Like most other applications of its nature, VTun creates a single connection between two machines, over which it multiplexes all traffic. VTun connections are initiated via a TCP connection from the client to the server. The server then initiates a UDP connection to the client, if the UDP protocol is requested.
The software allows the creation of tunnels, for routing traffic in a manner similar to PPP, as well as a bridge-friendly ethertap connection.
VTun uses a Private Shared Key to negotiate a handshake via a challenge and response.
A continual source of concern, and the target of more than one strongly worded security assessment, is that the VTun server and client binary applications can be completely built without encryption support. When such binaries are used, the encryption between both endpoints is only a simple XOR cipher, which is completely trivial to decode. This type of build is not supported by the developers.
"vtun(8): VTun daemon - Linux man page". linux.die.net. Retrieved 2023-07-09. https://linux.die.net/man/8/vtun ↩
"VTun - FAQ". vtun.sourceforge.net. Retrieved 2023-07-09. https://vtun.sourceforge.net/faq.html ↩