3 VPN Concepts
Learn how VPNs connect users and networks, how tunneling and security protections work, and which components and policies govern VPN access.
VPN purpose and trust
A creates a protected connection across a network that is not trusted, commonly the public internet. It allows remote users or separate networks to communicate as though they had a private connection, while security mechanisms protect traffic in transit. A VPN does not automatically make an endpoint or the network beyond its gateway trustworthy; access continues to depend on security policy.
Remote-access and site-to-site VPNs
Remote-access VPNs connect an individual user device to an organization's network. They are useful for employees working away from the office, and access is usually authenticated and authorized per user or device. A typical connection has a VPN client on a laptop or phone and a . For example, an employee can connect from home to company applications.
Site-to-site VPNs connect networks at two or more locations. Gateways, often routers or firewalls, protect traffic between specified networks, while users access resources through their local networks. This lets hosts at locations such as a branch and headquarters communicate through the protected connection. A site-to-site design may also connect an organization to a business partner, with access restricted by policy.
and security protections
carries one packet inside another. The original packet is the inner packet; added headers form the outer packet, which is used to route the encapsulated traffic across the intervening network. At the receiving tunnel endpoint, the outer wrapper is removed and the original packet is forwarded toward its destination. This encapsulation allows private-network traffic to cross a public network.
A tunnel is not necessarily encrypted merely because it is called a tunnel. transforms readable data into ciphertext so an unintended observer who intercepts it cannot readily understand it. A secure VPN commonly combines with , which helps detect alteration, and , which verifies the identity of a user or VPN peer. These protections are established through agreed security settings and keys.
and key exchange
VPNs commonly use to authenticate peers, negotiate security settings, and establish keys; then protects the data packets. can operate in tunnel mode, where it protects an entire original IP packet by encapsulating it in a new packet. is the protocol commonly used to provide and .
VPN components and
A VPN endpoint or client is a user device and its VPN software in a remote-access connection. It initiates the VPN and sends traffic through it. A , also called a headend, is the router, firewall, or dedicated service that terminates VPN connections and connects them to the protected network.
The public or transport network is the intervening network—often the internet—that carries encapsulated VPN packets. and key-management mechanisms use credentials, certificates, or shared secrets to help verify users or gateways. For , IKE negotiates security parameters and keys.
rules determine which users, devices, or network traffic may use the VPN and which internal resources they may reach. An organization may use an to authenticate users, authorize access, and record activity.
How VPN connections are established
In a , an employee's client connects over the internet to the organization's gateway. After and policy checks, the client and gateway establish protected communication.
In a , gateways at a branch and headquarters establish the tunnel, allowing permitted traffic between their networks. In both cases, the VPN's protections apply to communication across the connection; the determines what is permitted.