Virtual private network

Short description: Extension of a private network across a public one

"VPN" redirects here. For other uses, see VPN (disambiguation). For commercial services, see VPN service.

VPN connectivity overview, showing intranet site-to-site and remote-work configurations used together

A virtual private network (VPN) is an overlay network that uses network virtualization to extend a private network across a public network, such as the Internet, via the use of encryption and tunneling protocols.[1] In a VPN, a tunneling protocol is used to transfer network messages from one network host to another.

Host-to-network VPNs are commonly used by organizations to allow off-site users secure access to an office network over the Internet.[2][3] Site-to-site VPNs connect two networks, such as an office network and a datacenter. Provider-provisioned VPNs isolate parts of the provider's own network infrastructure in virtual segments, in ways that make the contents of each segment private with respect to the others. Individuals also use VPNs to encrypt and attempt to anonymize their network traffic, with VPN services selling access to their own private networks.

VPNs can enhance usage privacy by making an ISP unable to access the private data exchanged across the VPN. However, the VPN provider and the online service being accessed via the VPN may have visibility of the user's activities. Through encryption, VPNs enhance confidentiality and reduce the risk of successful external data sniffing attacks.

## Contents

* 1 Background
* 1.1 Network communication
* 2 Security
* 2.1 Split tunneling
* 3 Classification
* 3.1 Topology
* 3.2 Trusted and secure delivery networks
* 4 Types
* 4.1 Mobile VPN
* 4.2 DMVPN
* 4.3 EVPN
* 4.4 MPLS VPN
* 4.5 VPLS
* 4.6 PPVPN
* 5 Protocols
* 5.1 IPSec (1996)
* 5.2 TLS/SSL (1999)
* 5.3 OpenSSH (1999)
* 5.4 OpenVPN (2001)
* 5.5 SSTP (2007)
* 5.6 Wireguard (2015)
* 5.7 Other
* 6 Native and third-party support
* 7 Society and culture
* 7.1 Individual users
* 8 See also
* 9 References
* 10 Further reading

## Background

Main article: Computer network

A network is a group of communicating computers known as hosts, which communicate data to other hosts via communication protocols, as facilitated by networking hardware. Within a computer network, computers are identified by network addresses, which allow rule-based systems such as Internet Protocol (IP) to locate and identify hosts. Hosts may also have hostnames, memorable labels for the host nodes, which are rarely changed after initial assignment. The transmission medium that supports information exchange includes wired media like copper cables, optical fibers, and wireless radio-frequency media. The arrangement of hosts and hardware within a network architecture is known as the network topology.[4][5]

Apart from physical transmission media, networks comprise network nodes such as network interface controllers, repeaters, hubs, bridges, switches, routers, and modems:

* The network interface controller (NIC) is computer hardware that connects the computer to the network media. In Ethernet networks, each NIC has a unique Media Access Control (MAC) address, usually stored in the controller's permanent memory.
* A repeater is an electronic device that receives a network signal, cleans it of unnecessary noise and regenerates it. The signal is retransmitted at a higher power level, or to the other side of obstruction so that the signal can cover longer distances without degradation.
* An Ethernet repeater with multiple ports is known as an Ethernet hub. In addition to reconditioning and distributing network signals, a hub assists with collision detection and fault isolation for the network. Hubs and repeaters in LANs have been largely made obsolete by modern network switches.
* Unlike hubs, which forward communication to all ports, network switches forward frames only to the ports involved in the communication. Switches normally have numerous ports, facilitating a star topology for devices, and for cascading additional switches. Network bridges are analogous to a two-port switch.
* Bridges and switches operate at the data link layer of the OSI model and bridge traffic between two or more network segments to form a single local network. Both are devices that forward frames of data between ports based on the destination MAC address in each frame. Network segmentation through bridging and switching helps break down a large, congested network into an aggregation of smaller, more efficient networks.
* A router is an internetworking device that forwards packets between networks by processing the addressing or routing information included in the packet.
* Modems (modulator-demodulator) are used to connect network nodes via wire not originally designed for digital network traffic, or for wireless.

### Network communication

A communication protocol is a set of rules for exchanging information over a network. Communication protocols have various characteristics, such as being connection-oriented or connectionless, or using circuit switching or packet switching.

