Definition
L2TP (Layer 2 Tunneling Protocol) is a tunneling protocol that, by itself, provides no encryption — it simply encapsulates Layer 2 frames inside IP packets. To be secure, it is virtually always paired with IPSec, which encrypts and authenticates the L2TP traffic. The combination, written L2TP/IPSec, was standard on consumer devices and routers for many years because it was natively supported by Windows, macOS, iOS, and Android.
Concerns
L2TP/IPSec uses fixed UDP ports (1701, 500, and 4500), all easily blocked by firewalls. Edward Snowden's leaks raised concerns that the NSA might have weakened or partially compromised IPSec, though specifics remain unclear. The double encapsulation imposes higher overhead than purpose-built VPN protocols. None of these are decisive flaws, but together they have moved L2TP/IPSec from default-recommendation status to a 'works, but not the first choice' tier.
Status Today
L2TP/IPSec is still useful when nothing else is available — many older routers and embedded devices speak it natively. For new deployments, IKEv2/IPSec, OpenVPN, and especially WireGuard are preferred. Most reputable VPN providers still offer L2TP/IPSec as a fallback but no longer feature it prominently.