Now that we've mastered IPsec, we can step back and compare it to TLS and the newcomer, WireGuard. No single protocol is 'the best'; the right choice depends on whether you need to secure a single app, a whole network, or a high-performance cloud link.
IPsec is the only choice for true Site-to-Site connectivity. Because it works at Layer 3, it is completely transparent to the applications. If you need to connect an entire office in Tokyo to an office in London, IPsec is the standard. However, it is complex to configure and can be slow due to the heavy IKE handshakes.
💡 Use IPsec when: You need 'Always-On' connectivity between two fixed locations.
TLS-based VPNs (like OpenVPN or AnyConnect) operate at a higher layer. They are much easier to deploy because they usually only require a single port (TCP 443). They are ideal for remote employees who need to connect from hotels or cafes where IPsec's UDP 500/4500 might be blocked.
⚠️ TLS VPNs can suffer from 'TCP-over-TCP' meltdown. If the VPN tunnel is TCP and the application inside is also TCP, a single packet drop can cause a recursive retransmission storm that kills the connection.
| Protocol | Layer | Ease of Setup | Performance | Best Use Case |
|---|---|---|---|---|
| IPsec | Layer 3 | Hard | Medium | Site-to-Site VPN |
| TLS VPN | Layer 4-7 | Easy | Low/Med | Remote Client Access |
| WireGuard | Layer 3 | Very Easy | Very High | Cloud/Modern VPN |
WireGuard is the new gold standard. It replaces the complex IKE negotiation with 'Cryptokey Routing'. There are no 'phases' and no 'proposals'. You simply exchange public keys, and the connection is established instantly. It uses only high-performance modern primitives (ChaCha20, Poly1305) and has a tiny codebase, making it far easier to audit for bugs.
# Conceptual WireGuard Config
[Interface]
PrivateKey = <My_Private_Key>
Address = 10.0.0.1/24
[Peer]
PublicKey = <Server_Public_Key>
Endpoint = 203.0.113.10:51820
AllowedIPs = 10.2.0.0/24WireGuard does not have a built-in 'Key Exchange' like IKE. You must manage the public keys yourself (or via a tool like Tailscale), which is a different operational challenge.
Verify exercises to earn ★ 160 XP and unlock next lab level.