## 1 Introduction  
Last-generation IT systems can span vast geographical regions, necessitating secure and dependable infrastructures that ensure cost-effectiveness regarding space and time. Virtual Private Networks (VPNs) and Overlay Networks (ONs) emerge as highly dependable technologies catering to these requirements, seamlessly traversing both traditional Public Switched Telephone Networks (PSTN) and cutting-edge 4G/5G architectures [1, 2, 3]. Just for the sake of clarity, we recall that a VPN is based on a technology that establishes an encrypted secure connection over a public network (typically the Internet), enabling users to transmit data securely. VPNs are often utilized to maintain privacy and security during internet browsing, particularly on public Wi-Fi networks, and to circumvent geographic restrictions by hiding the user's IP address and location. An ON, on the other hand, is essentially a virtual network constructed atop an already established physical network infrastructure. Typically, it entails establishing extra logical connections, protocols, or network segments to facilitate particular functions or services, all without necessitating alterations to the foundational network structure. These overlay networks find widespread application in implementing functionalities like Content Delivery Networks (CDNs) and Peer-to-Peer (P2P) networks. They offer adaptability and scalability, enabling the smooth deployment of new services or enhancing existing ones while leaving the underlying network undisturbed. It is important to emphasize that the main differences between an overlay network and a VPN concern their approach to security, architecture, and managing data flow over a public network. In particular:  
* Approach to Security: ONs implement security through end-to-end encryption of data. Each node encrypts the data before transmitting them over the public network. This ensures that the data remain secure even when transmitted over an untrusted network. VPNs, on the other hand, use tunneling to ensure data security. Data are encapsulated in encrypted packets as they traverse the public network. This creates a secure tunnel between devices communicating through the VPN. * Architecture: ONs are built on top of existing networks, adding an abstraction layer. Nodes in the ON can be implemented on different hardware and software, allowing for greater flexibility. VPNs are typically implemented on existing Internet Protocol (IP) networks, both on the Internet and as part of private networks. They use specific protocols to establish secure connections between participating devices. * Data Flow Management: ONs manage data flow in a distributed manner. Each node in the network is responsible for transmitting and receiving data, which may follow different paths based on the overlay network topology. VPNs manage data flow in a centralized way. Data are sent through the VPN tunnel between a client and a central VPN server, which handles routing and data security. * Scalability: ONs can be more scalable than VPNs in some situations, as they can better adapt to changes in network topology and support a larger number of nodes without impacting performance. VPNs may have scalability limitations due to their need to manage centralized VPN tunnels and their dependence on a device's capacity to handle encrypted traffic. From the sentences above, it is clear that both ONs and VPNs offer solutions for creating private and secure networks over public network infrastructures. Still, their approaches to security, architecture, and data flow management differ. The choice between the two depends on the specific requirements of the network environment and applications. This work's main aim is to offer a deep performance comparison (from different points of view) between VPNs and ONs.