Overview
How VPNGeek gateways, tunnels, and subnets fit together before you provision anything.
The moving parts
Three concepts cover almost everything you will do:
- Gateway — an encrypted endpoint you run at a location. It is the thing that terminates tunnels. You deploy one per site, cloud region, or DR location.
- Tunnel — an encrypted path between two gateways (or between a gateway and a third-party IKEv2 device such as a firewall). Traffic between the networks flows inside it.
- Subnet — the local IP range each gateway advertises across a tunnel. Non-overlapping subnets are what make routing unambiguous.
How traffic flows
A packet leaving a machine at Site A destined for Site B's subnet is routed to the local gateway, encrypted, carried across the tunnel to Site B's gateway, decrypted, and delivered on the far LAN. Return traffic takes the mirror path. Your existing routers and IP ranges stay in place; the gateway sits alongside them and only handles traffic bound for remote subnets.
Crypto defaults
New tunnels default to IKEv2 with AES-256-GCM, SHA-256 integrity, and Perfect Forward Secrecy enabled. These match what most modern firewalls negotiate out of the box, so a tunnel to third-party gear usually comes up without touching the proposal. Override any of it per tunnel when a policy demands a specific match.