VPNs are complicated and its rarely a case of one is better than another. Tools for the job, should be our watchword ... phrase 8) IPSEC is somewhat old schoo

VPNs are complicated and its rarely a case of one is better than another. Tools for the job, should be our watchword ... phrase 8) IPSEC is somewhat old school but very solid - if you can do opportunistic IPSEC via DNS etc it can be rather nifty. You can also use FRRRRRRRRRRRR to do it routed. IPSEC with BINAT can be used to avoid issues involving duplicate network addressing. I default to IPSEC for site to site links. OpenVPN is more TCP/IP related compared to IPSEC - that's very simplified. You can easily set an IP address for a client and other niceties. OpenVPN is superb for massive client deployment. If you have a central CA and can deploy certs on all devices eg via MS AD CA then you can use a single config file for all clients, which is a doddle to deploy via GPO. Tailscale is the new kid on the block. As with all new kids you need to examine what works for you and you could be one person or an entire multi national. The real world is rather messy. For example your home/office/corp network will almost certainly have a MTU of 1500 bytes. When you hit the internets it gets really messy. Some British Telecom links (for example) will support mini jumbo frames and some won't and the real world continues to get more and more complicated.