VPN (Virtual Private Network)
What Is a VPN?
A Virtual Private Network (VPN) is a technology that creates an encrypted, private network connection over a public internet infrastructure, allowing users and devices to send and receive data as if they were directly connected to a private network, regardless of their physical location. VPNs protect data in transit from interception, mask the user’s actual IP address, and extend network access privileges to remote users securely.
Originally developed to connect remote workers and branch offices to corporate networks before cloud computing made direct application access common, VPNs remain a widely deployed remote access tool. They are increasingly being reconsidered and supplemented by Zero Trust Network Access (ZTNA) architectures as the security limitations of traditional VPN design become more apparent in cloud-centric environments.
How VPNs Work
Tunneling
A VPN establishes an encrypted tunnel between the user’s device and a VPN server (or VPN gateway). All network traffic from the user’s device is routed through this tunnel before reaching its destination. From the perspective of external observers and websites the user accesses, traffic appears to originate from the VPN server rather than the user’s actual location and device.
Encryption Protocols
VPN encryption protects data from interception and eavesdropping. Common VPN protocols include OpenVPN, an open-source protocol widely considered the most secure and configurable standard; WireGuard, a newer protocol offering significantly faster connection speeds with strong security; IKEv2/IPSec, commonly used for mobile VPN clients because of its resilience during network transitions; and L2TP/IPSec, an older standard less commonly used in new deployments due to performance limitations.
Authentication
VPN connections require user authentication before granting network access. Strong VPN deployments combine username and password authentication with multi-factor authentication, ensuring that stolen credentials alone are insufficient to establish a VPN connection.
Types of VPN Deployments
Remote Access VPN
Remote access VPNs allow individual users to connect to an organization’s private network from any internet-connected location. This is the most common enterprise VPN use case, enabling employees working from home or traveling to access internal resources, applications, and file shares as if they were on premises.
Site-to-Site VPN
Site-to-site VPNs connect to entire networks rather than individual users. They are commonly used to link branch offices to headquarters, connecting the two networks seamlessly so that users at branch locations can access central network resources without individual client software.
VPN Limitations and the Shift to ZTNA
Traditional VPNs grant connected users broad network access based on successful authentication. Once a user connects, they typically have access to a wide range of network resources rather than only the specific applications they need. This broad access model is problematic when credentials are compromised: an attacker who successfully authenticates the VPN gains the same broad access as the legitimate user.
Zero Trust Network Access (ZTNA) addresses this limitation by granting access at the application level based on continuous verification of user identity, device posture, and contextual signals rather than assuming trust based on a successful VPN connection. ZTNA does not replace VPN in all scenarios but is increasingly the preferred model for application access in cloud-centric environments.
Key Takeaways
- A VPN creates an encrypted tunnel over public internet infrastructure, allowing users to access private networks and protect data in transit regardless of location.
- Key VPN protocols include OpenVPN, WireGuard, and IKEv2/IPSec, each offering different trade-offs between security, speed, and compatibility.
- Remote access VPNs connect individual users to corporate networks; site-to-site VPNs connect entire branch networks to headquarters infrastructure.
- Traditional VPNs grant broad network access upon authentication, creating risk if credentials are compromised; ZTNA addresses this by granting application-level access based on continuous verification.
- VPNs remain widely deployed but are increasingly supplemented or replaced by ZTNA architectures in cloud-centric environments where application-level access control is more appropriate than network-level access grants.