Tech_Interview_Prep

VPNs & Tunneling

Encapsulating traffic inside another protocol to create a private, often encrypted path across an untrusted network.

OverviewQ&AMCQ

What it is

Tunneling encapsulates one network protocol's traffic inside another, creating a logical path across an underlying network that the tunnel itself doesn't need to trust — VPNs are the most common application, adding encryption to that tunnel for privacy and integrity.

Key points

  • Site-to-site vs. remote-access VPNs: site-to-site VPNs connect two networks (e.g. an office and a cloud VPC) continuously; remote-access VPNs let an individual device connect into a private network on demand.
  • IPsec vs. TLS-based VPNs: IPsec operates at the network layer and is common for site-to-site connections; TLS-based VPNs (like WireGuard or OpenVPN) operate higher up and are often simpler to deploy for remote access.
  • What a VPN actually guarantees: confidentiality and integrity of traffic between the two tunnel endpoints — it doesn't make either endpoint itself more secure, which is a common misunderstanding of what a VPN protects against.
  • Modern zero-trust network architectures increasingly replace traditional "VPN into the whole internal network" with per-application access — reducing the blast radius of a compromised VPN credential.