VPN Basics Cheat Sheet

Virtual Private Networks: IPsec vs WireGuard vs OpenVPN comparison, split tunneling, site-to-site vs client VPN, and common VPN deployment patterns.

Last Updated: May 1, 2025

VPN Types Comparison

FeatureWireGuardOpenVPNIPsec (IKEv2)
PerformanceFastest (kernel)Moderate (userspace)Fast (kernel)
Codebase~4,000 lines~70,000+ linesLarge + complex
Config simplicityVery simple (few options)ModerateComplex
Port51820 (UDP default)1194 (UDP), 443 (TCP)500/4500 (UDP)
RoamingSeamless (stateless)Needs reconnectMobility & Multihoming (MOBIKE)
Crypto agilitySingle suite (opinionated)Pluggable (many options)Negotiable (many suites)

Split Tunneling

ItemDescription
Full tunnelALL traffic routes through VPN (secure but slower)
Split tunnelOnly corporate traffic through VPN; internet goes direct
Split-includeRoute specific subnets (10.0.0.0/8) through VPN tunnel
Split-excludeRoute everything through VPN EXCEPT specific IPs (streaming)
DNS splitCorporate DNS queries through VPN; public DNS uses local resolver
BenefitReduces VPN bandwidth costs; keeps personal traffic private from employer

WireGuard Quick Config

[Interface]
Define local endpoint: PrivateKey, Address, ListenPort
[Peer]
Define remote peer: PublicKey, AllowedIPs, Endpoint
wg genkey | tee privatekey | wg pubkey > publickey
Generate WireGuard keypair
wg-quick up wg0
Bring up WireGuard interface
wg-quick down wg0
Bring down WireGuard interface
wg show
Show WireGuard interface status and peers
AllowedIPs = 0.0.0.0/0
Route all traffic through this peer (full tunnel)
AllowedIPs = 10.0.0.0/8, 192.168.1.0/24
Split tunnel — only these subnets

VPN Deployment Patterns

ItemDescription
Client VPNIndividual devices connect to corporate network remotely
Site-to-siteTwo office networks connected as one (always on)
Hub-and-spokeHQ connects to all branch offices (central management)
MeshEvery site connects to every other site (full connectivity)
Zero Trust VPNVPN + identity context: only access specific apps, not full network
Pro Tip: WireGuard is the go-to for most new VPN deployments — kernel-level speed, simple config (under 100 lines), and built into Linux kernel 5.6+. Use it unless you need IPsec compatibility.