IPsec

TLS secures one connection at a time, and only for apps written to use it. But sometimes you want to protect everything between two places — every packet from every program, automatically — without each application knowing or caring. IPsec does this by securing at the network layer: it wraps and protects IP packets themselves, so the protection is invisible to the applications above. Think of it as armoring the envelopes rather than asking each letter-writer to seal their own.

IPsec is a suite that adds confidentiality, integrity, and authentication to IP. Its main workhorse is ESP (Encapsulating Security Payload), which encrypts and authenticates the packet contents; there's also AH (Authentication Header) for integrity and origin authentication only. It runs in two modes: transport mode protects the payload of an IP packet between two hosts, while tunnel mode wraps the entire original packet inside a new one — used to build secure tunnels between gateways, which is the heart of many VPNs. Before any data flows, two endpoints run a key-exchange protocol (IKE) to authenticate each other and agree on keys and parameters, recorded in a security association.

Why it matters: because IPsec protects at the IP layer, it secures all traffic between two networks or hosts transparently — a company can connect two offices over the public Internet as if they shared a private wire, with every protocol inside protected at once. That's why it's a standard foundation for site-to-site and remote-access VPNs. The trade-off versus TLS: IPsec is powerful and comprehensive but notoriously complex to configure, and being at the network layer it can interact awkwardly with NAT and middleboxes. TLS, sitting higher up, is simpler to deploy per-application — which is why the web chose TLS while VPNs often choose IPsec.