In a protocol stack, often constructed per the OSI model, communications functions are divided into protocol layers, where each layer leverages the services of the layer below it until the lowest layer controls the hardware that sends information across the media. The use of protocol layering is ubiquitous across the field of computer networking. An important example of a protocol stack is HTTP, the World Wide Web protocol. HTTP runs over TCP over IP, the internet protocols, which in turn run over IEEE 802.11, the Wi-Fi protocol. This stack is used between a wireless router and a personal computer when accessing the web.

Most modern computer networks use protocols based on packet-mode transmission. A network packet is a formatted unit of data carried by a packet-switched network. Packets consist of two types of data: control information and user data (payload). The control information provides data the network needs to deliver the user data, for example, source and destination network addresses, error detection codes, and sequencing information. Typically, control information is found in packet headers and trailers, with payload data in between.

The Internet protocol suite, also called TCP/IP, is the foundation of all modern networking and the defining set of protocols for the Internet. It offers connection-less and connection-oriented services over an inherently unreliable network traversed by datagram transmission using Internet protocol (IP). At its core, the protocol suite defines the addressing, identification, and routing specifications for Internet Protocol Version 4 (IPv4) and for IPv6, the next generation of the protocol with a much enlarged addressing capability.[6]

## Security

### Split tunneling

Split tunneling allows a user to access distinct security domains at the same time, using the same or different network connections.[7] This connection state is usually facilitated through the simultaneous use of a LAN network interface controller (NIC), radio NIC, Wireless LAN NIC, and virtual private network client software application. Split tunneling is most commonly configured via the use of a remote-access VPN client, which allows the user to simultaneously connect to a nearby wireless network, resources on an off-site corporate network, as well as websites over the Internet.

Not every VPN allows split tunneling.[8][9][10] Advantages of split tunneling include alleviating bottlenecks, conserving bandwidth (as Internet traffic does not have to pass through the VPN server), and enabling a user to not have to continually connect and disconnect when remotely accessing resources.. Disadvantages include DNS leaks and potentially bypassing gateway-level security that might be in place within the company infrastructure.[11] Internet service providers often use split tunneling to that implement for DNS hijacking purposes.

## Classification

VPN classification tree based on the topology first, then on the technology used

### Topology

A site-to-site configuration connects two networks. This configuration expands a network across geographically disparate locations. Tunneling is only done between gateway devices located at each network location. These devices then make the tunnel available to other local network hosts that aim to reach any host on the other side. This is useful to keep sites connected to each other in a stable manner, like office networks to their headquarters or datacenter. In this case, any side may be configured to initiate the communication as long as it knows how to reach the other. In the context of site-to-site configurations, the terms intranet and extranet are used to describe two different use cases.[12] An intranet site-to-site VPN describes a configuration where the sites connected by the VPN belong to the same organization, whereas an extranet site-to-site VPN joins sites belonging to multiple organizations. A limitation of traditional VPNs is that they are point-to-point connections and do not tend to support broadcast domains. Therefore, communication, software, and networking that are based on layer 2 and broadcast packets (such as NetBIOS used in Windows networking) may not be fully supported as on a local area network. Variants on VPN such as Virtual Private LAN Service (VPLS) and layer 2 tunneling protocols are designed to overcome this limitation.[13]

### Trusted and secure delivery networks

Trusted VPNs do not use cryptographic tunneling; instead, they rely on the security of a single provider's network to protect the traffic.[14] Multiprotocol Label Switching (MPLS) often overlays trusted VPNs, often with quality-of-service control over a trusted delivery network. A secure VPN either trusts the underlying delivery network or enforces security with an internal mechanism. Unless the trusted delivery network runs among physically secure sites only, both trusted and secure models need an authentication mechanism for users to gain access to the VPN.[citation needed]

## Types

### Mobile VPN

Mobile virtual private networks are used in settings where an endpoint of the VPN is not fixed to a single IP address, but instead roams across various networks such as data networks from cellular carriers or between multiple Wi-Fi access points without dropping the secure VPN session or losing application sessions.[15] Mobile VPNs are widely used in public safety where they give law-enforcement officers access to applications such as computer-assisted dispatch and criminal databases,[16] and in other organizations with similar requirements such as field service management and healthcare.[17][need quotation to verify]

### DMVPN

Dynamic Multipoint Virtual Private Network (DMVPN)[18] is a dynamic tunneling form of a virtual private network supported on Cisco IOS-based routers, Huawei AR G3 routers,[19] and Unix-like operating systems.

