Virtual Private Network
An encrypted tunnel that presents a remote network as local, and the narrow set of things a commercial one actually hides.
A virtual private network is an encrypted tunnel that makes a remote network reachable as though the machine were attached to it directly. Traffic is encapsulated, carried across the untrusted path, and decapsulated at the far end, where it emerges with an address belonging to the remote network.
The distinction that causes the most confusion is where the tunnel sits. An operating-system-level VPN creates a virtual interface and installs routes, so every program is carried whether or not it knows the tunnel exists. An application-level proxy is configured per program — a browser setting, an SSH dynamic forward — and everything else keeps the default route, including background updaters and, usually, name resolution. Split tunnelling sits between the two: named destinations go through the tunnel and the rest go direct, limiting blast radius in the spirit of Least Privilege, provided the list is right.
WireGuard, merged into the Linux kernel in 2020, reorganized the problem around cryptokey routing: a peer is a public key bound to a list of permitted addresses, and that single table serves as both routing table and access control list. There is no cipher negotiation — a fixed modern suite with keyed Hash Function constructions from the Noise framework — and no reply at all to unauthenticated packets. A few thousand lines against hundreds of thousands for IPsec or OpenVPN is the security argument. It runs over one UDP Port and treats the network as Peer-to-Peer; mesh products add key distribution on top, a role resembling a Signaling Server.
A commercial VPN relocates trust rather than removing it: the local network and access provider stop seeing destinations, and the provider starts. It does not anonymize. Logged-in accounts, cookies and browser fingerprints identify the same person, Domain Name System queries leak whenever the resolver is not tunnelled too, and WebRTC can expose local addresses. Since transport is already encrypted, the hostile-café argument is largely obsolete.
See also4
eSIM
A SIM soldered into the device and provisioned over the air, with profiles downloaded rather than cards swapped.
Networks & Distribution12 connections
Secret Management
Storing, distributing, and rotating credentials without embedding them in code or history.
Systems & Tooling33 connections
Streaming Response
Delivering a response incrementally as it is produced rather than all at once when complete.
Networks & Distribution20 connections
Code Signing
Cryptographically attesting who produced a binary, and the operating-system checks built on it.
Systems & Tooling27 connections
Linked from16
- Caller ID AuthenticationNetworks & Distribution
Cryptographic attestation of an originating telephone number, and why spoofed calls survive it.
- Conflict-Free Replicated Data TypeNetworks & Distribution
A data structure whose replicas can be edited independently and always converge without coordination.
- Domain Name SystemSystems & Tooling
The distributed directory translating names to addresses, and the layer where propagation delays live.
- eSIMNetworks & Distribution
A SIM soldered into the device and provisioned over the air, with profiles downloaded rather than cards swapped.
- Multi-TenancyData & Content
One deployment serving many isolated customers, with tenancy threaded through data, routing, and access.
- Multicast DNSNetworks & Distribution
How devices on a local network find each other by name, and discover printers, speakers, and screens, without any server or configuration, by asking everyone at once.
- Network Address TranslationNetworks & Distribution
Rewriting the addresses in packets as they cross a router so that many devices can share one public IPv4 address, a stopgap that became permanent and broke the internet's end-to-end design.
- Peer-to-PeerNetworks & Distribution
An architecture where participants communicate directly rather than through a central server.
- Remote DesktopNetworks & Distribution
Controlling a computer from somewhere else by streaming its screen to a distant machine and sending keyboard and mouse input back, used for IT support, remote work and cloud gaming, and a favorite entry point for attackers when left exposed.
- Same-Origin PolicyWeb Platform
The browser rule isolating documents by scheme, host, and port, and the mechanisms for relaxing it.
- Secure ShellSystems & Tooling
The encrypted protocol for logging into and running commands on remote machines, authenticated by key pairs, that also tunnels other traffic and underpins Git.
- Signaling ServerNetworks & Distribution
The small coordination service peers use to find each other before connecting directly.
- SubnetNetworks & Distribution
A block of IP addresses that share a common prefix, written in CIDR notation such as 192.168.1.0/24, which decides what a device can reach directly and what it must send through a router.
- WebRTCNetworks & Distribution
The browser standard for direct peer connections carrying audio, video, and arbitrary data.
- Wi-FiNetworks & Distribution
Wireless local networking over shared, unlicensed radio channels, where every device on a channel takes turns talking, which explains most of its speed, range, and reliability quirks.
- Zero Trust NetworkNetworks & Distribution
Zero trust authenticates and authorizes every request individually, treating network location as no proof of anything.