VPN vs VPC Peering: What is the Difference?
Understand the difference between a VPN and VPC peering — encrypted internet tunnel vs private backbone routing — with a DevOps interview answer.
Expected Interview Answer
A VPN creates an encrypted tunnel over the public internet to connect two networks (such as an on-premises data center and a cloud VPC), while VPC peering directly connects the private IP address space of two virtual networks inside the cloud provider's own backbone, with no encryption tunnel or public internet path involved.
A site-to-site VPN encrypts traffic between two gateways using IPsec, so it is the standard way to connect an office or data center that is not itself inside the cloud provider's network — the tradeoff is added latency and throughput limits from encryption overhead and internet routing. VPC peering instead establishes a direct routing relationship between two VPCs (often in the same or different accounts/regions of the same provider), so instances in each VPC can reach each other by private IP as if on the same network, riding the provider's internal backbone with no encryption overhead and typically lower latency and higher throughput. Peering is non-transitive — if VPC A peers with B and B peers with C, A cannot reach C through B without its own direct peering connection or a transit gateway — while VPN connections can be chained or routed more flexibly through gateway configuration. Choose VPN when at least one side is outside the cloud provider's network; choose peering (or a transit gateway/hub for many-to-many) when connecting cloud-native VPCs to each other.
- VPN connects on-prem or third-party networks to the cloud securely
- VPC peering gives low-latency, high-throughput private connectivity within a provider
- Peering avoids public internet exposure and encryption overhead entirely
- Choosing the right one avoids unnecessary latency or unreachable topologies
AI Mentor Explanation
A VPN is like a secure armored van that transports a team's equipment from an off-site training facility, through public roads, to the stadium, with guards checking every package along the way. VPC peering is like two stadiums built right next to each other sharing a private tunnel underneath the pitch, letting players walk directly between dressing rooms without ever stepping onto a public road. The armored van works no matter how far apart the facilities are, but it is slower because of the checks along the way. The private tunnel is only possible when the two stadiums are adjacent and directly connected.
Step-by-Step Explanation
Step 1
Identify what needs connecting
On-prem/third-party network to cloud → VPN; VPC to VPC within the same cloud provider → peering.
Step 2
Set up VPN gateways with IPsec
Configure a customer gateway on-prem and a virtual private gateway in the cloud, establishing an encrypted tunnel.
Step 3
Set up VPC peering with route table updates
Request/accept the peering connection, then add routes in both VPCs' route tables pointing to each other's CIDR ranges.
Step 4
Account for non-transitivity
For many VPCs needing mesh connectivity, use a transit gateway/hub instead of chaining individual peering connections.
What Interviewer Expects
- Clear distinction: VPN encrypts over the internet, peering routes privately within the provider
- Understanding of when each is the correct choice
- Awareness that VPC peering is non-transitive
- Knowledge of the latency/throughput tradeoff from encryption overhead
Common Mistakes
- Assuming VPC peering works transitively across three or more VPCs
- Using a VPN to connect two VPCs in the same cloud account unnecessarily
- Forgetting that overlapping CIDR ranges make VPC peering impossible
- Not accounting for the extra latency and throughput cost of VPN encryption
Best Answer (HR Friendly)
“A VPN is how we securely connect our office network or another outside network to the cloud, by encrypting traffic as it travels over the public internet. VPC peering is different — it directly connects two of our own private cloud networks together over the provider's internal backbone, so it is faster and does not need encryption, but it only works between networks that already live inside the same cloud provider.”
Code Example
# Request a peering connection from VPC A to VPC B
aws ec2 create-vpc-peering-connection \
--vpc-id vpc-aaaa1111 --peer-vpc-id vpc-bbbb2222
# Accept it from the VPC B account
aws ec2 accept-vpc-peering-connection \
--vpc-peering-connection-id pcx-0123456789
# Add a route in each VPC route table pointing to the peer CIDR
aws ec2 create-route --route-table-id rtb-aaaa \
--destination-cidr-block 10.1.0.0/16 \
--vpc-peering-connection-id pcx-0123456789Follow-up Questions
- Why is VPC peering non-transitive, and how do you work around it?
- What happens if two VPCs you want to peer have overlapping CIDR blocks?
- When would you use AWS Transit Gateway instead of individual peering connections?
- What throughput and latency differences would you expect between VPN and peering?
MCQ Practice
1. What is the fundamental difference between a VPN and VPC peering?
A VPN tunnels encrypted traffic across the public internet, while VPC peering creates a direct private route on the cloud provider's own network.
2. Is VPC peering transitive across three VPCs (A-B peered, B-C peered)?
VPC peering connections are strictly non-transitive; reaching C from A requires either direct peering or a hub like a transit gateway.
3. When is a site-to-site VPN the correct choice over VPC peering?
VPN is designed to securely bridge networks outside the provider's backbone, such as on-prem offices, into the cloud.
Flash Cards
What does a VPN provide between two networks? — An encrypted tunnel over the public internet, typically IPsec.
What does VPC peering provide? — A direct private routing connection between two VPCs on the cloud provider's backbone, no encryption needed.
Is VPC peering transitive? — No — each pair of VPCs needs its own direct peering connection or a transit gateway.
When should you choose VPN over peering? — When at least one side of the connection is outside the cloud provider's network, e.g. on-prem.