Handbook · networking reference · no affiliations

Virtual private networks: the reference notes.

A plain account of what tunnel technology does at the protocol level, how vendor documentation uses its vocabulary, and which parameters are worth reading before choosing anything.

SECTION: 5 READ: ~8 min REVIEWED: 2026-01 STATUS: stable

01What a tunnel changes

A VPN re-routes where your traffic enters the public network. Ordinarily that entry point is your local router. With a tunnel, traffic is encrypted to a server you selected and enters the internet from there instead. The change is one of geography, not magic: the packets are sealed to a point, and the destination sees that point.

Note the symmetry: the destination website sees the VPN exit, but you also hand your traffic’s full history to the VPN operator. Reading a provider’s logging policy is not optional reading.

02Protocols in brief

Name	RFC / lineage	Reference notes
WireGuard	modern, in-kernel	Small codebase by design; fast handshake; keys rotate without state loss. The reference configuration is deliberately minimal.
OpenVPN	userspace, TLS-based	Two decades of public review; extensive configuration surface, where most misconfigurations originate.
IKEv2 / IPsec	standards-track (RFC 7296 et al.)	Rekeys gracefully across network changes; ubiquitous on mobile operating systems.
Vendor protocols	undisclosed	Cannot be checked against a specification. Treat trust as an input, not an output.

03Known limits

Reference notes must record limits as plainly as features. A tunnel does not unmask accounts you sign into; an authenticated session travels with you. It does not replace transport encryption, which is HTTPS’s domain entirely. And it does not stop client-side fingerprinting, which reads the browser rather than the address.

Practical ordering: patching, credential hygiene, and HTTPS are the load-bearing walls. A tunnel adds a wall beside them; it never leans on one for support.

04Parameters worth reading

Vendor documentation rarely puts these on the front page, yet they determine most of the experience:

Logging policy text. The full policy, not the marketing summary of it.
Protocol defaults. Defaults show engineering intent better than feature lists.
Kill-switch semantics. Interface-level or process-level, and what happens on rekey.
DNS handling. Leak tests are trivial and belong in any setup checklist.
Jurisdiction. Where the operator can be compelled, and what has been compelled there before.
Pricing pattern. Deep discounts and luxury premiums are both informative signals.

05Glossary

Exit node

The server where tunneled traffic rejoins the public internet. All destinations see this node’s address.

Handshake

The key-exchange phase establishing the session. Its speed and cost are protocol-defining properties.

Split tunneling

A configuration routing only selected traffic through the tunnel; the rest keeps its ordinary path.

Leak

Traffic reaching the internet outside the tunnel, usually via DNS or IPv6.

Questions this handbook receives

Does this handbook recommend a provider?

No. It documents protocol behaviour and parameter vocabulary. Provider selection stays with the reader, on evidence the reader can verify.

Is the content legal to read?

Everywhere that publishes networking documentation is. A small set of jurisdictions restricts VPN use itself; the reader’s local law governs their deployment, not this page.

Do you host any VPN software?

No software is hosted or distributed on this domain. The handbook describes; it does not carry.