DMVPN provides the capability for creating a dynamic-mesh VPN network without having to statically pre-configure all possible tunnel end-point peers, such as IPsec and ISAKMP peers.[20] DMVPN is initially configured to build a hub-and-spoke network by statically configuring the hubs (VPN headends) on the spokes; no change in the configuration on the hub is required to accept new spokes. Using this initial hub-and-spoke network, tunnels between spokes are dynamically built on demand without additional configuration on the hubs or spokes. This dynamic-mesh capability alleviates the need for any load on the hub to route data between the spoke networks.

### EVPN

Ethernet VPN (EVPN) is a technology for carrying OSI layer 2 Ethernet traffic as a virtual private network using wide area network protocols. EVPN technologies include Ethernet over Multiprotocol Label Switching (MPLS) and Ethernet over Virtual Extensible LAN.[21][22]

### MPLS VPN

Multiprotocol Label Switching (MPLS) is a routing technique in telecommunications networks that directs data from one node to the next based on labels rather than network addresses.[23] Whereas network addresses identify endpoints, MPLS labels identify established paths between endpoints. MPLS can encapsulate packets of various network protocols.

In practice, MPLS is mainly used to forward IP protocol data units and Virtual Private LAN Service Ethernet traffic. Major applications of MPLS are telecommunications traffic engineering and MPLS VPN. MPLS works in conjunction with IP and its routing protocols, usually interior gateway protocols (IGPs) and supports the creation of dynamic, transparent virtual networks with support for traffic engineering, the ability to transport layer VPNs with overlapping address spaces, and for layer-2 pseudowires that are capable of transporting a variety of transport payloads (IPv4, IPv6, ATM, Frame Relay, etc.).[24]REFERENCE FOR RFC3985 IS NOT DEFINED YET. You are invited to add it here.

### VPLS

Virtual Private LAN Service (VPLS) is a virtual private network technology that provides Ethernet-based multipoint-to-multipoint communication over IP or MPLS networks. It allows geographically dispersed sites to share an Ethernet broadcast domain by connecting sites (including both servers and clients) through pseudowires.[25] The technologies that can be used as pseudo-wire can be Ethernet over MPLS, L2TPv3 or even GRE. There are two IETF standards-track RFCs (RFC 4761 and RFC 4762) describing VPLS establishment. In contrast to L2TPv3, which allows only point-to-point OSI layer 2 tunnels, VPLS allows any-to-any (multipoint) connectivity.[26][27]

### PPVPN

A provider-provisioned VPN (PPVPN) is a virtual private network (VPN) implemented by a connectivity service provider or large enterprise on a network they operate on their own, as opposed to a "customer-provisioned VPN" where the VPN is implemented by the customer who acquires the connectivity service on top of the technical specificities of the provider.

## Protocols

The life cycle phases of an IPSec tunnel in a virtual private network

A virtual private network is based on a tunneling protocol, and may be combined with other network or application protocols to provide additional security and capabilities.

### IPSec (1996)

Internet Protocol Security (IPsec) is a standards-based security protocol, initially developed by the Internet Engineering Task Force (IETF) for IPv6, and was required in all standards-compliant implementations of IPv6 before RFC 6434 made it only a recommendation.REFERENCE FOR RFC6434 IS NOT DEFINED YET. You are invited to add it here. It is also widely used with IPv4.

The design of IPSec meets most security goals: availability, integrity, and confidentiality. IPsec uses encryption, encapsulating an IP packet inside an IPsec packet. De-encapsulation happens at the end of the tunnel, where the original IP packet is decrypted and forwarded to its intended destination. IPsec is also often supported by network hardware accelerators,[28] which makes IPsec VPN desirable for low-power scenarios, like always-on remote access VPN configurations.[29][30]

IPsec tunnels are set up by the Internet Key Exchange (IKE) protocol. IPsec tunnels made with IKE version 1 (also known as IKEv1 tunnels, or often just "IPsec tunnels") can be used alone to provide VPN but are often combined with the Layer 2 Tunneling Protocol (L2TP) to reuse existing L2TP-related implementations for more flexible authentication features (e.g. Xauth).

IKE version 2, which was created by Microsoft and Cisco, can be used alone to provide IPsec VPN functionality. Its primary advantages are the native support for authenticating via the Extensible Authentication Protocol (EAP) and that the tunnel can be seamlessly restored when the IP address of the associated host is changing, which is typical of a roaming mobile device, whether on 3G or 4G LTE networks.

