The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →An IPsec VPN uses network-layer security protocols to protect IP traffic between hosts or networks. In most deployments, IKEv2 authenticates the peers and negotiates the security associations, then ESP protects the selected traffic. Whether a connection actually provides confidentiality, integrity, and replay protection depends on its algorithms, identities, traffic selectors, and security policy.
What is an IPsec VPN?
IPsec is an open-standards security framework for private communication over IPv4 and IPv6 networks. NIST describes it as a widely used network-layer security control in SP 800-77 Revision 1 (2020). Unlike security mechanisms limited to a particular application, IPsec can protect IP traffic according to network policy.
An IPsec implementation can run on a host, a security gateway such as a router or firewall, or a device that serves both roles. Its policy determines whether traffic is protected, allowed to bypass IPsec, or discarded. The IETF describes the architecture as designed to provide interoperable, cryptographically based security for IPv4 and IPv6 in RFC 4301 (December 2005).
How does IPsec work?
IPsec combines four connected elements: traffic-protection protocols, Security Associations (SAs) and policy, key management, and cryptographic algorithms. IKE normally handles key management and negotiation; ESP or, less commonly, AH protects packets.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
- Policy identifies traffic. The Security Policy Database (SPD) determines which traffic must be protected, bypassed, or discarded. Traffic selectors describe the addresses and other traffic characteristics to which a negotiated protection relationship applies.
- Peers establish an IKE SA. With IKEv2, the peers authenticate and negotiate an IKE Security Association, which protects subsequent IKE exchanges.
- Peers negotiate Child SAs. Over the protected IKE relationship, they negotiate one or more IPsec Child SAs for data traffic, including the traffic selectors and protection parameters.
- ESP protects matching packets. ESP applies the agreed algorithms, keys, and security parameters to packets selected by policy. The details of the protection depend on the negotiated service set and mode.
IKEv2 and IPsec SAs are related but not interchangeable: the IKE SA secures control exchanges, while Child SAs carry IPsec-protected traffic. NIST’s SP 800-77 Revision 1 describes IKEv2 as the standard key-management approach for setting up IPsec.
AH vs. ESP: which IPsec protocol is used?
| Protocol | What it can provide | Confidentiality? | Role in a new design |
|---|---|---|---|
| AH (Authentication Header) | Connectionless integrity and data-origin authentication; optional anti-replay features | No | Optional to support under RFC 4301; use only when a specific interoperability or design requirement justifies it |
| ESP (Encapsulating Security Payload) | Can provide integrity, data-origin authentication, replay protection, confidentiality, and limited traffic-flow confidentiality | Yes, when configured | Required for IPsec implementations to support under RFC 4301 and the normal choice for traffic that needs confidentiality |
These protocols are not interchangeable encryption options: AH does not encrypt traffic, while ESP supports confidentiality as well as integrity and authentication services. ESP’s services are configurable, so its use alone does not prove that every listed service is enabled. See RFC 4301 and RFC 4303 for their protocol definitions.
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
Tunnel mode vs. transport mode
The mode determines which parts of an IP packet are protected and is chosen by the IPsec policy and negotiated parameters.
| Mode | What is protected | Common fit |
|---|---|---|
| Tunnel | The complete inner IP packet is protected and carried within an outer IP packet | Gateway-to-gateway links and site-to-site VPNs |
| Transport | The packet payload is protected while the original IP header remains | Some host-to-host or host-to-gateway arrangements |
These are common design patterns, not rigid rules. Endpoint type, selectors, routing, and policy all affect whether a mode fits. For the protocol-level details, consult RFC 4301 and RFC 4303.
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
What security does an IPsec VPN provide—and what does it not?
RFC 4301 identifies access control, connectionless integrity, data-origin authentication, replay detection, confidentiality, and limited traffic-flow confidentiality as services IPsec can provide. These are capabilities, not automatic guarantees. The effective protection depends on the administrator’s policy, the algorithms and key strength, peer identity checks, traffic selectors, and the security of the endpoints themselves.
A VPN can protect data and control information exchanged between computers or networks, as NIST states in its 2020 announcement of SP 800-77 Revision 1. It does not eliminate all network risk: traffic outside the protected selectors, compromised endpoints, weak credentials, or misconfigured policy can undermine the intended protection.
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
Which IPsec settings matter for a site-to-site tunnel?
Before configuring peers, define the traffic and endpoint layout. Then document the choices that both gateways must agree on. Exact setting names vary by vendor, so treat this as a design checklist rather than a universal UI recipe.
- Define protected networks and selectors. Specify the local and remote addresses or subnets and the traffic to protect. Check that the peers’ selector definitions match the intended flows.
- Choose endpoint placement and mode. Identify whether each endpoint is a gateway or host and choose tunnel or transport mode accordingly.
- Prefer IKEv2 and specify identity verification. Record how each peer authenticates, the expected identities, and the trust anchors or credentials used to validate them.
- Choose ESP and its services. Use ESP unless a documented interoperability requirement calls for a different arrangement. When confidentiality is enabled, enable integrity/authentication as well.
- Agree on algorithms and key-management policy. Select current algorithms supported by both peers, and record the rekey and lifetime policy so each side can maintain compatible SAs.
- Validate network behavior in the deployment environment. Test routing, NAT traversal, fragmentation and MTU behavior, failover, and logging. These depend on the network and equipment; a configuration that negotiates successfully may still fail to carry the intended application traffic.
- Monitor operation. Check SA establishment and expiration, replay counters, logs, and policy or selector mismatches.
Sources and scope
The standards references here are IETF RFC 4301 and RFC 4303, both published in December 2005, and NIST SP 800-77 Revision 1 (2020). Those sources describe architecture and security services, not current performance benchmarks. They do not establish a universal throughput, latency, market-share, or failure-rate figure for IPsec VPNs.
Recommended Free Tools
Quick Recap
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
