# What is a VPN on TurboStack?

A Virtual Private Network (VPN) creates an encrypted tunnel over the public internet, so traffic that
travels through it is private and the two ends can reach each other as if they were on the same
network. TurboStack supports two kinds of VPN - an Internet Protocol Security (IPsec) VPN and a
Secure Sockets Layer (SSL) VPN - and they solve different problems:

| | IPsec VPN | SSL VPN |
| --- | --- | --- |
| **Connects** | One network to another network | One person to your network |
| **Also called** | Site-to-site | Remote access, client-to-site |
| **Who connects** | The servers themselves, permanently | An individual user, when they need it |
| **Client software** | None - the tunnel is built between the two gateways | A VPN client on the laptop or phone |
| **Identity** | A shared secret between the two sites | A personal user account per person |
| **Typical use** | Reach a database or an application in your office or data center | Let a developer or supplier reach a private service |

## IPsec VPN (site-to-site)

An IPsec VPN is a permanent tunnel between two gateways: your TurboStack host on one side, and the
firewall or router of another location on the other side (for example your office, a data center, or
a partner). Once it is up, the machines on both sides reach each other over their internal addresses.

You define which subnets may talk to each other. Only traffic between those subnets goes through the
tunnel. Nobody has to log in and no software is installed on individual machines: the two gateways
keep the tunnel available, and it carries traffic as soon as a connection matches one of the
configured subnet pairs.

Use it when a **system** needs a permanent, unattended connection - for example your application on
TurboStack must query a database that stays in your own data center.

## SSL VPN (remote access)

An SSL VPN gives **people** a way in. Each user gets a personal account and connects from a laptop or
phone with a VPN client, over an encrypted Transport Layer Security (TLS) connection. When they are
connected, they can reach the private networks you allow, and they disconnect when they are done.

Because the connection is per user, you can add and remove access per person, and you always know
who was connected. The connection runs over a single hostname and port, which works from most
networks, including guest Wi-Fi and mobile networks.

Use it when a **person** needs occasional access - for example an external developer who must reach a
private administration interface that is not published on the internet.

## Which one do you need?

- **A system must always be reachable, on both sides, without anyone logging in** - use an IPsec VPN.
- **A person needs to reach something private, now and then** - use an SSL VPN.
- **Both** - that is fine, they are independent. A common combination is an IPsec tunnel to the office
  for application traffic, plus an SSL VPN so staff can also connect from home.

> [!NOTE]
> A VPN is not the only way to reach a private service. For a single administrator on a single
> server, [SSH access](../ssh/what-is.md) is usually simpler. To restrict who may reach a public
> service, the [Firewall](../firewall/what-is.md) allow-list is often enough. A VPN is the right tool
> when whole networks or several private services must be reachable.

## How it is set up

Both VPN types are configured in the host's YAML configuration - see
[Configure VPN](configure.md). There are no fields for this in the platform interface yet, so the
settings are written in the Source (YAML) view of the host.

The values on both ends must match, and the remote side is usually managed by someone else (your own
network team, or the party you connect to). Plan a VPN together with
[Support](../../platform/support.md): they can confirm the parameters your counterpart proposes and
help you get the tunnel up.

## Related

- [Configure VPN](configure.md)
- [SSH access](../ssh/what-is.md)
- [Firewall](../firewall/what-is.md)
- [Networking](../../concepts/networking.md)
- [Support](../../platform/support.md)