Virtual Private Networks

A virtual private network, or VPN, carries selected network traffic through a protected tunnel across another network. The outer network might be the public internet. To applications, the path can behave like a direct connection to a remote private network.

The useful mental model is a guarded route, not a blanket of safety.

original packet → policy selects route → VPN protects and encapsulates it
                → untrusted network → peer verifies and unwraps it → destination

The tunnel protects traffic only between its endpoints. Traffic before it enters or after it leaves follows the security controls of those networks. A VPN does not repair an infected endpoint, authorize every application correctly, or make a remote network trustworthy.

Why VPNs exist

Organizations often need private communication without owning every link between locations. A VPN uses an existing IP network while adding security services such as confidentiality, integrity, peer authentication, and replay protection.

Common purposes include:

• Connecting a remote worker to internal services.
• Connecting two offices or cloud networks.
• Building an encrypted overlay among servers.
• Protecting traffic on an untrusted local network.
• Sending selected traffic through a controlled inspection or egress point.

A VPN can reduce exposure on the path. It also creates a high-value entry point. Weak credentials, vulnerable gateways, broad routes, or compromised clients can turn remote connectivity into a route for attackers.

The parts of a VPN

Every VPN design answers five questions.