A VPN (virtual private network) is an encrypted tunnel between your device, or a whole network, and a VPN server or gateway elsewhere. People use one to reach a company or home network from anywhere, to connect office networks to each other, and to protect their traffic on networks they don't trust, such as public Wi-Fi.
This article explains the types of VPN, the protocols in use today and the ones to avoid, what a VPN does and doesn't do, and how to set up your own VPN server on a VPS in the Netherlands.
What a VPN does, and what it doesn't
A VPN encrypts the traffic between your device and the VPN server. The network you're on and your internet provider see only encrypted data going to that server, and the websites and services you use see the server's IP address instead of yours.
That's useful, but it has limits:
- It doesn't make you anonymous. Whoever runs the VPN server can see where your traffic goes, and the sites you sign in to still know who you are. Cookies and browser fingerprints work as before. On a VPN server of your own, the IP address is your server's and is linked to your hosting account.
- It protects the traffic only as far as the VPN server. From there to the website, the connection is as secure as the site makes it, which is why HTTPS and SSL certificates still matter.
- It doesn't change the rules. The laws that apply to you and the terms of the services you use still apply when you're connected. On a LyraHosting server, everything the VPN carries goes out from the server's IP address, so it must be legal and follow our Acceptable Use Policy.
Types of VPN
VPNs fall into two main types by what they connect: remote access and site-to-site. A VPN that runs on a router is a related setup.
Remote access VPN
Individual devices, such as a laptop or a phone, connect to a VPN server or gateway. Through it, they reach a private network, such as a company's internal systems, as if they were in the office, or send all their internet traffic through the server. Each device runs a VPN app and has its own credentials, usually a key or certificate. Ubuntu's WireGuard documentation calls this setup "peer-to-site".
Site-to-site VPN
Two or more whole networks are connected over the internet, for example a head office, a branch office and servers in a data center. A router or firewall at each site runs the VPN, so the devices behind it need no VPN software. When the sites belong to one organization, the result works like one internal network (an intranet). When they belong to partner organizations that share selected systems, it's sometimes called an extranet VPN.
VPN on a router
Some routers can run a VPN client themselves. Every device on the network then uses the tunnel, including smart TVs and IoT devices that can't run a VPN app. This works only if the router's firmware supports the protocol you want. Ubuntu's documentation notes that you usually can't install software on a router your internet provider supplies, but some providers let you switch theirs to bridge mode and use your own device as the router.
VPN protocols in use today
The protocol decides how the tunnel is built, encrypted and authenticated. These are the ones to choose from now:
WireGuard
WireGuard is a newer, deliberately simple VPN. Each side has a key pair, much as with SSH keys, and the peers exchange public keys. It sends all its traffic over UDP, uses modern cryptography (Curve25519 for key exchange, ChaCha20 and Poly1305 for encryption and authentication, BLAKE2s for hashing), and is built into the Linux kernel. It runs on Linux, Windows, macOS, BSD, iOS and Android, and a connection can follow a device that moves between networks.
OpenVPN
OpenVPN is open-source VPN software that uses the TLS protocol for its security, the same family of protocols as HTTPS. It authenticates clients with certificates, smart cards or a username and password, and runs on one TCP or UDP port. UDP is faster; TCP can get through networks that block UDP. It's mature, flexible and supported by many routers and apps, which makes it a good choice when you need TCP or have to connect older systems.
IPsec with IKEv2
IPsec is a framework of open standards for protecting traffic at the IP level, and IKEv2 is the part of it that authenticates both ends and sets up the encryption keys. IPsec is widely used for site-to-site VPNs between routers and firewalls. IKEv2 with its MOBIKE extension also suits phones and laptops: it keeps the connection up when a device moves from one network or address to another, such as from Wi-Fi to mobile data.
IPsec has two modes: transport mode protects the contents of packets between two hosts, and tunnel mode, the one VPNs usually use between two gateways or between a device and a gateway, protects the whole original packet inside a new one.
SSTP
The Secure Socket Tunneling Protocol (SSTP) is Microsoft's VPN protocol over SSL/TLS, built into Windows. Microsoft says it passes through most firewalls and proxy servers. Microsoft recommends SSTP and IKEv2 for Windows VPN servers.
Older protocols to avoid
- PPTP (Point-to-Point Tunneling Protocol): one of the first VPN protocols and no longer secure. Don't use it.
- L2TP/IPsec: L2TP builds the tunnel but doesn't secure it, so it's paired with IPsec for encryption and integrity. It still works, but it's a legacy choice.
Microsoft says it doesn't recommend L2TP or PPTP "due to their lack of security features". It deprecated both for Windows Server in October 2024, and new VPN server setups on Windows Server 2025 no longer accept PPTP or L2TP connections unless an administrator enables them.
Lists of VPN types sometimes add SSH and "SSL VPNs". SSH port forwarding sends chosen applications' traffic through an encrypted SSH connection, which is handy for one service but isn't a VPN for the whole device. "SSL VPN" is a general name for VPNs secured with TLS, such as OpenVPN.
How to set up your own VPN server
For a VPN that only you and the devices you choose use, rent a server and run the VPN software yourself:
- Get a server with a public IP address and root access. A LyraHosting Linux VPS is a KVM virtual machine in our data centers in the Netherlands, with full root access and a dedicated IPv4 address, and IPv6 on request. KVM matters here: OpenVPN needs the kernel's TUN device and WireGuard runs in the kernel, and both work on a KVM VPS as on any Linux server. On container-based VPS types such as OpenVZ, they depend on what the host provides; on our OpenVZ Storage VPS, TUN is available for OpenVPN.
- Install a supported Linux release and update it, for example a current Ubuntu LTS release.
- Install the VPN software. Our step-by-step OpenVPN guide sets up an OpenVPN server on Ubuntu LTS with an installer script. For WireGuard, Ubuntu's WireGuard documentation covers remote access and site-to-site setups.
- Open the VPN port in the firewall, safely. If you turn on a firewall over SSH, allow SSH first, or you lock yourself out. If you do lose access, start the rescue system from the control panel of a LyraHosting Linux VPS to reach the server's disk and correct the firewall rules. A reboot alone doesn't help, because a firewall such as ufw starts again with the server.
- Give every device its own key or certificate. Keep the private keys private, and revoke a device's access when it's lost or no longer needed.
- Connect and test. Once you're connected, and if the VPN carries all your traffic, a "what is my IP" search should show the server's address instead of yours.
- Keep the server updated, along with the VPN software on it.
You install and run the VPN yourself.
Why a VPN server in the Netherlands
The VPN server is where your traffic leaves the tunnel for the rest of the internet. With a server in the Netherlands, websites see a Dutch IP address, and services that look up locations by IP address will usually place you there. The Netherlands is also one of Europe's best-connected internet hubs. Before you order, you can test our network from the data center page, with a test IP, test files and a looking glass.
A Linux VPS in the Netherlands starts at €8.99 a month, with standard anti-DDoS protection. If you have a question before you order, contact our team.
