Skip to content

Every type of VPN, explained

34 VPN types across protocols, topologies and managed services — how each one works, how widely it is used today, and the config files you can generate for it.

Showing 34 of 34 types

WireGuard

Most used

A small, fast, modern tunnel built on fixed cryptography.

WireGuard
Generate config

Remote-Access VPN

Most used

A single device tunnels into a private network from anywhere.

WireGuardIKEv2/IPsecOpenVPN
Generate config

Consumer VPN

Most used

Traffic routed through a provider's server to mask your IP.

WireGuardOpenVPNIKEv2/IPsec
Generate config

IPsec VPN

Most used

The IETF standard for authenticating and encrypting IP packets.

IKEv2ESPAH
Generate config

Client-to-Site VPN

Most used

Client software dials a gateway — the classic corporate pattern.

OpenVPNWireGuardIKEv2/IPsec
Generate config

Site-to-Site VPN

Most used

Two gateways hold a permanent tunnel so whole networks can talk.

IPsecGRE over IPsecWireGuard
Generate config

IKEv2/IPsec

Most used

The mobile-friendly IPsec profile with fast reconnects.

IKEv2IPsec/ESP
Generate config

ZTNA / SASE

Growing fast

Per-application access checks instead of a network tunnel.

TLSmTLSIdentity-aware proxies
Generate config

Cloud VPN

Growing fast

Your on-premises network, tunnelled into a cloud VPC.

IPsecIKEv2Provider-managed gateways
Generate config

OpenVPN

Widely used

The mature, endlessly configurable TLS-based tunnel.

OpenVPN
Generate config

SD-WAN

Growing fast

Software picks the path; encrypted overlays ride on top.

IPsecTLSVendor overlays
Generate config

Corporate VPN

Widely used

Company-operated infrastructure with central identity and policy.

IPsecSSL/TLSWireGuard
Generate config

Peer-to-Peer / Mesh VPN

Growing fast

Devices connect directly, coordinated by a small control plane.

WireGuard-based overlaysProprietary mesh protocols
Generate config

SSL/TLS VPN

Widely used

Tunnels that ride the same TLS everyone already allows.

TLSOpenConnectOpenVPN
Generate config

Mobile VPN

Widely used

A tunnel that survives switching between Wi-Fi and cellular.

IKEv2/IPsec (MOBIKE)WireGuard
Generate config

Hub-and-Spoke VPN

Widely used

Every branch connects to one central gateway.

IPsecWireGuardDMVPN
Generate config

Obfuscated VPN / proxy

Growing fast

Tunnels shaped to look like ordinary traffic.

ShadowsocksVMessVLESS
Generate config

Intranet VPN

Widely used

Site-to-site links between networks owned by the same organisation.

IPsecMPLSSD-WAN
Generate config

Full-Mesh VPN

Growing fast

Every site holds a direct tunnel to every other site.

WireGuardIPsecSD-WAN
Generate config

Extranet VPN

Widely used

A controlled tunnel to a partner organisation.

IPsecSSL/TLS
Generate config

Dynamic VPN

Widely used

Tunnels built on demand between changing endpoints.

DMVPNSD-WANMesh overlays
Generate config

OpenConnect / ocserv

Niche

An open SSL VPN that speaks the AnyConnect protocol.

TLSDTLSAnyConnect-compatible
Generate config

MPLS VPN

Declining

Carrier-isolated private WAN — isolated, but not encrypted.

MPLSBGPVRF
Generate config

GRE over IPsec

Niche

GRE carries what IPsec alone cannot; IPsec encrypts it.

GREIPsec
Generate config

Clientless SSL VPN

Declining

Browser-only access to selected internal applications.

SSL/TLSHTTPS reverse proxy
Generate config

Layer-2 overlay network

Niche

A virtual switch spanning devices anywhere.

ZeroTier-style overlaysVXLANGENEVE
Generate config

DMVPN

Declining

Spokes discover each other and build direct tunnels on demand.

mGRENHRPIPsec
Generate config

Multi-hop VPN

Niche

Two chained tunnels so no single server sees both ends.

WireGuardOpenVPNShadowsocks chains
Generate config

SSTP

Declining

Microsoft's SSL tunnel, native to Windows.

SSTPTLSPPP
Generate config

VPLS / Layer-2 VPN

Declining

Remote sites share one broadcast domain as if on the same switch.

VPLSL2TPv3VXLAN
Generate config

SoftEther

Niche

One server that speaks many VPN protocols at once.

SoftEtherOpenVPNL2TP/IPsec
Generate config

L2TP/IPsec

Declining

L2TP tunnels the traffic; IPsec supplies the security.

L2TPIPsec
Generate config

6in4 / IPv6 tunnel

Declining

Carrying IPv6 across an IPv4-only path.

6in4GRETunnel brokers
Generate config

PPTP

Obsolete

Cryptographically broken — kept here only for identification.

PPTPGREMPPE
Generate config