VPN Explained: Tunnels, WireGuard & IPSec

Lesson Overview & Learning Objectives

Whether securing remote corporate access to proprietary internal subnets or shielding personal data packets on hostile public Wi-Fi networks, Virtual Private Networks (VPNs) are an essential pillar of modern cybersecurity. At its core, a VPN constructs an encrypted, point-to-point cryptographic tunnel across an untrusted public network. In this installment, we dissect the mechanics of packet encapsulation, inspect virtual kernel TUN/TAP network interfaces, compare WireGuard against IPSec and OpenVPN, and evaluate Split Tunneling architectures.

1. How VPN Tunneling Works: The Packet Inside a Packet

The magic of a VPN lies in Encapsulation. Rather than routing standard IP packets directly to their destination, the operating system wraps entire original packets inside a brand new encrypted payload:

Packet Anatomy Inside the Cryptographic Tunnel:

[Outer IP Header]: Src: 172.56.21.9 (Your Public Home/Mobile IP) → Dst: 198.51.100.1 (VPN Gateway Server)

[VPN Security Header]: UDP Port (WireGuard 51820 / OpenVPN 1194) + Sequence + Auth Tag (ChaCha20-Poly1305)

[Encrypted Payload]: Contains the ENTIRE original, inner IP packet:
• Inner Src: 10.8.0.2 (Assigned Virtual IP)
• Inner Dst: 192.168.1.50 (Internal Corporate Database / Web Host)
• Data: HTTP, SSH, Database query

2. Virtual Network Adapters: TUN vs. TAP

TUN Devices (Network Layer 3)

Simulates a point-to-point network device and operates with Layer 3 IP packets. Because it does not process Layer 2 Ethernet headers or broadcast frames, TUN interfaces are lighter, faster, and used by almost all modern VPN software (WireGuard, OpenVPN routed mode).

TAP Devices (Data Link Layer 2)

Simulates a virtual Ethernet device and operates with raw Layer 2 frames (including MAC addresses). Used when you need to bridge networks, forward non-IP protocols (like IPX), or pass local broadcast traffic (like mDNS or LAN gaming discovery).

3. Protocol Comparison: WireGuard vs. OpenVPN vs. IPSec

Protocol	Codebase Size	Cryptography	Performance & Battery	Best Use Case
WireGuard	< 4,000 lines (Auditable)	ChaCha20, Poly1305, Curve25519, BLAKE2s	Blazing fast; runs in Linux kernel; zero handshake overhead	Modern standard for cloud mesh (Tailscale), mobile, and servers
OpenVPN	~100,000+ lines	OpenSSL / Custom Ciphers (AES-CBC/GCM, RSA)	Moderate (Runs in userland, context switches between kernel/user)	Bypassing firewalls (can disguise traffic over TCP port 443)
IPSec / IKEv2	Large, complex RFCs	AES-GCM, SHA-256, Diffie-Hellman	High (Kernel level, hardware cryptographic offload)	Site-to-site enterprise datacenter interconnects & mobile roaming