From Tanenbaum's Computer Network

This demand soon led to the invention of VPNs (Virtual Private Networks), which are overlay networks on top of public networks but with most of the properties of private networks.

One popular approach is to build VPNs directly over the Internet. A common design is to equip each office with a firewall and create tunnels through the Internet between all pairs of offices. ... When the system is brought up, each pair of firewalls has to negotiate the parameters of its SA, including the services, modes, algorithms, and keys. If IPsec is used for the tunneling, it is possible to aggregate all traffic between any two pairs of offices onto a single authenticated, encrypted SA, thus providing in- tegrity control, secrecy, and even considerable immunity to traffic analysis. Many firewalls have VPN capabilities built in. Some ordinary routers can do this as well, but since firewalls are primarily in the security business, it is natural to have the tunnels begin and end at the firewalls, providing a clear separation between the company and the Internet. Thus, firewalls, VPNs, and IPsec with ESP in tunnel mode are a natural combination and widely used in practice. Once the SAs have been established, traffic can begin flowing. To a router within the Internet, a packet traveling along a VPN tunnel is just an ordinary packet. The only thing unusual about it is the presence of the IPsec header after the IP header, but since these extra headers have no effect on the forwarding process, the routers do not care about this extra header.

Another approach that is gaining popularity is to have the ISP set up the VPN. Using MPLS (as discussed in Chap. 5), paths for the VPN traffic can be set up across the ISP network between the company offices. These paths keep the VPN traffic separate from other Internet traffic and can be guaranteed a certain amount of bandwidth or other quality of service.

  1. Is VPN a layer 3 or 5 concept? (seems to me yes?)

  2. Do both approaches in the quote to build VPNs are layer 3 approaches? (Seems to me yes, because the technologies involved to built VPNs seem to be layer 3)

  3. Does openvpn use the server-client model and therefore a layer 5 approach to build VPNs? How do a openvpn server and client work together to build a VPN? I can't figure it out based on the two approaches in the book.

  4. Similar questions for SSH VPN to those for openvpn.


3 Answers 3


There are layer-2 and layer-3 VPNs. "VPN" is a term used for a tunnel combined with encryption.

A tunneling interface encapsulates an inner packet (or frame) in an outer packet. This inner packet is then transported to the far tunnel end, according to the outer packet, and decapsulated again. For the inner packet the tunnel looks like a direct connection, regardless of the path of the outer packet.

Tunneling somewhat defies the strict OSI layering. Usually, layer-3 packets are tunneled over layer 3 (IPsec) or layer 4 (TCP or UDP). An L3 tunnel routes between two networks.

When layer-2 frames are tunneled, the networks are bridged together.

OpenVPN uses SSL VPN over UDP or TCP (layer 4) with SSL encryption. It can tunnel either L2 or L3. SSH has an inherent tunneling mechanism for arbitrary connections including port forwarding.

[edit] Note that we're using OSI layer numbers here (as far as applicable), so your "layer 5" application layer is usually refered to as layer 7.

  • Thanks. "OpenVPN uses SSL VPN over UDP or TCP (layer 4) with SSL encryption". Do you mean the protocols from top to bottom are: VPN, SSL, UDP/TCP?
    – Tim
    Commented Mar 18, 2019 at 20:56
  • 1
    VPN is not a protocol. OpenVPN uses UDP or TCP with SSL and tunnels IP within.
    – Zac67
    Commented Mar 18, 2019 at 21:35
  • Thanks. Are protocols from top to bottom (one encapsulate the one below) are: IP, SSL, UDP/TCP?
    – Tim
    Commented Mar 18, 2019 at 21:40
  • 1
    @slebetman If I can figure that out by googling, I would not ask here. Thank you in avdance for understanding.
    – Tim
    Commented Mar 19, 2019 at 13:42
  • 1
    @Tim I'd call VPN a general concept. There are many ways to do it and countless protocols.
    – Zac67
    Commented Mar 20, 2019 at 7:20

Is VPN a layer 3 or 5 concept? (seems to me yes?)

It's both. And it's others. The VPN software is layers 5-7, whilst commonly L3 routing is used to direct packets trough the VPN. Note that layers generally break down above layer 3; there's fuzzy boundaries.

Does openvpn use the server-client model and therefore a layer 5 approach to build VPNs?

Yes, but the result is a layer 3 tunnel. You have to differentiate between the tunnel and the software that builds it, and how traffic trough the tunnel is handled.

Note that OpenVPN may run in L2 mode as well, commonly known as tap device.

  • Thanks. WHat is the tunnelling protocol provided by openvpn?
    – Tim
    Commented Mar 18, 2019 at 20:55
  • Many. As L2 tunnel? Whatever you care to throw at it.
    – vidarlo
    Commented Mar 18, 2019 at 21:01

Layer 3 VPN (L3VPN) is a type of VPN mode that is built and delivered on OSI layer 3 networking technologies. The entire communication from the core VPN infrastructure is forwarded using layer 3 virtual routing and forwarding techniques. Layer 3 VPN is also known as virtual private routed network (VPRN).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.