### TLS/SSL (1999)

Transport Layer Security (SSL/TLS) can tunnel an entire network's traffic (as it does in the OpenVPN project and SoftEther VPN project[31]) or secure an individual connection. A number of vendors provide remote-access VPN capabilities through TLS. A VPN based on TLS can connect from locations where the usual TLS web navigation (HTTPS) is supported without requiring additional configuration.

### OpenSSH (1999)

OpenSSH offers VPN tunneling (distinct from port forwarding) to secure[ambiguous] remote connections to a network, inter-network links, and remote systems. OpenSSH server provides a limited number of concurrent tunnels. The VPN feature itself does not support personal authentication.[32] SSH is more often used to remotely connect to machines or networks instead of a site to site VPN connection.

### OpenVPN (2001)

OpenVPN is a free and open-source VPN protocol based on the TLS protocol. It supports perfect forward-secrecy, and most modern secure cipher suites, like AES, Serpent, TwoFish, etc. It is currentlyTemplate:Current event inline being developed and updated by OpenVPN Inc., a non-profit providing secure VPN technologies.

### SSTP (2007)

Secure Socket Tunneling Protocol (SSTP) is a form of VPN tunnel that provides a mechanism to transport Point-to-Point Protocol (PPP) traffic through an SSL/TLS channel.

### Wireguard (2015)

WireGuard is a protocol designed to be more lightweight than OpenVPN.[33] In 2020, WireGuard support was added to both the Linux[34] and Android[35] kernels, opening it up to adoption by VPN providers. By default, WireGuard utilizes the Curve25519 protocol for key exchange and ChaCha20-Poly1305 for encryption and message authentication, but also includes the ability to pre-share a symmetric key between the client and server.[36]

### Other

* Datagram Transport Layer Security (DTLS) – used in Cisco AnyConnect VPN and in OpenConnect VPN[37] to solve the issues TLS has with tunneling over TCP (SSL/TLS are TCP-based, and tunneling TCP over TCP can lead to big delays and connection aborts[38]).
* Microsoft Point-to-Point Encryption (MPPE) works with the Point-to-Point Tunneling Protocol and in several compatible implementations on other platforms.
* Microsoft Secure Socket Tunneling Protocol (SSTP) tunnels Point-to-Point Protocol (PPP) or Layer 2 Tunneling Protocol traffic through an SSL/TLS channel (SSTP was introduced in Windows Server 2008 and in Windows Vista Service Pack 1).
* Multi Path Virtual Private Network (MPVPN). Ragula Systems Development Company owns the registered trademark "MPVPN".[relevant? - discuss][39]
* Crypto IP Encapsulation (CIPE) is a free and open-source VPN implementation for tunneling IPv4 packets over UDP via encapsulation.[40] CIPE was developed for Linux operating systems by Olaf Titz, with a Windows port implemented by Damion K. Wilson.[41] Development for CIPE ended in 2002.[42]
* L2TP[43] which is a standards-based replacement for two proprietary VPN protocols: Cisco's Layer 2 Forwarding (L2F)[44] (obsolete as of 2009[update]) and Microsoft's Point-to-Point Tunneling Protocol (PPTP).[45]

## Native and third-party support

Desktop, smartphone and other end-user device operating systems usually support configuring remote access VPN from their graphical or command-line tools.[46][47][48] However, due to the variety of, often non standard, VPN protocols, there exist many third-party applications that implement additional protocols not yet or no longer natively supported by the OS. For instance, Android lacked native IPsec IKEv2 support until version 11,[49] and users needed to install third-party apps in order to connect that kind of VPN. Conversely, Windows does not natively support plain IPsec IKEv1 remote access native VPN configuration (commonly used by Cisco and Fritz!Box VPN solutions).

## Society and culture

### Individual users

According to a 2022 estimate, 3% of Chinese netizens use VPNs, compared to 8.5% of Americans.[50][51] In China, VPNs are increasingly blocked and unauthorized usage can be subject to fines and legal prosecution.[50] Based on its estimates of leaked government documents, ChinaFile estimated in 2026 that VPN demand in China was in the low single digits. It also estimated that foreign apps blocked by the Great Firewall have extremely low traffic, particularly compared to domestic apps; the top five domestic apps saw traffic that was 1,000 times more than the top five foreign apps.[52]

As of 2025[update], approximately 1.75 billion people used VPNs. By 2027, this market is projected to grow to $76 billion.[53]

