A virtual private network () is a tunnel: traffic is encapsulated and encrypted at one end, carried across a network nobody trusts, and unwrapped at the other as if the two ends shared a private wire. The retired fundamentals blueprint asked for the rationale - privacy, encryption, anonymity - and the valid uses, a pairing worth keeping together because the rationale is where the honest limits live.
The function: an encrypted overlay
Technically, a VPN puts whole packets inside other packets, protected by cryptography. The inner traffic keeps its private addressing and its meaning; the outer wrapper is all any intermediate network sees - endpoints and ciphertext. That single move buys the two properties the blueprint names first. Confidentiality: observers along the path read nothing of the content. Integrity and authenticity: the endpoints prove themselves to each other and tampering is detectable. The result behaves like a Layer 3 extension cord - remote things join the network as if local, which is both the entire value and the entire risk.
Valid uses
Three patterns cover practice. Site-to-site: two networks joined across the internet - branch to headquarters, data center to cloud - with gateways tunneling on behalf of everyone behind them; the users never know. Remote access: an individual device tunnels into the organization, arriving with an internal address and internal reachability; this is the corporate client on the laptop, and the pattern F5 implements in Secure Sockets Layer (SSL) VPN form through its access module. And privacy transit: routing personal traffic through a provider to shield it from the local network - the coffee-shop case - and to change the address the destination sees.
The honest boundaries
The blueprint's third word, anonymity, deserves the asterisk it rarely gets. A VPN moves trust; it does not remove it. The tunnel provider sees what the local network no longer can, the destination still sees a real address - the provider's - and identity leaks happily above the tunnel through logins, cookies, and fingerprints. Encrypted is likewise not endorsed: the tunnel authenticates its endpoints, not the intentions of the traffic inside, which is exactly why remote-access designs pair tunnels with posture checks and per-application policy, and why the industry's turn treats "on the VPN" as the beginning of an access decision rather than the end of one. And a tunnel terminates: past its far end, traffic travels as plainly as it ever would - protection for the segment where it applies, not a blessing on the whole path, a boundary worth respecting in exactly the way TLS termination points demand one layer up.
Stated plainly for the exam question the retired blueprint asked: the rationale is confidentiality and integrity across untrusted segments, with anonymity a partial and provider-shaped property; the valid uses are joining networks, admitting remote users, and shielding transit - each excellent within its segment, none a substitute for securing what waits at either end.
This series, in order
This article opens the series Tunnels and VPNs. It sets out what any tunnel can and cannot promise; the parts go from the simplest envelope to the full negotiation of and the deliberately small , then to the overhead and arithmetic that causes most tunnel trouble, and end with the being dismantled.
- GRE Tunnels: The Simplest Envelope in Networking. One packet inside another with no encryption and no authentication, and why that simplicity is useful.
- IPsec and IKE: How Encrypted Tunnels Negotiate Themselves. negotiates who you are and which keys to use, carries the packets: security associations, IKEv1 and IKEv2, tunnel and transport mode.
- WireGuard: the argument that a tunnel should be small enough to read. About four thousand lines, one cipher suite and no negotiation: the argument that a tunnel should be small enough to read.
- Tunnel Overhead, MTU, and MSS: The Byte Math Every Tunnel Owes. The bytes each encapsulation adds, the ceiling of the path, and the mysterious slowness between the two.
- Jumbo frames: when 1500 bytes stops being enough. Why settled on 1500 bytes, what 9000-byte frames buy, and how an MTU mismatch becomes a silent black hole.
- Why the SSL-VPN is being dismantled, and what is actually replacing it. Fortinet removed SSL VPN tunnel mode from FortiOS, and what is actually replacing remote-access VPNs.