Virtual Private Networks (VPNs), Tunnels, and WireGuard

A Virtual Private Network (VPN) extends a private network across public untrusted infrastructure by creating an encrypted point-to-point or site-to-site tunnel. This guide covers VPN protocol evolution (IPsec, OpenVPN, WireGuard), cryptokey routing, split tunneling, and modern zero-trust overlay meshes.

⚡ Quick Dive

VPN Technologies Comparison

Protocol Cryptographic Engine Lines of Code Kernel Integration Performance Roaming / Mobility
WireGuard Modern (Noise, Curve25519, ChaCha20) ~4,000 LOC ✅ Native Linux Kernel (5.6+) ⚡ Maximum (Line rate) ⚡ Instant (Handshake on packet)
IPsec (IKEv2) Modular (AES-GCM, RSA/ECDSA) ~100,000+ LOC ✅ Kernel module High Moderate (MOBIKE)
OpenVPN OpenSSL (AES, RSA) ~100,000+ LOC ❌ User-space (/dev/net/tun) Moderate (Context switch cost) Slow (TCP/TLS renegotiation)

Complete WireGuard Configuration Template

# /etc/wireguard/wg0.conf (Server Node: 10.0.0.1)
[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = aAAA...ServerPrivateKey...=
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

# Client Peer Definition
[Peer]
PublicKey = bBBB...ClientPublicKey...=
AllowedIPs = 10.0.0.2/32

# client.conf (Developer Workstation: 10.0.0.2)
[Interface]
Address = 10.0.0.2/24
PrivateKey = cCCC...ClientPrivateKey...=
DNS = 1.1.1.1

[Peer]
PublicKey = dDDD...ServerPublicKey...=
Endpoint = vpn.example.com:51820
AllowedIPs = 10.0.0.0/16 # Split Tunneling: Route only internal 10.0.x.x traffic over VPN
PersistentKeepalive = 25

📖 Extended Guide

1. Cryptokey Routing (The WireGuard Paradigm)

WireGuard associates public cryptographic keys directly with a list of tunnel IP addresses (Cryptokey Routing):

Outbound Packet to 10.0.0.2:
Look up AllowedIPs for 10.0.0.2 ──► Finds Client Public Key ──► Encrypts with ChaCha20-Poly1305 ──► Transmits UDP
  • When the server receives an encrypted packet from an unknown public IP, it decrypts the packet using the client's public key and verifies that the internal source IP matches AllowedIPs.
  • If a client switches from home Wi-Fi to mobile 5G, the server automatically updates the client's endpoint IP address upon receiving the first authenticated packet (Seamless Roaming).

2. Split Tunneling vs. Full Tunneling

  • Full Tunneling (AllowedIPs = 0.0.0.0/0, ::/0): All device traffic (web browsing, streaming, internal tools) is encrypted and routed through the VPN gateway.
  • Split Tunneling (AllowedIPs = 10.100.0.0/16, 172.16.0.0/12): Only traffic destined for corporate subnets travels over the VPN. Public internet traffic routes directly through the user's local ISP, reducing VPN server bandwidth costs.

3. Modern Zero-Trust Overlay Mesh Networks

Traditional hub-and-spoke VPNs route all traffic through a central gateway, introducing high latency and single points of failure.

Mesh Overlay Networks (Tailscale, Headscale, Nebula):

  • Establish direct, peer-to-peer WireGuard tunnels between every device using automated NAT Traversal (STUN/ICE/DERP).
  • Traffic flows directly between machines with lowest physical latency without central bottleneck chokepoints.
⌂ All Guides