Tunneling protocol

A network protocol that encapsulates packets of one protocol inside packets of another, allowing them to cross an intermediary network that does not carry them directly.

Protocol encapsulation: Wrapping data from one protocol inside the packet format of another protocol. This is the defining operation that lets a tunnel carry one packet type through another network.
Virtual private network: A network that uses shared infrastructure to provide protected connections between devices or sites. Many VPNs use tunneling to carry private-network traffic across the public internet.
Network address translation: A technique that rewrites IP addresses and sometimes transport ports as packets cross a network boundary. NAT changes packet headers, whereas tunneling wraps an inner packet in a separate outer packet.
Encapsulation overhead: The extra bytes and processing required to wrap data in protocol headers or trailers. Tunnel headers reduce effective payload capacity and can lower throughput.
Tunnel endpoint: A device or software process that adds or removes encapsulation at a tunnel's boundary. Endpoints create the outer packet at one boundary and recover the inner packet at the other.
IPsec: A suite of protocols that authenticates and protects IP traffic, including through tunnel mode. IPsec tunnel mode encapsulates entire IP packets for protected site-to-site or remote connections.
Proxy server: An intermediary that makes requests or connections on behalf of clients. A proxy terminates and relays a connection; a tunnel typically transports encapsulated packets between endpoints.
Path MTU discovery: A method for finding the largest packet size that can traverse an IP path without fragmentation. It helps tunnel endpoints avoid packet loss when encapsulation pushes traffic beyond path limits.
IP-in-IP: An IP tunneling method that places one IP packet inside another IP packet. It illustrates the basic case in which the inner and outer network protocols are both IP.
WireGuard: A VPN protocol that uses encrypted UDP transport to connect network peers. WireGuard carries encrypted IP packets inside UDP datagrams.

Linked from 2 pages