VPN Types: Route-Based vs. Policy-Based

How Traffic Enters the Tunnel

When configuring IPSec VPNs — especially on AWS — you will be asked to choose between Route-Based and Policy-Based VPNs. This distinction is about how the VPN decides which traffic to encrypt and send through the tunnel.

1. Policy-Based VPN (The Legacy Approach)

A policy-based VPN uses explicit Access Control Lists (ACLs) — essentially a list of rules — to decide what traffic goes into the tunnel.

Example rule: "If source IP is in 10.0.0.0/16 AND destination IP is in 192.168.1.0/24, encrypt it and send it through the tunnel."

• How it works: The router checks every packet against the policy list. If it matches, it goes into the tunnel. If it doesn't match, it goes out normally (or gets dropped).
• Cons: If your network IP ranges change, the VPN breaks until you update the policy on both sides simultaneously — a coordination nightmare. Policy-based VPNs also typically support only one Security Association (one tunnel), which limits throughput and redundancy. AWS explicitly limits policy-based VPNs to a single tunnel with no BGP support.

2. Route-Based VPN (The Cloud Standard)

A route-based VPN creates a Virtual Tunnel Interface (VTI) — a virtual network interface that represents the tunnel, just like a physical ethernet port.

• How it works: The router treats the VPN tunnel like any other network interface. You simply add entries to your routing table: "Traffic destined for 192.168.1.0/24? Send it out the vti0 interface." The VTI handles the encryption automatically for anything sent through it.
• Pros: Supports BGP (Border Gateway Protocol) for dynamic routing — routes are exchanged automatically and update when the network changes. Supports multiple tunnels for redundancy and higher throughput. Much easier to troubleshoot because you can use standard routing tools.
• Why it matters: With BGP, if you add a new subnet on-premises, your router advertises it automatically over BGP and the cloud side learns the route without any manual configuration changes.

Always prefer Route-Based VPNs in cloud environments. AWS, Azure, and GCP all recommend route-based VPNs as the default.

Key Point: Route-based VPNs are the modern standard because they integrate seamlessly with dynamic routing protocols like BGP, support multiple tunnels for redundancy, and are resilient to network changes. Policy-based VPNs are a legacy approach you will encounter when connecting to older hardware that doesn't support VTIs.