# Choose a traffic path: server, tunnel or proxy

> Understand what a VPS, VPN and proxy each change, then select routing, protocols and operating responsibilities from the connection you actually need.

Canonical human page: https://swissoctet.com/insights/choose-a-server-tunnel-or-proxy/

SwissOctet Editorial. Topic: network. Level: Foundation. Reading time: 4 minutes.

## Direct answer
A VPS supplies a machine; a VPN supplies a configured tunnel; a proxy relays selected traffic. Match the role to the requirement and verify routing, trust and failure behaviour rather than treating the labels as privacy guarantees.

## Draw the connection you want to change
A VPS is a machine you can use to run software. A VPN creates a protected network path between participating endpoints. A proxy handles traffic on behalf of a client or service. These roles can coexist: a VPS may host a VPN or proxy, but buying a server does not configure either one. Start with a simple diagram of the client, destination and intermediate systems.

If the requirement is to publish a website, you need a hosting environment and an application. If the requirement is private access to an administration network, a tunnel may be part of the design. If one application must connect through a controlled intermediary, a proxy may fit. Choosing by role keeps you from expecting a hosting product to change the traffic of a device automatically.

## A tunnel protects a specific leg of the journey
A VPN encrypts traffic within its configured tunnel; routing determines which traffic enters that tunnel. A full-tunnel configuration and a split-tunnel configuration have different effects. Review DNS handling, IPv6 routes and the behaviour when the tunnel becomes unavailable. Test those paths on the actual client rather than assuming an installation screen proves all traffic follows the intended route.

The tunnel endpoint becomes part of the trust model. After traffic exits, its protection depends on the next connection and application protocol, including HTTPS where used. A VPN does not remove website accounts, browser identifiers or information you submit. It also does not correct a compromised device. Evaluate access control and the endpoint operator alongside the protocol, and keep claims about anonymity separate from a verified routing result.

## A proxy has a narrower and configurable scope
A forward proxy receives client connections and makes onward connections according to its configuration. HTTP and SOCKS proxies present different interfaces, and applications must support or be configured for the chosen one. A proxy does not inherently encrypt every connection from the device. The connection to the proxy and the onward connection must be evaluated separately.

A reverse proxy sits in front of a service and receives requests from its users. It can route to internal application processes and handle public HTTP settings. This is an operator-facing architecture decision rather than a substitute for a client VPN. Avoid creating an unauthenticated open proxy: allow only the users and destinations required for your legitimate workflow and monitor failures without retaining unnecessary browsing data.

| Component | Primary role | What it does not establish |
| --- | --- | --- |
| VPS | Runs an operating system and applications | A configured tunnel for your device |
| VPN tunnel | Carries selected network traffic between peers | An anonymous identity at the destination |
| Forward proxy | Relays supported client traffic | Protection for every device connection |
| Reverse proxy | Receives requests on behalf of an application | Application correctness or unlimited attack capacity |

## Select a protocol from the endpoints and policy
WireGuard uses UDP and a defined cryptographic design with public-key peer configuration. OpenVPN's documented deployment options include routed tunnels, certificates and TCP or UDP transports. IPsec describes protection at the IP layer and commonly appears with a key-management system such as IKE. These are technical families with different deployment choices, not a universal speed ranking.

Check client support, key rotation, how users are removed and what the networks between peers permit. A design for a site-to-site link may differ from remote access for staff devices. Test reachability and throughput using representative endpoints and permitted traffic. Record the protocol and conditions with the result. A faster result in one environment does not prove that the same protocol is the best fit everywhere.

## Self-hosting transfers work to you
Running a tunnel on your own server gives you responsibility for updates, keys, firewall rules and availability. Restrict the administration interface, protect backups of configuration and decide how a lost device's access is revoked. A single server creates a clear dependency: if it stops working, the route it provides stops working too. Plan recovery before relying on it for your only administration path.

Write a logging policy that you can actually implement. Keeping few logs can reduce stored information, but it can also limit incident investigation. Do not infer a no-logs policy from the presence of a VPN protocol or a server location. Monitor service health without recording more user activity than necessary. Keep credentials and private keys outside public application directories and generated configuration examples.

## Verify the whole path before choosing a plan
Test DNS resolution, the public address seen by an approved test destination and access to the resources that should remain private. Disconnect the tunnel and confirm the intended fallback behaviour. Repeat on the devices and networks your users will employ. For a proxy, test an application that uses it and one that does not, so its scope is visible.

Shield is the SwissOctet VPN service family; Vector or dedicated ranges are separate hosting choices for software you administer. Read their listed options and confirm the required capability before ordering. Select capacity from expected traffic, concurrent sessions and measured endpoint resources. The right route is the one whose scope, permissions and failure behaviour match the project, with responsibilities that you are ready to maintain.

## Checklist
- Draw clients, intermediaries and destinations.
- Decide which traffic enters the tunnel or proxy.
- Check DNS, IPv6 and disconnected behaviour.
- Select protocols from support and policy requirements.
- Plan key revocation, updates and endpoint recovery.

## Frequently asked questions
### Can I run a VPN on a VPS?
Yes, if the operating environment supports your chosen software and networking requirements. You remain responsible for its configuration, maintenance and keys.

### Does a proxy encrypt all traffic?
No. Protection depends on the protocol and configuration of each connection. Applications outside its scope may connect directly.

### Which VPN protocol is always fastest?
There is no universal result. Client hardware, transport, path and configuration matter. Measure the intended deployment and consider support and access policy too.

## Primary sources
- [WireGuard: Protocol and Cryptography](https://www.wireguard.com/protocol/)
- [OpenVPN: Community deployment guide](https://openvpn.net/community-docs/how-to.html)
- [RFC 4301: Security Architecture for the Internet Protocol](https://www.rfc-editor.org/rfc/rfc4301)
- [NGINX: HTTP proxy module](https://nginx.org/en/docs/http/ngx_http_proxy_module.html)

## Related infrastructure
- [Shield VPN](https://swissoctet.com/services/shield/index.txt): A Swiss OpenVPN configuration for one device, with AES-256 encryption and unlimited traffic.
- [Vector VPS](https://swissoctet.com/services/vector/index.txt): Your own Linux environment, with KVM virtualization and a clear path from small projects to larger workloads.
- [Metal Origin](https://swissoctet.com/services/metal-origin/index.txt): A practical entry to dedicated hardware. Your workload, on its own physical machine.

## Related guides
- [Secure Windows RDP administration without losing access](https://swissoctet.com/insights/secure-windows-rdp-administration/index.txt): Separate network reachability, authentication and privilege, then verify a recovery route before tightening remote access.
- [A practical threat model for your hosted project](https://swissoctet.com/insights/threat-model-a-hosted-project/index.txt): Map assets and trust boundaries, choose a few realistic failure scenarios and turn them into controls you can test.
- [Separate your public web edge from the application](https://swissoctet.com/insights/separate-the-web-edge-from-the-app/index.txt): Give the web server, reverse proxy and application distinct responsibilities, with deliberate origin access, TLS, request limits and an incident path.