VPNs Explained: WireGuard vs. IPsec, Simply

Most people know a VPN as the app they switch on before working from a coffee shop. Fewer people know what actually happens when they do, or why the technology behind their company's VPN might be completely different from the one they use at home.

I run a WireGuard VPN in my home lab so I can reach my network securely from anywhere. In my networking and security studies, I've also spent a lot of time with IPsec, which has been the backbone of enterprise VPNs for decades. This article compares the two in plain language: what a VPN does, how each protocol works and when you'd choose one over the other.

What a VPN actually does

A virtual private network creates an encrypted tunnel between two points over an untrusted network, usually the internet. Traffic inside the tunnel is protected in three ways:

• Confidentiality: it's encrypted, so anyone intercepting it sees only scrambled data.
• Integrity: it's authenticated, so any tampering in transit is detected.
• Authentication of the endpoints: each side proves who it is, so you're not building a tunnel to an impostor.

VPNs are used in two main ways:

1. Remote access: an individual device, like a laptop or phone, connects to a private network. This is the classic "work from home" VPN.
2. Site-to-site: two networks, such as a head office and a branch, are permanently linked through a tunnel between their routers or firewalls, so they behave like one network.

IPsec: the established standard

IPsec isn't a single protocol. It's a framework, a suite of standards developed through the Internet Engineering Task Force, that secures traffic at the IP layer.

How it works, in brief

IPsec has two main jobs: agreeing on how to protect traffic, and then protecting it.

• Agreeing: the two endpoints use a key exchange protocol, today usually IKEv2 (Internet Key Exchange version 2), to authenticate each other and negotiate encryption algorithms and keys. Authentication can use pre-shared keys or digital certificates.
• Protecting: traffic is then protected using ESP (Encapsulating Security Payload), which encrypts and authenticates packets. An older component, AH (Authentication Header), provides integrity without encryption and is rarely used now.

IPsec can run in tunnel mode, which wraps the entire original packet inside a new one and is typical for site-to-site VPNs, or transport mode, which protects only the payload and is used for host-to-host connections.

Strengths

• Universal support. Practically every enterprise firewall, router and operating system supports IPsec. That makes it the default choice for connecting different vendors' equipment.
• Flexibility. It supports many algorithms, authentication methods and configurations to suit almost any policy.
• Maturity. It has been deployed and studied for decades.

Weaknesses

• Complexity. All that flexibility means many settings that must match on both sides. A mismatched setting is one of the most common reasons a site-to-site tunnel won't come up.
• Configuration risk. Complexity creates room for mistakes, including choosing outdated algorithms that should no longer be used.
• NAT and firewall friction. IPsec can struggle when traffic passes through network address translation, though NAT traversal (which wraps traffic in UDP) addresses most of this today.

WireGuard: the modern minimalist

WireGuard takes the opposite approach. It's deliberately small and opinionated, designed to be simple to configure and easy to audit. Its code base is famously compact compared with traditional VPN implementations, and it has been part of the Linux kernel since version 5.6, released in 2020. It's also available on Windows, macOS, iOS and Android.

How it works, in brief

• Keys, not negotiation. Each device has a public and private key pair, similar to SSH. You configure each peer with the other's public key. There's no lengthy negotiation of algorithms.
• A fixed set of modern cryptography. WireGuard uses a single, carefully chosen set of algorithms, including Curve25519 for key exchange and ChaCha20-Poly1305 for encryption and authentication. If one ever needs replacing, the protocol is versioned rather than renegotiated.
• Cryptokey routing. Each peer is associated with the IP addresses it's allowed to use. When a packet arrives, WireGuard checks that it came from the right key for that address. This ties identity and routing together neatly.
• UDP only and quiet. WireGuard runs over UDP and doesn't respond to packets from unknown keys, which makes the server hard to discover by scanning.

