IPsec
Internet Protocol Security
The standards-based way to encrypt traffic at the IP layer itself. It is the quiet backbone of office-to-office VPNs and, via IKEv2, the smooth mobile VPN that survives switching from Wi-Fi to cellular.
IPsec (Internet Protocol Security) is a suite of standardised protocols that authenticate and encrypt traffic at the network layer — securing whole IP packets rather than a single application's data. Because it operates that low in the stack, everything riding on IP is protected transparently, which makes IPsec the natural fit for connecting entire networks together and for built-in operating-system VPNs.
How IPsec is built
IPsec is not one protocol but a toolkit of cooperating parts:
- IKE (Internet Key Exchange) — negotiates the connection and sets up the encryption keys. The modern version, IKEv2, is what you usually see named on devices.
- ESP (Encapsulating Security Payload) — does the actual encryption and authentication of each packet.
- Tunnel vs transport mode — tunnel mode wraps the entire original packet (used for VPNs), while transport mode protects just the payload between two hosts.
Where IPsec shines
Two scenarios are IPsec's home turf:
- Site-to-site VPNs: permanently linking two office networks over the internet as if they were one. IPsec's standards-based, vendor-neutral design means routers and firewalls from different makers interoperate.
- Mobile VPNs via IKEv2: the IKEv2/IPsec pairing reconnects almost instantly when a phone moves between Wi-Fi and cellular, making it a popular, smooth choice for always-on mobile VPNs and built into most operating systems.
How it compares
| Protocol | Best at | Weakness |
|---|---|---|
| IPsec (IKEv2) | Site-to-site, fast mobile reconnect, OS-native | Complex; can be blocked by firewalls |
| WireGuard | Speed and simplicity for individuals | Fixed-IP privacy nuance |
| OpenVPN | Firewall evasion via TCP/443 | Heavier, slower |
The firewall caveat
IPsec's main practical drawback is that it relies on specific protocols and ports (and ESP, which is neither TCP nor UDP) that some restrictive networks block — unlike OpenVPN's TCP mode, which can hide as HTTPS. It also traditionally struggled with NAT, addressed by NAT-Traversal which wraps IPsec in UDP. For an individual user on an open network wanting maximum speed, WireGuard is often simpler; IPsec earns its place where standards-based interoperability, site-to-site links, or seamless OS-level mobile VPNs are the priority.