Skip to content
IT Atlas

Networking · Remote Access

VPN

A virtual private network carries private traffic across untrusted networks inside an authenticated, encrypted tunnel.

IntermediateUpdated 2026-09-01

Overview

VPNs come in two broad shapes. Site to site tunnels join networks, a branch to a data centre, or on premises to a cloud virtual network. Remote access tunnels connect a single user device to a corporate network.

A tunnel provides confidentiality, integrity and peer authentication. It does not provide authorisation. Many breaches have followed a legitimate VPN login that granted broad network reach, which is precisely the gap Zero Trust network access is designed to close.

How it works

  1. 01IPsec negotiates a security association with IKEv2, authenticating peers by certificate or pre shared key, then encrypts packets in ESP, typically tunnel mode for site to site and transport mode inside other encapsulation.
  2. 02TLS based clients tunnel IP traffic over TCP or UDP 443, which traverses restrictive networks more easily.
  3. 03WireGuard uses fixed modern cryptography and a very small code base, with peers identified by public keys.
  4. 04Split tunnelling sends only corporate bound prefixes through the tunnel; full tunnelling sends all traffic, including internet browsing, through the corporate egress.

Why it matters

  • It remains the default way to reach legacy applications that cannot be published safely any other way.
  • Cloud adoption depends on stable site to site connectivity or its private circuit equivalents.
  • VPN concentrators are internet facing, high value assets and a recurring initial access vector, they demand fast patching and strong authentication.

Design considerations

  • Terminate tunnels on a device that can enforce per user policy, not just route packets.
  • Plan MTU and MSS clamping; tunnel overhead is the usual cause of 'ping works, file copy hangs'.
  • Size for peak concurrency and for crypto throughput, not just licence count.
  • Prefer certificate based device authentication plus phishing resistant user MFA.

Security considerations

  • Require MFA on every remote access VPN, ideally phishing resistant.
  • Restrict what the tunnel can reach with per group ACLs; a VPN should not place a laptop on the server VLAN.
  • Patch gateways urgently, VPN appliance vulnerabilities are routinely exploited within days of disclosure.
  • Log and monitor authentications for impossible travel and unusual concurrency.

Common misconfigurations

  • Local accounts left enabled on the gateway without MFA.
  • Any/any policy for the VPN pool.
  • Weak or legacy IKE proposals (DES, 3DES, MODP-1024) still enabled for compatibility.
  • Certificates and pre shared keys that never rotate and are shared across sites.

Primary sources