Strengths

• Simplicity. A working configuration fits on a few lines. Fewer settings means fewer mistakes.
• Performance. It's fast and efficient, which is especially noticeable on phones and lower-powered hardware.
• Roaming. Connections recover smoothly when a device switches from Wi-Fi to mobile data.
• Auditability. A small code base is easier for security researchers to review.

Weaknesses

• Less built-in enterprise management. Out of the box, WireGuard doesn't include user authentication systems, directory integration or dynamic IP assignment. Commercial products and tools build these features on top.
• Static key management. Distributing and rotating keys for many users requires tooling or a managed platform.
• Interoperability. Older enterprise equipment may not support it, so IPsec often remains necessary for site-to-site links with partners.

Side by side

• Design philosophy: IPsec is flexible and configurable. WireGuard is minimal and fixed.
• Setup effort: IPsec takes more planning and matching settings. WireGuard is quick to configure.
• Cryptography: IPsec supports many algorithms (choose carefully). WireGuard uses one modern set.
• Best fit: IPsec suits site-to-site links between enterprise firewalls and mixed-vendor networks. WireGuard suits remote access, cloud connections, labs and modern platforms.
• Enterprise features: IPsec products often include them. WireGuard relies on extra tooling.

What running WireGuard at home taught me

My lab's WireGuard server runs in a Docker container on an Ubuntu server, with one UDP port forwarded through my home router. A few lessons stood out:

• One key pair per device. If I lose a phone, I remove that single peer. It's the same principle as revoking one user's access rather than changing a shared password.
• Allowed IPs matter. This setting decides both which traffic goes into the tunnel and which addresses a peer may use. Getting it wrong either breaks connectivity or sends more traffic through the tunnel than intended.
• Full tunnel vs. split tunnel is a real decision. Routing all traffic through the VPN protects me on public Wi-Fi. Routing only home-network traffic is faster. Companies face the same trade-off when setting VPN policy.
• Test from outside. A VPN that works from inside the house proves nothing. I always test over mobile data.

When the tunnel won't come up

VPN problems are some of the most common tickets in any remote workforce. A few checks solve most of them.

For IPsec site-to-site tunnels:

• Compare the phase 1 and phase 2 settings on both ends line by line: encryption, integrity, Diffie-Hellman group, lifetimes and the local and remote networks. One mismatch is enough to stop the tunnel.
• Confirm the pre-shared key or certificates match and haven't expired.
• Check that the required ports and protocols are allowed through any firewall in the path: UDP 500 and 4500 for IKE and NAT traversal, and ESP where NAT traversal isn't used.
• Read the logs on both devices. Each side usually reports exactly which proposal it rejected.

For WireGuard:

• Check that each peer has the other's correct public key. A single wrong character means silent failure.
• Look at the latest handshake time. If there's no recent handshake, the peers aren't reaching each other, which usually means a port, firewall or endpoint address problem.
• Review the allowed IPs on both sides, since overlapping or missing ranges cause traffic to go nowhere.

For any remote-access VPN:

• Ask whether the user can reach the internet at all without the VPN.
• Check whether the local network, such as a hotel or café, blocks VPN traffic.
• Confirm the user's account, MFA and client version are all current.

Security reminders for any VPN

Whatever protocol you use:

• Patch VPN devices quickly. VPN gateways sit on the edge of the network and are frequent targets for attackers. Vulnerabilities in VPN appliances have been widely exploited, so updates shouldn't wait.
• Use multi-factor authentication for remote-access users.
• Avoid outdated algorithms in IPsec configurations.
• Limit what VPN users can reach. A VPN connection shouldn't automatically grant access to the entire network.
• Log and monitor connections, including unusual login times and locations.

The takeaway

IPsec and WireGuard solve the same problem in different ways. IPsec is the flexible, universally supported standard that still connects most enterprise networks. WireGuard is the lean, modern option that's easy to deploy and hard to misconfigure. Many organizations will use both for years to come, and understanding each makes you more effective in network and security roles.

Which VPN technology does your organization rely on, and has it been easy to manage?