L2TP stands for Layer 2 Tunneling Protocol. Its job is to build a tunnel, but it does not provide strong encryption on its own. In real VPN setups, it is almost always paired with IPsec, which is why you usually see L2TP/IPsec.［1］［2］

The short answer: L2TP is not unusable, but it is clearly an older option. For most personal VPN users today, WireGuard, OpenVPN, or IKEv2 are usually better first choices.

Key Takeaways

L2TP mainly handles tunneling and encapsulation, not standalone encryption. The security usually comes from IPsec.［1］［2］

Most "L2TP VPN" references really mean L2TP/IPsec.

L2TP is not just old. Double encapsulation adds overhead, so speed and NAT traversal are often weaker than newer protocols.

L2TP can still be a compatibility option when old devices or enterprise environments require it, but it should not be the default for new setups.

If you prefer an app-managed VPN, AethoVPN is one option on platforms currently listed on its download page. This L2TP guide does not establish which protocol AethoVPN uses or whether its app exposes manual protocol controls.［4］

What is L2TP? Start with its protocol role

RFC 2661 defines L2TP as a way to tunnel PPP traffic across an intermediate network. Think of it as a rule set for wrapping traffic so it can cross the public internet and reach the other side.［1］

The easy misunderstanding is that L2TP is not a complete VPN security solution. It is closer to the tunnel layer than the encryption layer.

Component	Main role
L2TP	Builds the tunnel and encapsulates PPP traffic
IPsec	Handles authentication, encryption, integrity protection, and anti-replay
PPP	Carries the session and some authentication logic

So calling L2TP a "VPN protocol" is not completely wrong, but it needs the extra context that it is normally paired with IPsec.

How does L2TP/IPsec work?

The simplest way to understand it is in two steps.

First, IPsec negotiates the security relationship between the two sides, including authentication, key exchange, integrity, and replay protection. RFC 3193 explains how L2TP relies on IPsec for those security properties.［2］

Second, L2TP puts PPP traffic into the tunnel and carries it across the connection. Because this process often involves multiple layers of encapsulation, L2TP/IPsec is known for extra overhead.

If you want the tunnel concept first, read What Is a VPN Tunnel? How It Works, Types, and Common Misunderstandings. For the broader foundation, start with What Is a VPN? A Complete Beginner's Guide.

Is L2TP secure?

L2TP by itself is not secure enough because it does not provide full encryption. The VPN-grade security comes from pairing it with IPsec. RFC 3193 states that secure implementations use IPsec ESP to protect L2TP control and data packets.［2］

So the better question is: is L2TP/IPsec good enough today?

Usually:

it is much more reliable than PPTP;
it is usually not the first choice in modern consumer VPN apps;
its security and compatibility depend heavily on implementation quality, pre-shared key configuration, and operating-system support.

If you are comparing it with the older PPTP, see What Is PPTP? Why It Is Rarely Recommended Now.

Why do fewer people choose L2TP now?

There are three main reasons.

1. It is an older protocol

L2TP was standardized a long time ago. For everyday users, it now feels more like a legacy compatibility layer than a fresh deployment choice.

2. Double encapsulation adds overhead

When L2TP is combined with IPsec, packets become heavier and devices have more processing work to do. That often means weaker speed and latency than modern protocols.

3. NAT traversal and setup are less smooth

Behind NAT, corporate firewalls, and complicated network environments, L2TP/IPsec is not always the easiest option. Modern clients often favor WireGuard or IKEv2 because the experience is more direct.

Where will you still see L2TP?

It has not disappeared. You may still see it in:

Scenario	Why L2TP still appears
Old routers or systems	Long-standing built-in support
Legacy enterprise environments	Existing equipment and policies already use it
Manual setup guides	Some platforms still expose an L2TP/IPsec option
Specific interoperability needs	Some older devices connect most easily with it

Apple still documents L2TP over IPsec as a supported deployment option across several device platforms.［3］

In other words, L2TP is now an older protocol you may encounter, not one you should actively prefer.

How should you understand L2TP, PPTP, IPsec, and WireGuard?

People get stuck here because these names do not all sit at the same layer.

Name	Closer to
PPTP	Old VPN tunneling protocol
L2TP	Tunneling protocol, usually paired with IPsec
IPsec	Network-layer security protocol suite
WireGuard	Modern VPN protocol implementation

So "L2TP vs IPsec" is not quite the right comparison. A better comparison is "L2TP/IPsec vs WireGuard, OpenVPN, or IKEv2." For a broader comparison, read VPN Protocols Explained: How to Choose the Right One. If you are still mapping VPN categories, see Types of VPNs: 5 Common VPN Types Explained.

Should regular users still choose L2TP?

In most cases, it should not be your first choice.

Regular users usually need:

modern encryption;
fewer connection problems;
better speed and mobile performance;
more stable behavior across changing networks.

L2TP is rarely strongest in those areas. It still works, but it is better treated as a compatibility option.

Summary

L2TP is a tunneling protocol, not a complete encryption solution by itself.［1］［2］
In practice, you usually see L2TP/IPsec, not standalone L2TP.
It is more reliable than PPTP, but it is no longer a first-choice modern protocol.
Double encapsulation adds overhead, so speed and traversal are often weaker than newer options.
Unless you are supporting legacy equipment, a modern VPN protocol is usually the better path.

FAQ

Are L2TP and L2TP/IPsec the same thing?

Not exactly. L2TP is the tunnel protocol. L2TP/IPsec is the common deployment that pairs it with IPsec.

Does L2TP encrypt data by itself?

It is not usually treated as a standalone encryption solution. IPsec provides the authentication, encryption, and integrity protection.［2］

Is L2TP safer than PPTP?

Generally, yes. PPTP is widely considered obsolete, while L2TP/IPsec at least relies on a more complete security mechanism. It is still not the most recommended modern choice.

Why do many device menus still include L2TP?

Because it has been supported for many years. Operating systems and network devices often keep it for legacy compatibility.

Is L2TP slower than WireGuard?

In many cases, yes, especially on mobile devices and complex networks. Extra encapsulation and processing overhead are part of the reason.

When should I consider L2TP?

Usually only when old devices, old routers, or an existing enterprise environment leave you no better option. It is not recommended as the default for new deployments.

Disclaimer

This article is for general networking education only. It does not constitute enterprise architecture, compliance, or procurement advice. Your protocol choice should account for device support, network conditions, and organizational security requirements.

Sources:

RFC 2661 - Layer Two Tunneling Protocol "L2TP" — https://www.rfc-editor.org/rfc/rfc2661
RFC 3193 - Securing L2TP using IPsec — https://www.rfc-editor.org/rfc/rfc3193.html
Apple Platform Deployment - VPN overview for Apple devices — https://support.apple.com/guide/deployment/vpn-overview-depae3d361d0/web
AethoVPN - Downloads — https://www.aethovpn.com/en/downloads

Sources checked 1 September 2026.

Related Articles:

What Is L2TP? How It Works and When to Use It