How VPNs Work: IPsec vs WireGuard, Explained for Interviews

"How does a VPN work?" is a favourite opening question because the follow-ups test so much: tunnelling, key exchange, NAT, authentication and access control. This post gives the mechanics for both common protocols and the design points that interviewers actually care about.

A tunnel is a packet inside a packet

A VPN takes an IP packet, encrypts and authenticates it, and wraps it in a new packet addressed to the other end of the tunnel. Networks along the way see only the outer addresses. At the far end, the gateway checks and decrypts the inner packet and delivers it onto the internal network.

IPsec in two parts

IKE (usually IKEv2 on UDP port 500) runs first. The peers agree algorithms, perform Diffie-Hellman, and authenticate each other with certificates, pre-shared keys or EAP. The result is a set of security associations with keys. ESP then protects each packet with those keys. In tunnel mode, the whole original packet is protected; in transport mode, only its payload. When a NAT sits between the peers, IPsec detects it and wraps everything in UDP port 4500, because ESP has no ports for the NAT to track.

WireGuard's simpler model

WireGuard configures each peer as a public key plus a list of allowed IP ranges. Outgoing packets are encrypted for the peer whose ranges contain the destination; incoming packets are decrypted and dropped if their inner source address is not in that peer's ranges. This cryptokey routing binds identity to addresses. The handshake takes one round trip, keys rotate automatically every couple of minutes, and there is no cipher negotiation to get wrong.

What interviewers really want to hear

The tunnel is not the access policy. Once connected, the client gets an address and routes. If the address pool can reach every subnet, so can a stolen session. Good designs give each group its own pool and firewall rules to only the applications it needs, or skip network access entirely with identity-aware, per-application access.

The gateway is a prime target. VPN gateways are internet-facing and authenticate users, and appliances from several vendors have had critical vulnerabilities exploited at scale. Patch them quickly, keep management interfaces off the internet, and monitor logins and configuration changes.

Leaks matter. DNS queries sent outside the tunnel, IPv6 traffic bypassing an IPv4-only tunnel, and local route tricks can expose traffic. Always-on, fail-closed clients close most of these.

A compact model answer

"A VPN wraps packets inside authenticated, encrypted packets so they cross untrusted networks safely. IPsec uses IKE to authenticate and agree keys and ESP to protect packets, with UDP 4500 for NAT. WireGuard binds public keys to allowed addresses with a one-round-trip handshake. Either way the tunnel only proves who connected; what they can reach is policy behind the gateway, which I design per group or per application, and I treat the gateway as critical infrastructure."

Where to go deeper

See how IPsec works, how WireGuard works and secure remote access design, and find them in order on the learning journey.