# Design a VPN service: system design interview question

> A regional VPN service must balance packet capacity, failure recovery, traffic isolation, and secure key changes.

Source: https://sysround.com/questions/design-vpn-service
Updated: 2026-11-05


Difficulty: hard. Levels: Senior, Staff+.

## How the interviewer opens it

"Design a VPN service with gateways in several regions. Clients use encrypted tunnels to reach the internet. Support high throughput, gateway failure recovery, and secure key changes."

## What to clarify first

- Client behavior
- Geographic scale
- Traffic volume
- Gateway capacity
- API traffic
- Response times
- Failure behavior
- Access consistency
- Key policy
- Durability and scope

## Scope of a strong answer

Core requirements:

- Establish an encrypted tunnel to a regional gateway
- Route IPv4, IPv6, and DNS traffic through the tunnel
- Restore VPN access after a gateway fails
- Rotate tunnel keys and revoke device access

Usually out of scope:

- Design a new cryptographic protocol
- Preserve open connections across gateway failure
- Connect private networks to each other
- Inspect or store user payloads
- Guarantee access to geographically restricted content

## What interviewers probe

### Traffic through a gateway

Encryption, packet rate, and NAT state can limit capacity before network bandwidth does. IPv4 and IPv6 need correct return paths.

### When a gateway fails

A failed gateway can break tunnels, return routes, and DNS access. A client must restore both IP families without exposing application traffic.

### Changes to keys and access

Traffic keys and identity keys have different roles. Old sessions and stale authorization can preserve access after a key compromise.

## Common mistakes

- Treats the VPN as an ordinary HTTP proxy and ignores IP packets.
- Sizes gateways from bandwidth alone and ignores packet rate and NAT ports.
- Promises seamless gateway failure recovery without preserving connection state.
- Blocks IPv6 during normal service or lets DNS or IPv6 traffic bypass a failed tunnel.
- Confuses traffic-key changes with identity replacement and device revocation.
- Requires fast revocation but lets gateways trust stale authorization without a time limit.

## The bar by level

- **Senior:** Calculates gateway capacity and spare capacity. Defines failure detection, leak prevention for both IP families, device isolation, identity replacement, and bounded revocation during an outage.
- **Staff+:** Defines capacity and authorization invariants across regions. Resolves stale-policy risks, correlated retry bursts, and partial failures. Explains when continuity conflicts with security or connection preservation.

Practice this question with an AI interviewer: https://sysround.com/practice/new?problem=vpn-service


---
SysRound (https://sysround.com) is an AI practice tool for system design interviews. It has a voice or typed AI interviewer and a shared whiteboard. At the end, you get feedback on each skill and a model answer. The AI feedback can be wrong.