A virtual private network (VPN) is an encrypted connection, or tunnel, across a shared network such as the internet that links a remote user’s device, or an entire site, to a private network. Traffic inside the tunnel is encrypted and authenticated, so it can cross the internet without being read or altered on the way. Businesses use VPNs in two main ways: remote-access VPNs for people and site-to-site VPNs for connecting offices, data centers and cloud networks.
At a glance
- A remote-access VPN connects a user’s device to the company network; a site-to-site VPN connects two networks, usually between firewalls or routers.
- Common protocols are IPsec, especially for site-to-site, and TLS-based VPNs and WireGuard for remote users.
- Once connected, a user can reach whatever the network’s routes and firewall rules allow, which is often broader than their job needs.
- Remote-access VPN gateways face the internet and are a frequent target, so patching and MFA matter.
- ZTNA is a common alternative to remote-access VPN for user-to-app needs; site-to-site VPNs remain widely used.
What problem it solves
Business networks and applications need to be reachable from places the company doesn’t control: employees’ homes, hotels, branch offices on ordinary internet circuits and cloud providers’ networks. Sending that traffic over the internet in the clear would expose it. A VPN wraps the traffic in an encrypted tunnel so it can travel over cheap, widely available internet connections instead of dedicated private circuits.
For sites, site-to-site VPNs are a common, low-cost way to connect branches to headquarters or to a cloud network, often in a hub-and-spoke design. For people, remote-access VPN gives staff and administrators access to internal systems that aren’t published to the internet.
How it works
- Authenticate. The VPN client and gateway, or two gateways, prove their identities using certificates, pre-shared keys or user credentials, ideally with MFA for users.
- Agree on keys. They negotiate encryption settings and derive session keys, using protocols such as IKEv2 for IPsec or a TLS handshake.
- Build the tunnel. Traffic is encapsulated and encrypted. In full-tunnel mode all of a user’s traffic goes through the VPN; in split-tunnel mode only traffic for private networks does, and internet traffic goes direct.
- Route and filter. Routes and firewall rules at the gateway determine which networks and systems the user or site can reach.
- Log. Connection, authentication and traffic logs support troubleshooting and investigations.
Encapsulation adds overhead to each packet, so VPNs sometimes need MTU adjustments to avoid stalled connections. Many VPN gateways are features of network firewalls; others are dedicated appliances or cloud services.
When it matters for buyers
- When remote-access VPN hardware or licenses come up for renewal. Compare a like-for-like refresh with ZTNA or an SSE service for user access.
- When a VPN gateway vulnerability is announced. Internet-facing VPN devices are frequent targets; how quickly you can patch, and whether MFA is enforced, matters.
- When opening a new site. Site-to-site VPN over business internet is a common, inexpensive way to connect it, compared with a private WAN circuit.
- When cyber insurers ask about remote access. MFA on VPN and exposure of remote access services are common questionnaire items.
- When performance complaints rise. Backhauling all remote traffic through one data center often causes them; local internet breakout for SaaS traffic, with suitable security, is a common fix.
Questions to ask vendors
- Which protocols and clients do you support, on which operating systems?
- How do you enforce MFA and device checks before a user connects?
- Can we limit each user or group to specific networks or applications rather than the whole network?
- How are gateway vulnerabilities patched, and how quickly, and who does it under a managed service?
- What throughput and concurrent user limits apply, and how do you provide redundancy?
- What logs do we get, and can they go to our SIEM?
How it differs from ZTNA
Zero Trust Network Access (ZTNA) connects a user to individual applications based on identity and other available context, such as device posture, rather than placing the user on the network. A VPN puts the user’s device, or a whole site, onto a private network, and what it can reach is then controlled by routes and firewall rules, which are often broad. That is why a stolen VPN credential can lead to lateral movement across the network. Both encrypt traffic. ZTNA is a common alternative for user remote access, often delivered as part of SSE; site-to-site connections and some legacy needs still use VPNs. For site-to-site options, see our private networking overview and our comparison of SASE vs VPN.
Problems this helps with
- Remote staff need access to internal systems from home
- Branch offices and cloud networks need to connect securely over the internet
- VPN is slow and every remote user's traffic goes through the head office
- Contractors with VPN access can reach far more than they need
