IPsec vs SSL VPNs: Which VPN Technology to Use

When choosing a Virtual Private Network (VPN) technology, the classic comparison is between IPsec and SSL/TLS. This doc helps you decide which one fits your needs for site-to-site or remote access networking.

flowchart LR
  IPSEC[IPsec] --> A1[Layer 3 - encrypts whole packets]
  IPSEC --> A2[UDP 500 and 4500 plus ESP]
  IPSEC --> A3[Best for site to site]
  SSL[SSL VPN] --> B1[Rides TLS like HTTPS]
  SSL --> B2[Port 443 sails through firewalls]
  SSL --> B3[Best for remote users]

Overview

"IPsec vs SSL" categorizes these technologies based on how they encrypt data:

• IPsec works at the network layer (Layer 3) by wrapping entire IP packets.
• SSL/TLS uses the same protocol as HTTPS, typically over port 443.

A third option, WireGuard, is quietly gaining popularity and is often preferred in modern homelab and small business setups. This doc focuses on choosing between them for your specific use case.

IPsec, In-Depth

How It Works

• Layer 3 Operation: IPsec operates at the network layer (Layer 3), encrypting and encapsulating entire IP packets. Applications above it are protected without needing to know about the encryption.
• Strengths:
  • Mature and standardized.
  • High performance.
  • Protects all traffic transparently.
  • Widely supported by firewall vendors for site-to-site links.

Weaknesses

• Requires an IPsec-aware client or gateway, which can be non-trivial to configure.
• Firewall traversal is fragile. Restrictive networks often block ESP (IP protocol 50) and IKE ports (UDP 500 and 4500), causing the tunnel to fail.

SSL/TLS VPN, In-Depth

How It Works

• TLS Protocol: Uses TLS, the same protocol behind HTTPS, typically over port 443.
• Flavors:
  • Clientless / Portal SSL VPN: You log into a web portal in a browser to reach specific internal web apps. Limited to web and proxied protocols.
  • Client-Based / Full-Tunnel SSL VPN: A lightweight client (e.g., Cisco AnyConnect, Palo Alto GlobalProtect) builds a full network tunnel over TLS.

Strengths

• Works through nearly any firewall.
• Easy for non-technical remote users.
• Granular per-application access in clientless mode.
• NAT-friendly.

Weaknesses

• Slightly more overhead than IPsec.
• Clientless mode is limited.
• SSL VPN appliances have been among the most-attacked devices, with serious CVEs leading to major breaches. An internet-facing SSL VPN must be patched aggressively.

OpenVPN, the Classic

OpenVPN is a long-standing open-source SSL/TLS-based solution, running over UDP or TCP (often port 1194, or 443 for blending in). It was widely used in homelabs and small businesses but is now being displaced by WireGuard.

WireGuard, the Modern Wildcard

• Neither IPsec nor SSL: Uses modern fixed cryptography, runs over UDP, and has a tiny codebase (thousands of lines vs hundreds of thousands).
• Speed and Simplicity: Faster than OpenVPN and simpler to configure with public/private key pairs.
• Versatility: Supports both site-to-site and remote access. Foundation for mesh-VPN products like Tailscale and Netbird.

Weaknesses

• UDP-only, so it can struggle on networks that block everything but TCP 443.

Choosing the Right Technology

• Connecting Whole Networks Between Firewalls or Interoperating with Enterprise Gear: Use IPsec (see the IPsec Fundamentals and Site-to-Site vs Remote Access docs).
• Remote Users Who Must Connect from Any Network, or Non-Technical Staff: Use SSL/TLS — clientless for web apps, full client for everything.
• Modern Homelab or Small Setup Where You Control Both Ends: Use WireGuard — fastest and simplest unless a hostile network forces you onto TLS 443.

Meta-Point: Match the Tool to the Constraint

The deciding factor is usually less about cryptography and more about which ports the network in the middle will allow through.

Related: Site-to-site vs remote access VPNs · IPsec fundamentals