Client ⇄ Tunnel ⇄ VPN Server

OpenVPN (userspace / TLS) IPsec/IKEv2 (kernel, roaming) WireGuard (kernel, Curve25519/ChaCha20)