Amid Internet restrictions and blocking in Russia, Internet activists created the Amnezia VPN project in 2020 during a digital rights hackathon organized by Roskomsvoboda. The service gained popularity among Russian users by providing access to blocked resources, as well as features aimed at enhancing anonymity and resistance to traffic analysis.[54][55]

## See also

* Internet privacy
* Opportunistic encryption
* VPNLab

## References

1. ↑ "virtual private network". https://csrc.nist.gov/glossary/term/virtual_private_network.
2. ↑ "What Is a VPN? - Virtual Private Network" (in en). https://www.cisco.com/c/en/us/products/security/vpn-endpoint-security-clients/what-is-vpn.html.
3. ↑ Mason, Andrew G. (2002). Cisco Secure Virtual Private Network. Cisco Press. p. 7. ISBN 978-1-58705-033-6. https://archive.org/details/ciscosecurevirtu00andr.
4. ↑ Peterson, Larry; Davie, Bruce (2000). Computer Networks: A Systems Approach. Singapore: Harcourt Asia. ISBN 978-981-4066-43-3. https://book.systemsapproach.org/index.html. Retrieved May 24, 2025.
5. ↑ Anniss, Matthew (2015). Understanding Computer Networks. United States: Capstone. ISBN 978-1-4846-0907-1.
6. ↑ Tanenbaum, Andrew S. (2003). Computer Networks (4th ed.). Prentice Hall.
7. ↑ "What is VPN Split Tunneling?" (in en). https://www.fortinet.com/resources/cyberglossary/vpn-split-tunneling.
8. ↑ "VPN split tunneling". https://nordvpn.com/features/split-tunneling/.
9. ↑ Long, Moe (2021-07-22). "Best VPN for Split Tunneling" (in en-US). https://techuplife.com/best-vpn-split-tunneling.
10. ↑ "What is VPN split tunneling? All you need to know" (in en-US). https://surfshark.com/features/split-tunneling.
11. ↑ Remote Access VPN and a Twist on the Dangers of Split Tunneling, May 10, 2005, http://techgenix.com/2004fixipsectunnel/, retrieved 2017-12-05
12. ↑ RFC 3809 - Generic Requirements for Provider Provisioned Virtual Private Networks, sec. 1.1, doi:10.17487/RFC3809, RFC 3809, https://tools.ietf.org/html/rfc3809#section-1.1
13. ↑ Sowells, Julia (2017-08-07). "Virtual Private Network (VPN): What VPN Is And How It Works". https://hackercombat.com/virtual-private-network/.
14. ↑ Cisco Systems, Inc. (2004). Internetworking Technologies Handbook. Networking Technology Series (4 ed.). Cisco Press. p. 233. ISBN 978-1-58705-119-7. https://books.google.com/books?id=3Dn9KlIVM_EC. Retrieved 2013-02-15. "[...] VPNs using dedicated circuits, such as Frame Relay [...] are sometimes called trusted VPNs, because customers trust that the network facilities operated by the service providers will not be compromised."
15. ↑ Phifer, Lisa. "Mobile VPN: Closing the Gap" , SearchMobileComputing.com, 16 July 2006.
16. ↑ Willett, Andy. "Solving the Computing Challenges of Mobile Officers" , www.officer.com, May, 2006.
17. ↑ Cheng, Roger. "Lost Connections" , The Wall Street Journal, 11 December 2007.
18. ↑ Cisco engineers. "Dynamic Multipoint IPsec VPNs (Using Multipoint GRE/NHRP to Scale IPsec VPNs)" (in en). Cisco. https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/41940-dmvpn.html.
19. ↑ Huawei DSVPN Configuration
20. ↑ Kurniadi, S. H.; Utami, E.; Wibowo, F. W. (Dec 2018). "Building Dynamic Mesh VPN Network using MikroTik Router" (in en). Journal of Physics: Conference Series 1140. doi:10.1088/1742-6596/1140/1/012039. ISSN 1742-6596.
