Networking · Remote Access
VPN
A virtual private network carries private traffic across untrusted networks inside an authenticated, encrypted tunnel.
IntermediateUpdated 2026-09-01
Overview
VPNs come in two broad shapes. Site to site tunnels join networks, a branch to a data centre, or on premises to a cloud virtual network. Remote access tunnels connect a single user device to a corporate network.
A tunnel provides confidentiality, integrity and peer authentication. It does not provide authorisation. Many breaches have followed a legitimate VPN login that granted broad network reach, which is precisely the gap Zero Trust network access is designed to close.
How it works
- 01IPsec negotiates a security association with IKEv2, authenticating peers by certificate or pre shared key, then encrypts packets in ESP, typically tunnel mode for site to site and transport mode inside other encapsulation.
- 02TLS based clients tunnel IP traffic over TCP or UDP 443, which traverses restrictive networks more easily.
- 03WireGuard uses fixed modern cryptography and a very small code base, with peers identified by public keys.
- 04Split tunnelling sends only corporate bound prefixes through the tunnel; full tunnelling sends all traffic, including internet browsing, through the corporate egress.
Why it matters
- It remains the default way to reach legacy applications that cannot be published safely any other way.
- Cloud adoption depends on stable site to site connectivity or its private circuit equivalents.
- VPN concentrators are internet facing, high value assets and a recurring initial access vector, they demand fast patching and strong authentication.
Design considerations
- Terminate tunnels on a device that can enforce per user policy, not just route packets.
- Plan MTU and MSS clamping; tunnel overhead is the usual cause of 'ping works, file copy hangs'.
- Size for peak concurrency and for crypto throughput, not just licence count.
- Prefer certificate based device authentication plus phishing resistant user MFA.
Security considerations
- Require MFA on every remote access VPN, ideally phishing resistant.
- Restrict what the tunnel can reach with per group ACLs; a VPN should not place a laptop on the server VLAN.
- Patch gateways urgently, VPN appliance vulnerabilities are routinely exploited within days of disclosure.
- Log and monitor authentications for impossible travel and unusual concurrency.
Common misconfigurations
- Local accounts left enabled on the gateway without MFA.
- Any/any policy for the VPN pool.
- Weak or legacy IKE proposals (DES, 3DES, MODP-1024) still enabled for compatibility.
- Certificates and pre shared keys that never rotate and are shared across sites.
