VPN :: ENCRYPTED TUNNEL

> A VPN creates an encrypted tunnel between your device and a VPN server.
> Useful to protect a connection, reach a remote network, or reduce exposure of your public IP address.

TL;DR: A VPN encrypts traffic between you and the VPN server. It is useful on untrusted networks, but it is not a magic anonymity tool.

WHAT IS A VPN?

A VPN, or Virtual Private Network, is an encrypted network tunnel. When it is active, part or all of your traffic goes through this tunnel before reaching its destination.

The website or service you access usually sees the VPN server IP address, not directly your home or local network IP. However, the VPN provider, or the server you administer, can see that a connection exists.

WHAT IT IS FOR

Securing a connection from public Wi-Fi, accessing a company or lab network, hiding your original IP from some services, or linking several sites together.

WHAT IT DOES NOT DO

A VPN does not make you anonymous by magic. It does not replace good security habits, does not block every tracker, and does not protect you if your device is compromised.

COMMON USE CASES

REMOTE ACCESS

Connecting a remote user to a private network: company, homelab, NAS, monitoring, GLPI, etc.

SITE-TO-SITE

Permanent tunnel between two networks: headquarters and branch office, two remote VLANs, or two firewalls.

PRIVACY

Reduces exposure of your real IP address on the destination side, especially on public or untrusted networks.

COMMON PROTOCOLS

WIREGUARD

Modern, fast, simple to configure, and a very good choice for a homelab or clean remote access setup.

OPENVPN

Older, very compatible, and often used in companies or by VPN providers.

IPSEC / IKEV2

Widely used for site-to-site tunnels, especially between firewalls, routers, and professional network devices.

SSL VPN

Common on enterprise firewalls. Convenient for users, but heavily dependent on the vendor implementation.

FULL TUNNEL VS SPLIT TUNNEL

cluster@vpn:~$ routing-mode

FULL TUNNEL
All traffic goes through the VPN.
+ Easy to understand
+ Better protection on public Wi-Fi
- Can be slower
- Everything depends on the VPN server

SPLIT TUNNEL
Only selected networks go through the VPN.
+ Faster
+ Ideal to access a remote LAN
- Less protective for normal internet traffic

SIMPLE MENTAL MODEL

Your PC  --->  Encrypted tunnel  --->  VPN server  --->  Internet

The local network sees a VPN connection.
The final service sees the VPN server IP.
The VPN server becomes a trust point.

THINGS TO WATCH

Choose a trusted server or provider.
Enable the kill switch when possible.
Avoid shady free VPNs.
Check for DNS leaks.
Keep the VPN client and server updated.
Protect private keys and configuration files.

PRIVACY-RESPECTING VPN PROVIDERS

No VPN provider should be trusted only because of marketing. A privacy-oriented VPN should minimize collected data, support modern protocols, publish clear policies, accept privacy-friendly payment methods when possible, and have public audits.

MULLVAD

Strong privacy-first approach: no email required, numbered accounts, cash and Monero payments, WireGuard/OpenVPN support, and a strict no-activity-logs policy. Good choice when account anonymity matters.

PROTON VPN

Good privacy-focused option with open-source apps, WireGuard/OpenVPN support, a strict no-logs policy, and recurring independent no-logs audits. Good choice if you already use Proton services.

IVPN

Minimal-account model, no email required, WireGuard/OpenVPN support, kill switch, tracker blocking, cash and crypto payments, and a clear no-logs position. Good choice for a simple privacy-focused setup.

HOW TO CHOOSE A VPN FOR PRIVACY

cluster@vpn:~$ privacy-check

[ ] No activity logs
[ ] Independent audits available
[ ] WireGuard and OpenVPN supported
[ ] Kill switch available
[ ] DNS leak protection
[ ] Clear company ownership
[ ] Anonymous or minimal signup
[ ] Cash / Monero / privacy-friendly payment possible
[ ] No fake "100% anonymous" marketing

A good shortlist for privacy is: Mullvad, Proton VPN, and IVPN. This is not a sponsored ranking. Always re-check current policies before paying, because providers can change ownership, jurisdiction, logging practices, or features.

Avoid VPNs that promise total anonymity, require unnecessary personal data, hide ownership, inject ads, or offer a "free unlimited" service without explaining how it is funded.

IMPORTANT: A VPN moves trust. Instead of trusting only your ISP or the local network, you also trust the VPN server. For strong anonymity, Tor is still more suitable than a simple VPN.

VPN AND TOR

VPNs and Tor do not serve exactly the same purpose. A VPN is useful to secure network access or hide your IP from some services. Tor is designed to better separate identity, IP address, and destination.

For admin or homelab use, WireGuard is often a very good choice. To bypass censorship or seek stronger anonymity, it is better to understand Tor, bridges, and the limits of each approach.

MINI CHECKLIST

cluster@vpn:~$ secure-check

[ ] Modern protocol selected
[ ] Strong authentication
[ ] Private keys protected
[ ] Automatic updates enabled
[ ] DNS under control
[ ] Kill switch tested
[ ] Logs understood
[ ] Access limited to what is strictly necessary

SOURCES

BACK CONTACT