21. ↑ "EVPN Overview - TechLibrary - Juniper Networks". https://www.juniper.net/documentation/en_US/junos/topics/concept/evpns-overview.html.
22. ↑ "Understanding EVPN with VXLAN Data Plane Encapsulation - TechLibrary - Juniper Networks". https://www.juniper.net/documentation/en_US/junos/topics/concept/evpn-vxlan-data-plane-encapsulation.html.
23. ↑ Sturt, Robert; Rosencrance, Linda; Scarpati, Jessica (28 March 2023). "What is Multiprotocol Label Switching (MPLS)?". https://searchnetworking.techtarget.com/definition/Multiprotocol-Label-Switching-MPLS.
24. ↑ RFC 3031
25. ↑ H. Shah (Cisco Systems) (January 2015). "RFC 7436: IP‑Only LAN Service (IPLS)". IETF. https://www.ietf.org/rfc/rfc7436.html.
26. ↑ Rekhter, Yakov; Kompella, Kireeti (January 2007). ﻿Virtual Private LAN Service (VPLS) Using BGP for Auto-Discovery and Signaling﻿ (Report). Internet Engineering Task Force. https://datatracker.ietf.org/doc/rfc4761/.
27. ↑ Lasserre, Marc; Kompella, Vach (January 2007). ﻿Virtual Private LAN Service (VPLS) Using Label Distribution Protocol (LDP) Signaling﻿ (Report). Internet Engineering Task Force. https://datatracker.ietf.org/doc/rfc4762/.
28. ↑ "Security for VPNs with IPsec Configuration Guide, Cisco IOS Release 15S - VPN Acceleration Module [Support"] (in en). https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnips/configuration/15-s/sec-sec-for-vpns-w-ipsec-15-s-book/sec-vam.html.
29. ↑ "VPN overview for Apple device deployment" (in en). https://support.apple.com/guide/deployment/vpn-overview-depae3d361d0/web.
30. ↑ "About Always On VPN for Windows Server Remote Access" (in en-us). 2023-05-22. https://learn.microsoft.com/en-us/windows-server/remote/remote-access/overview-always-on-vpn.
31. ↑ "1. Ultimate Powerful VPN Connectivity". SoftEther VPN Project. https://www.softether.org/1-features/1._Ultimate_Powerful_VPN_Connectivity#SoftEther_VPN's_Solution:_Using_HTTPS_Protocol_to_Establish_VPN_Tunnels.
32. ↑ "ssh(1) – OpenBSD manual pages". https://man.openbsd.org/ssh.1#SSH-BASED_VIRTUAL_PRIVATE_NETWORKS.
* Barschel, Colin. "Unix Toolbox". http://cb.vu/unixtoolbox.xhtml#vpn.
* "SSH_VPN – Community Help Wiki". https://help.ubuntu.com/community/SSH_VPN.
33. ↑ Applied Cryptography and Network Security. Springer. 11 June 2018. ISBN 978-3-319-93387-0. https://books.google.com/books?id=UKJfDwAAQBAJ&pg=PA3. Retrieved 25 June 2018.
34. ↑ Salter, Jim (2020-03-30). "WireGuard VPN makes it to 1.0.0—and into the next Linux kernel" (in en-us). https://arstechnica.com/gadgets/2020/03/wireguard-vpn-makes-it-to-1-0-0-and-into-the-next-linux-kernel/.
35. ↑ "Diff - 99761f1eac33d14a4b1613ae4b7076f41cb2df94^! - kernel/common - Git at Google". https://android.googlesource.com/kernel/common/+/99761f1eac33d14a4b1613ae4b7076f41cb2df94^!.
36. ↑ Younglove, R. (December 2000). "Virtual private networks - how they work". Computing & Control Engineering Journal 11 (6): 260–262. doi:10.1049/cce:20000602. ISSN 0956-3385. https://ieeexplore.ieee.org/document/892887.
* Benjamin Dowling, and Kenneth G. Paterson (12 June 2018). "A cryptographic analysis of the WireGuard protocol". International Conference on Applied Cryptography and Network Security. ISBN 978-3-319-93386-3.
