Separate tunneling from encryption

Tunneling wraps one packet inside another packet so it can cross a network that would not route the original directly.

Encryption turns readable data into protected data for parties holding the right keys.

These are different operations solving different problems. Tunneling solves reachability: a packet addressed to 10.14.0.1 cannot cross the public Internet on its own, but a packet carrying it as payload can. Encryption solves confidentiality: whoever sees the bytes in transit learns nothing from them.

A wrapped, protected packet looks like this on the wire:

outer IP header        public addresses, routable everywhere
  UDP header           port 51820
    encrypted payload  opaque to observers
      inner IP header  10.14.0.2 → 10.14.0.1
      inner data       your actual traffic

A tunnel can exist without encryption. GRE, an old and still common tunneling protocol, wraps packets and moves them in the clear. Anyone on the path can read the inner packet. That can be acceptable inside infrastructure you already trust, and reckless across the Internet.

Encryption can protect an application without creating a network tunnel. HTTPS encrypts your connection to one website. No new interface appears, no routes change — exactly one TCP connection is protected, and nothing else.

A secure VPN normally combines both: it creates a routable outer packet and protects the inner packet. You can watch the combination on the real interface while a WireGuard tunnel carries traffic:

sudo tcpdump -n -i eth0 udp port 51820 -c 2
# IP 192.168.1.34.51423 > 203.0.113.10.51820: UDP, length 148
# IP 203.0.113.10.51820 > 192.168.1.34.51423: UDP, length 92

Ordinary UDP packets between two addresses. The payload is noise. That is tunneling and encryption working together.

Keeping the two ideas separate pays off when things break. Tunnel problems look like routing problems: unreachable destinations, packets taking the wrong path. Encryption problems look like identity problems: handshakes that never complete, peers that stay silent. Knowing which half failed cuts your search in half.