Definition
L2TP (Layer 2 Tunneling Protocol) is a tunneling protocol that, by itself, provides no encryption — it simply encapsulates Layer 2 frames inside IP packets. To be secure, it is virtually always paired with IPSec, which encrypts and authenticates the L2TP traffic. The combination, written L2TP/IPSec, was standard on consumer devices and routers for many years because it was natively supported by Windows, macOS, iOS, and Android.
Concerns
L2TP/IPSec uses fixed UDP ports (1701, 500, and 4500), all easily blocked by firewalls. Edward Snowden's leaks raised concerns that the NSA might have weakened or partially compromised IPSec, though specifics remain unclear. The double encapsulation imposes higher overhead than purpose-built VPN protocols. None of these are decisive flaws, but together they have moved L2TP/IPSec from default-recommendation status to a 'works, but not the first choice' tier.
Status Today
L2TP/IPSec is still useful when nothing else is available — many older routers and embedded devices speak it natively. For new deployments, IKEv2/IPSec, OpenVPN, and especially WireGuard are preferred. Most reputable VPN providers still offer L2TP/IPSec as a fallback but no longer feature it prominently.
In Practice
L2TP/IPsec still ships with Windows, macOS and many routers, so it can be handy as a fallback when nothing else is installed. Its fixed ports (UDP 500, 1701 and 4500) make it easy for firewalls to block, and it is slower than WireGuard or IKEv2. Avoid configurations that use a published pre-shared key, because anyone who knows the key can impersonate the server.