37. ↑ "OpenConnect". https://www.infradead.org/openconnect/index.html. "OpenConnect is a client for Cisco's AnyConnect SSL VPN [...] OpenConnect is not officially supported by, or associated in any way with, Cisco Systems. It just happens to interoperate with their equipment."
38. ↑ "Why TCP Over TCP Is A Bad Idea". http://sites.inka.de/~W1011/devel/tcp-tcp.html.
39. ↑ "Trademark Status & Document Retrieval". https://tarr.uspto.gov/servlet/tarr?regser=serial&entry=78063238&action=Request+Status.
40. ↑ Fuller, Johnray; Ha, John (2002). Red Hat Linux 9: Red Hat Linux Security Guide. United States: Red Hat, Inc.. pp. 48–53. https://archive.download.redhat.com/pub/redhat/linux/9/en/doc/RH-DOCS/pdf-en/rhl-sg-en.pdf. Retrieved 8 September 2022.
* Petersen, Richard (2004). "Chapter 17: Internet Protocol Security: IPsec, Crypto IP Encapsulation for Virtual Private Networks". Red Hat - The Complete Reference Enterprise Linux & Fedora Edition. United States: McGraw-Hill/Osborne. ISBN 0-07-223075-4. http://litux.nl/Reference/index.html?page=books/7213/ddu0125.html. Retrieved 17 January 2023.
41. ↑ Titz, Olaf (2011-12-20). "CIPE - Crypto IP Encapsulation". http://sites.inka.de/sites/bigred/devel/cipe.html.
42. ↑ Titz, Olaf (2013-04-02). "CIPE - encrypted IP in UDP tunneling". https://sourceforge.net/projects/cipe-linux/.
* Wilson, Damion (2002-10-19). "CIPE-Win32 - Crypto IP Encapsulation for Windows NT/2000". https://cipe-win32.sourceforge.net/.
43. ↑ Layer Two Tunneling Protocol "L2TP" , RFC 2661, W. Townsley et al., August 1999
44. ↑ IP Based Virtual Private Networks , RFC 2341, A. Valencia et al., May 1998
45. ↑ Point-to-Point Tunneling Protocol (PPTP) , RFC 2637, K. Hamzeh et al., July 1999
46. ↑ "Connect to a VPN in Windows - Microsoft Support". https://support.microsoft.com/en-us/windows/connect-to-a-vpn-in-windows-3d29aeb1-f497-f6b7-7633-115722c1009c.
47. ↑ "Connect to a virtual private network (VPN) on Android". https://support.google.com/android/answer/9089766?hl=en.
48. ↑ "VPN settings overview for Apple devices" (in en). https://support.apple.com/guide/deployment/vpn-settings-overview-dep2d2adb35d/web.
49. ↑ "IPsec/IKEv2 Library" (in en). https://source.android.com/docs/core/ota/modular-system/ipsec.
50. ↑ 50.0 50.1 Batke, Jessica; Edelson, Laura (June 30, 2025). "The Locknet: How China Controls Its Internet and Why It Matters" (in en). Asia Society. https://locknet.chinafile.com/the-locknet/intro/.
51. ↑ Edwards, David (2022-07-21). "Key VPN Statistics: What Are the Numbers Telling Us?" (in en-US). https://roboticsandautomationnews.com/2022/07/21/key-vpn-statistics-what-are-the-numbers-telling-us/53067/.
52. ↑ Batke, Jessica; Edelson, Laura (2026-06-02). "Leaked Documents Show the Success of China's VPN Crackdown" (in en). Asia Society. https://www.chinafile.com/reporting-opinion/features/leaked-documents-show-success-of-chinas-vpn-crackdown.
53. ↑ Hooson, Mark (2025-03-03). "VPN Statistics" (in en-GB). https://www.forbes.com/uk/advisor/business/vpn-statistics/.
54. ↑ Borak, Masha (7 April 2023). "The Open Source VPN Out-Maneuvering Russian Censorship". https://www.wired.com/story/amnezia-vpn-russia-censorship/.
55. ↑ Gill, Mark (27 March 2026). "Amnezia VPN review 2026". https://www.techradar.com/vpn/amnezia-vpn-review-year.

