A virtual private network moves traffic between two points inside an authenticated, encrypted tunnel. It changes where traffic appears to originate and it protects the traffic in transit.
It does not make the user anonymous, and it does not protect anything at either end. Those are the two claims most often attached to it and neither follows from the mechanism.
How IPsec is put together
IPsec is a framework rather than a protocol. A key exchange establishes shared material and negotiates parameters, and a separate protocol carries the protected packets.
Nearly everything is negotiable, including algorithms, key lifetimes, identity types, and whether the original header is preserved or wrapped. That flexibility is why it interoperates across vendors and why misconfiguration is the normal failure mode.
How WireGuard is put together
The design refuses negotiation. One set of algorithms is fixed in the specification, so there is nothing to agree on and no downgrade to attempt.
Peers are identified by public key, and the configuration is a short list of keys with the addresses each is permitted to use. The implementation is small enough to be read in an afternoon, which is a security property rather than an aesthetic one.
Side by side
| Property | IPsec | WireGuard |
|---|---|---|
| Algorithm choice | Negotiated | Fixed |
| Configuration size | Large | A few lines per peer |
| Transport | Own protocols, often over UDP | UDP only |
| Identity | Certificates or shared secrets | Public keys |
| Roaming | Requires reestablishment | Handled by design |
| Interoperability | Broad across vendors | Between implementations of one design |
| Crypto agility | Yes, at the cost of complexity | No, replaced by versioning |
The last row is the substantive disagreement. One design assumes algorithms must be replaceable in place, the other assumes a broken algorithm means a new protocol version, and both positions are defensible.
Roaming is a real operational difference
A device changing network moves to a new address. The older design generally treats that as a new association requiring reestablishment.
The newer one identifies peers by key rather than address and updates the address when an authenticated packet arrives from a new one, so a laptop moving between networks continues without interruption. For mobile endpoints this is the difference people notice first.
Encapsulation costs packet size
Wrapping a packet adds headers, so the largest payload that fits inside the tunnel is smaller than the one that fits outside it. If the effective size is not adjusted, packets are fragmented or dropped.
The failure this produces is characteristic and confusing. Small exchanges succeed, connections establish, and large transfers stall, because the path discovery messages that would signal the problem are frequently blocked.
Setting the size explicitly on the tunnel interface, and clamping the negotiated segment size for connections crossing it, prevents nearly all of this.
Where each fits
Site to site connectivity between equipment from different vendors is IPsec territory, because it is what everything implements and because policy based selection of which traffic to protect is mature there.
Point to point links, mobile clients, and infrastructure where both ends are under one administration suit the newer design, where the smaller configuration surface is a direct reduction in the chance of getting it wrong.
How much traffic to send through it
Sending everything through the tunnel means all traffic is subject to the organisation's inspection and filtering, and it means every connection depends on the tunnel being up.
Sending only traffic destined for internal networks reduces load and preserves local connectivity, and it means anything else leaves the device outside any inspection. The choice is a policy decision about visibility rather than a technical one, and it should be made deliberately rather than inherited from a default.
What neither provides
Traffic is decrypted at the far end, so the operator of that end sees it. Using a commercial provider relocates trust rather than removing it, from the local network to the provider.
Endpoint compromise is unaffected, browser fingerprinting continues to work, and accounts logged into remain identified regardless of where the traffic appears to originate.
Note: configuration size is a security property. A tunnel that takes forty lines and a manual to configure will be configured incorrectly somewhere, and the resulting weakness is more likely than a flaw in either design.