Virtual Private Network (VPN)
Encrypted tunnels over public networks — site-to-site links that stitch clouds to data centers, and the remote-access model zero trust is busily replacing.
Last reviewed: July 25, 2026
What is a VPN?
A virtual private network builds an encrypted tunnel across untrusted networks so remote parties communicate as if locally connected. Two deployment shapes dominate infrastructure work. Site-to-site VPNs connect networks to networks — your data center to a VPC via IPsec (AWS Site-to-Site VPN gives you a redundant pair of tunnels, ~1.25 Gbps each, in minutes — the fast, cheap counterpart to Direct Connect). Remote-access VPNs connect individual users to a network, historically the corporate perimeter’s front door.
The protocol landscape, briefly
IPsec rules site-to-site (hardware support everywhere, BGP-friendly). WireGuard rewrote expectations for the rest — a deliberately tiny cryptographic design, kernel-fast, with connection setup and roaming behavior that makes OpenVPN feel baroque; it now underpins most modern mesh/overlay products (Tailscale et al.). TLS-based VPNs persist mainly where traversing hostile middleboxes on 443 matters.
The strategic decline of remote-access VPN
The corporate VPN’s security model — authenticate once, receive broad network reachability — is exactly the flat-network assumption zero trust rejects: one phished credential yields lateral movement across everything routable. The replacement pattern (identity-aware, per-application access) is eating remote-access VPN steadily. Site-to-site is different: networks genuinely need network-level links, and there VPN remains unambiguous best practice — encrypted, cheap, and the standard backup path under Direct Connect.
What people get wrong
- Full-tunnel-everything remote access, hairpinning all user traffic through HQ for latency nobody enjoys and inspection nobody reads.
- Treating VPN presence as authorization — the tunnel authenticates the connection, not what it may touch.
- Forgetting overlapping CIDRs — site-to-site between networks that both picked 10.0.0.0/16 means NAT contortions forever.
Primary source: WireGuard — protocol whitepaper
Site-to-Site vs. Remote-Access VPNs
VPNs serve two structurally different use cases with different setups: site-to-site VPNs create a persistent, always-on encrypted tunnel connecting two entire networks (like an on-premises data center and a cloud VPC), letting any resource on either side communicate with any resource on the other as if they shared a network. Remote-access VPNs instead connect an individual device (an employee’s laptop) to a private network on demand, typically through client software the user runs to establish a temporary encrypted tunnel for that session. Zero trust network architectures are increasingly replacing remote-access VPNs specifically, since a VPN traditionally grants broad network-level access once connected, while zero trust approaches grant much more granular, continuously verified, per-resource access instead — though site-to-site VPNs remain common for connecting whole networks together in hybrid cloud architectures, a use case zero trust doesn’t directly replace.
Historical figures and technical concepts for informational purposes only. Not technical, professional, legal, or financial advice. Sources: Official Documentation.