## Further reading

* Kelly, Sean (August 2001). "Necessity is the mother of VPN invention". Communication News: 26–28. ISSN 0010-3632. http://www.comnews.com/cgi-bin/arttop.asp?Page=c0801necessity.htm.

* v
* t
* e

Virtual private networking

Communications protocol|

* SSTP
* IPsec
* L2TP
* L2TPv3
* PPTP
* Split tunneling
* SSL/TLS
* (Opportunistic: tcpcrypt)

Free software|

* Cloudvpn
* FreeLAN
* FreeS/WAN
* Libreswan
* n2n
* OpenConnect
* OpenIKED
* Openswan
* OpenVPN
* Social VPN
* SoftEther VPN
* strongSwan
* tcpcrypt
* tinc
* VTun
* WireGuard
* Shadowsocks

Vendor-driven protocols|

* Layer 2 Forwarding Protocol
* DirectAccess

Proprietary software|

* Avast SecureLine VPN
* Check Point VPN-1
* Cisco Systems VPN Client
* LogMeIn Hamachi
* Microsoft Forefront Unified Access Gateway
* Hola
* Tunnelbear
* NordVPN
* SaferVPN
* ExpressVPN
* ProtonVPN
* PureVPN
* VPN.ht
* Private Internet Access

Risk vectors|

* Content-control software
* Deep content inspection
* Deep packet inspection
* IP address blocking
* Network enumeration
* Stateful firewall
* TCP reset attack
* VPN blocking

* v
* t
* e

Cryptographic software

Email clients|

* Apple Mail
* Autocrypt
* Claws Mail
* Enigmail
* GPG (Gpg4win)
* Kontact
* Outlook
* p≡p
* PGP
* Sylpheed
* Thunderbird

Secure
communication|

| OTR|

* Adium
* BitlBee
* Centericq
* ChatSecure
* climm
* Jitsi
* Kopete
* MCabber
* Profanity

|

SSH|

* Dropbear
* lsh
* OpenSSH
* PuTTY
* SecureCRT
* WinSCP
* wolfSSH

TLS & SSL|

* Bouncy Castle
* BoringSSL
* Botan
* cryptlib
* GnuTLS
* JSSE
* LibreSSL
* MatrixSSL
* NSS
* OpenSSL
* mbed TLS
* RSA BSAFE
* SChannel
* SSLeay
* stunnel
* wolfSSL

VPN|

* Check Point VPN-1
* Hamachi
* Openswan
* OpenVPN
* SoftEther VPN
* strongSwan
* Tinc
* WireGuard

ZRTP|

* CSipSimple
* Jitsi
* Linphone
* Jami
* Zfone

P2P|

* Bitmessage
* RetroShare
* Tox

DRA|

* Matrix
* OMEMO
* Conversations
* Cryptocat
* ChatSecure
* Proteus
* Signal Protocol
* Google Allo
* Facebook Messenger
* Signal
* TextSecure
* WhatsApp

Disk encryption
(Comparison)|

* BestCrypt
* BitLocker
* CrossCrypt
* Cryptoloop
* DiskCryptor
* dm-crypt
* DriveSentry
* E4M
* eCryptfs
* FileVault
* FreeOTFE
* GBDE
* geli
* LUKS
* PGPDisk
* Private Disk
* Scramdisk
* Sentry 2020
* TrueCrypt
* History
* VeraCrypt

Anonymity|

* GNUnet
* I2P
* Java Anon Proxy
* Tor
* Vidalia
* RetroShare
* Ricochet
* Wickr

File systems (List)|

* EncFS
* EFS
* eCryptfs
* LUKS
* PEFS
* Rubberhose
* StegFS
* Tahoe-LAFS

Service providers|

* Freenet
* Tresorit
* Wuala

Educational|

* CrypTool

Related topics|

* Outline of cryptography
* Timeline of cryptography
* Hash functions
* Cryptographic hash function
* List of hash functions
* S/MIME

* Category
* Commons

* v
* t
* e

Internet censorship circumvention technologies

Background|

* Internet censorship
* Internet censorship in China
* National intranet
* Censorship and blocking technologies
* IP address blocking
* DNS cache poisoning
* Wordfilter
* Great Firewall of China
* Blocks on specific websites
* Wikipedia
* Facebook
* Twitter

Principles|

| With a proxy server|

* P2P
* Web proxies
* SSH
* VPN
* PAC

|

Without a proxy server|

* HTTPS
* IPv6 transition mechanism
* hosts
* DNSCrypt
* Domain fronting

Anti-censorship software|

| Free software|

* Lantern
* Psiphon
* Shadowsocks
* Outline VPN
* ~~GoAgent~~

|

Proprietary software|

* Freegate
* Ultrasurf
* Hotspot Shield
* ~~fqrouter~~
* ~~Xiaoyaoyou~~
* ~~Huofenghuang~~
* ~~Garden Networks~~
* ~~Telex~~
* FreeBrowser
* CGIProxy
* Proxify

Browser extensions|

* Hongxing
* ~~uProxy~~

Anonymity|

| Anonymous software|

* Tor
* JAP
* Flash proxy
* Mixmaster

|

Anonymous P2P network|

* I2P
* ZeroNet
* Freenet
* StealthNet

Relevant organizations|

* GreatFire
* FreeWeibo
* Turkey Blocks

Reference|

* Program Think Blog
* Great Cannon

~~Strike through~~ = the custodians have stopped maintenance

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Virtual private network. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Virtual_private_network&oldid=4572057"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template