Fortinet FortiOS (CVE-2018-13379) and Ivanti Connect Secure (CVE-2023-46805 and CVE-2024-21887, exploited in early 2024). VPN accounts without MFA are also a frequent initial access vector for ransomware groups, through password spraying or stolen credentials. Basic controls are MFA on every VPN login, rapid patching of the gateway, restricting and monitoring the management interface, and logging connections with source addresses to a SIEM.

The contrast with Zero Trust lies in what a connection grants. A classic VPN puts the device on the network, and unless internal segmentation restricts it, the user and any malware on the device can reach far more than needed. Zero Trust network access (ZTNA), in the spirit of NIST SP 800-207, instead brokers access per application after checking identity and device posture on each request. A VPN also differs from TLS: TLS protects one application connection end to end, whereas a VPN protects all traffic only between the device and the gateway, after which it travels unprotected unless the applications use TLS as well. A consumer VPN does not make a user anonymous; it moves trust from the local network and ISP to the VPN provider.