VPN types compared
All 34 types in one table, ordered by how widely they are deployed today. Everything here links through to a full explanation and a working config generator.
34 of 34 shown
| VPN type | What it connects | Protocols | Encryption | Used today | Main use case | Generator |
|---|---|---|---|---|---|---|
| WireGuard | Device/network → device/network | WireGuard | Encrypted | Most used98 | Fast, low-overhead tunnels for almost any topology. | Generate |
| Remote-Access VPN | Individual device → private network | WireGuardIKEv2/IPsecOpenVPNSSL/TLS | Encrypted | Most used96 | Secure access to company resources from outside the office. | Generate |
| Consumer VPN | User device → VPN provider | WireGuardOpenVPNIKEv2/IPsec | Encrypted | Most used94 | Privacy on untrusted networks and changing apparent location. | Generate |
| IPsec VPN | Device/network → device/network | IKEv2ESPAH | Encrypted | Most used92 | Both site-to-site links and standards-based remote access. | Generate |
| Client-to-Site VPN | VPN client → VPN gateway | OpenVPNWireGuardIKEv2/IPsecSSL VPN | Encrypted | Most used90 | Remote work with per-user authentication and access scoping. | Generate |
| Site-to-Site VPN | Network → network | IPsecGRE over IPsecWireGuard | Encrypted | Most used88 | Connecting branch offices and data centres. | Generate |
| IKEv2/IPsec | Device → VPN gateway | IKEv2IPsec/ESP | Encrypted | Most used86 | Native OS remote access on iOS, macOS, Windows and Android. | Generate |
| ZTNA / SASE | User/device → specific application | TLSmTLSIdentity-aware proxies | Encrypted | Growing fast85 | Granting access to applications without exposing the network behind them. | Generate |
| Cloud VPN | On-premises network → cloud network | IPsecIKEv2Provider-managed gateways | Encrypted | Growing fast84 | Hybrid connectivity between a data centre and AWS, Azure or GCP. | Generate |
| OpenVPN | Device/network → VPN server | OpenVPN | Encrypted | Widely used82 | General-purpose VPN where compatibility matters most. | Generate |
| SD-WAN | Sites, clouds and users | IPsecTLSVendor overlays | Encrypted | Growing fast80 | Replacing expensive private circuits with managed internet links. | Generate |
| Corporate VPN | Employees → company network | IPsecSSL/TLSWireGuard | Encrypted | Widely used78 | Enterprise remote access under a single policy and audit trail. | Generate |
| Peer-to-Peer / Mesh VPN | Device ↔ device/network | WireGuard-based overlaysProprietary mesh protocols | Encrypted | Growing fast76 | Connecting many devices without a central gateway to funnel through. | Generate |
| SSL/TLS VPN | User/device → VPN gateway | TLSOpenConnectOpenVPNSSTP | Encrypted | Widely used74 | Remote access from hotel, airport and captive-portal networks. | Generate |
| Mobile VPN | Mobile device → private network | IKEv2/IPsec (MOBIKE)WireGuard | Encrypted | Widely used72 | Keeping a session alive while moving between networks. | Generate |
| Hub-and-Spoke VPN | Branches → central hub | IPsecWireGuardDMVPN | Encrypted | Widely used70 | Centralised branch connectivity and traffic inspection. | Generate |
| Obfuscated VPN / proxy | Device → proxy/relay server | ShadowsocksVMessVLESSTrojan | Encrypted | Growing fast68 | Reaching the open internet where VPN protocols are detected and blocked. | Generate |
| Intranet VPN | Organisation network → organisation network | IPsecMPLSSD-WAN | Depends on transport | Widely used66 | One private network spanning every company location. | Generate |
| Full-Mesh VPN | Every site ↔ every other site | WireGuardIPsecSD-WAN | Encrypted | Growing fast60 | Low-latency direct traffic between all locations. | Generate |
| Extranet VPN | Organisation → partner organisation | IPsecSSL/TLS | Encrypted | Widely used54 | Letting a partner reach a defined slice of your network. | Generate |
| Dynamic VPN | Multiple changing endpoints | DMVPNSD-WANMesh overlays | Encrypted | Widely used52 | Avoiding hand-configured tunnels in a network that keeps changing. | Generate |
| OpenConnect / ocserv | Client → ocserv gateway | TLSDTLSAnyConnect-compatible | Encrypted | Niche44 | Enterprise-style SSL VPN without proprietary licensing. | Generate |
| MPLS VPN | Private enterprise networks | MPLSBGPVRF | Not encrypted | Declining42 | Predictable, SLA-backed private WAN connectivity. | Generate |
| GRE over IPsec | Router/network → router/network | GREIPsec | Encrypted | Niche40 | Carrying OSPF/EIGRP or multicast across an encrypted WAN. | Generate |
| Clientless SSL VPN | Browser → VPN gateway / application portal | SSL/TLSHTTPS reverse proxy | Encrypted | Declining38 | Give unmanaged devices access to a handful of web applications. | Generate |
| Layer-2 overlay network | Device ↔ virtual LAN | ZeroTier-style overlaysVXLANGENEVE | Encrypted | Niche36 | Making scattered machines behave like one LAN. | Generate |
| DMVPN | Many enterprise sites | mGRENHRPIPsec | Encrypted | Declining34 | A WAN that behaves like a mesh without configuring every pair. | Generate |
| Multi-hop VPN | Device → relay → exit → internet | WireGuardOpenVPNShadowsocks chains | Encrypted | Niche32 | Splitting trust between two independent servers. | Generate |
| SSTP | Windows device → VPN gateway | SSTPTLSPPP | Encrypted | Declining30 | Remote access from networks that only allow HTTPS. | Generate |
| VPLS / Layer-2 VPN | LAN segment ↔ LAN segment | VPLSL2TPv3VXLANEoIP | Depends on transport | Declining28 | Stretching a VLAN across locations. | Generate |
| SoftEther | Device/network → SoftEther server | SoftEtherOpenVPNL2TP/IPsecSSTP | Encrypted | Niche26 | Serving many different clients from a single gateway. | Generate |
| L2TP/IPsec | Device → VPN gateway | L2TPIPsec | Encrypted | Declining24 | Remote access on older equipment that offers nothing better. | Generate |
| 6in4 / IPv6 tunnel | Device/network → tunnel broker | 6in4GRETunnel brokers | Not encrypted | Declining18 | Getting IPv6 connectivity where the ISP provides none. | Generate |
| PPTP | Device → VPN server | PPTPGREMPPE | Broken encryption | Obsolete6 | Recognising and replacing an obsolete deployment. | Generate |
How to read this table
Encryption
“Not encrypted” means the technology isolates traffic without protecting it — MPLS and VXLAN both need IPsec on top if confidentiality matters.
Used today
A 0–100 score for real-world deployment in 2026. WireGuard leads on protocols; remote access leads on topologies.
Categories
Remote access, Site to site, Protocols, Overlay & managed, Legacy — filter by any of them in the catalogue.