This disclosure provides systems, methods and apparatus, including computer programs encoded on computer storage media for encapsulating and decapsulating packets for transmission via virtual private networks (VPNs). In one aspect, a packet is identified for transmission via a specified VPN. An ordered sequence of operations corresponding to the VPN may be received, with a set of parameters corresponding to the ordered sequence of operations. An encapsulated packet may be generated by performing the ordered sequence of operations on the packet using the set of parameters.