Tunneling protocols encapsulate one network protocol inside another, enabling encryption, network overlays, and connectivity across incompatible networks. Understanding tunneling is essential for VPNs, cloud networking, and modern container networking.

# IPsec: IP Security

IPsec can provide confidentiality, integrity, data-origin authentication, and anti-replay protection at the IP layer. It's widely used for site-to-site VPNs connecting datacenters or branch offices.

IPsec Modes

Transport Mode: ESP protects the next-layer protocol header and data while leaving the outer IP header visible; confidentiality is provided when selected. This mode is commonly used end to end between hosts.

Tunnel Mode: ESP carries a complete inner IP packet behind a new outer IP header; confidentiality, when selected, hides that inner packet from the transit path. This mode is commonly used between security gateways.

ESP (Encapsulating Security Payload): Can provide confidentiality, integrity, data-origin authentication, and anti-replay protection. IPsec implementations are required to support ESP.

AH (Authentication Header): Provides integrity and data-origin authentication without confidentiality. AH support is optional, and most security requirements can be met by ESP alone.

When IPsec Matters

• Site-to-site VPNs connecting datacenters over internet
• Encrypting traffic between cloud regions
• Securing management traffic (remote server access)

Performance impact: Encryption adds CPU overhead and latency (1-10ms typical). Hardware offload (AES-NI on CPUs, crypto accelerators) reduces overhead. Throughput can drop 20-50% without hardware acceleration.

# VPNs: Virtual Private Networks

Security-focused VPNs such as IPsec, OpenVPN, and WireGuard create encrypted tunnels over untrusted networks to connect remote sites or users; other VPN technologies can provide traffic separation without encryption.

Common VPN types:

• Site-to-site: Connect entire networks (datacenter to datacenter). Always-on, routed.
• Remote access: Individual users connect to corporate network (OpenVPN, WireGuard). On-demand.
• Cloud VPN: Connect on-prem to cloud (AWS VPN, Azure VPN Gateway). Hybrid cloud connectivity.

MTU consideration: VPN encapsulation lowers effective MTU by an amount that depends on the outer IP version, ESP transform and padding, and optional UDP encapsulation. Derive the tunnel MTU from the measured path MTU and the actual encapsulation overhead; otherwise packets can fragment or be black-holed.

# Overlay Networks

Overlay networks create virtual networks on top of physical infrastructure. They decouple logical network topology from physical cabling, enabling flexible, software-defined networking.

VXLAN: Virtual Extensible LAN

VXLAN extends Layer 2 networks across Layer 3 infrastructure. It's the foundation for most cloud and container networking (AWS VPC, Kubernetes CNI, VMware NSX).

Key benefit: Isolate up to 16 million tenant networks (24-bit VNI) vs 4094 usable VLAN IDs from the 12-bit VLAN-ID field. Essential for multi-tenant cloud environments.

Overhead: VXLAN adds 50 bytes with outer IPv4 and no outer VLAN tag (14-byte Ethernet + 20-byte IPv4 + 8-byte UDP + 8-byte VXLAN), leaving 1450 bytes inside a 1500-byte underlay MTU. Outer IPv6 adds 70 bytes before optional VLAN tags. Size the underlay MTU for the actual encapsulation; a larger underlay MTU can preserve a 1500-byte inner frame.

Geneve: Generic Network Virtualization Encapsulation

Geneve is a more flexible encapsulation protocol designed to replace/extend VXLAN. It supports variable-length options for metadata (security policies, QoS tags, etc.).

Used in: Some Kubernetes CNI plugins (for example, Cilium), newer SDN platforms. Less common than VXLAN but gaining adoption.

# Performance Impact of Encryption and Tunneling

Encryption and encapsulation aren't free. Understanding the overhead helps you design performant systems.

Optimization strategies:

• Use hardware crypto acceleration (AES-NI, IPsec offload NICs)
• Enable jumbo frames to reduce encapsulation overhead percentage
• For intra-datacenter traffic, consider unencrypted overlays (if physical security is sufficient)
• Use modern ciphers (ChaCha20-Poly1305) optimized for software performance

When to encrypt: Always encrypt over untrusted networks (internet, multi-tenant infrastructure). For dedicated datacenter interconnects (dark fiber, private MPLS), encryption depends on threat model and compliance requirements.

# Cloud Environment Tunneling

Cloud providers use tunneling extensively for isolation and security.

AWS VPC: Uses encapsulation (implementation details not public, but behaves like VXLAN) to isolate customer VPCs. Traffic between EC2 instances in same VPC is encapsulated, providing network isolation even though physical infrastructure is shared.

GCP VPC: Uses Andromeda SDN with encapsulation for isolation and routing.

Kubernetes: Kubernetes networking is implementation-dependent. Flannel can use VXLAN; Calico supports unencapsulated routing, VXLAN, or IP-in-IP; and Cilium supports native routing, VXLAN, or Geneve. Encapsulation adds packet overhead but can reduce dependence on the underlay topology.

# Key Takeaways

• IPsec tunnel mode can protect site-to-site traffic, with confidentiality when selected; adds CPU overhead and latency
• VPNs reduce effective MTU due to encapsulation—measure path MTU and account for the selected tunnel's actual overhead
• VXLAN enables 16M virtual networks (vs 4K VLANs), essential for cloud multi-tenancy
• Encryption performance depends on hardware acceleration; can impact throughput 20-50% without it
• Overlay networks decouple logical topology from physical infrastructure, enabling SDN
• Cloud environments use tunneling/encapsulation for tenant isolation on shared infrastructure