Introduction
A Virtual Private Network (VPN) creates a secure, private connection over a public or otherwise untrusted network, most commonly the internet. Instead of exposing internal services directly to the internet, or sending sensitive traffic in the clear, a VPN wraps that traffic in an encrypted tunnel so that even if it is intercepted, it cannot be read or tampered with by anyone without the correct keys.
Cricket analogy: Instead of broadcasting a team's private tactical radio chatter openly over the stadium's public frequency, a VPN is like routing that chatter through a coded, sealed channel so that even if opponents intercept the signal, they can't read or alter the instructions inside.
Explanation
A VPN's core mechanism has two parts: tunneling and encryption. Tunneling encapsulates one network packet inside another, effectively creating a private, logical path across a network that the underlying, potentially hostile network cannot see into or interfere with in a meaningful way. Encryption then protects the confidentiality and integrity of the encapsulated data, so that anyone observing the tunnel from the outside sees only opaque, encrypted traffic rather than the original packet contents. Together, tunneling plus encryption let two endpoints communicate as if they were on the same private network, even though their traffic physically crosses the public internet. There are two common VPN deployment models. A site-to-site VPN connects two networks, such as a company's headquarters and a branch office, through VPN gateways at each location; individual devices on either network are unaware a VPN is even in use, since the gateways handle the tunnel transparently. A remote-access VPN, by contrast, connects an individual user's device, such as an employee's laptop, to a corporate network through a VPN client running on that device and a VPN gateway/concentrator at the corporate edge; this model is intended for people working from home, hotels, or other untrusted networks who need to reach internal resources securely.
Cricket analogy: Tunneling is like packing a team's coded tactical notes inside a sealed courier pouch so the postal system carrying it can't see the contents, and encryption is the lock on that pouch; a site-to-site VPN is like two team headquarters exchanging pouches via dedicated couriers, while a remote-access VPN is like a single traveling scout carrying their own sealed pouch wherever they go.
Example
Site-to-site VPN:
HQ-Network <--> [VPN Gateway A] === encrypted tunnel === [VPN Gateway B] <--> Branch-Network
(All devices at HQ and Branch communicate transparently; no per-device VPN client needed)
Remote-access VPN:
Employee Laptop --[VPN Client]-- encrypted tunnel --[VPN Gateway]-- Corporate Network
(Only devices running the VPN client and authenticating individually get access)
Packet view (simplified):
Original packet: [ IP header | TCP header | Data ]
After VPN tunneling: [ New IP header (tunnel) | Encrypted( IP header | TCP header | Data ) ]
Analysis
In the site-to-site model, the encryption and tunneling happen entirely at the network edge (the gateways), so it scales well for connecting whole offices without configuring every individual machine, but it does not protect a device once it leaves either network's physical location. In the remote-access model, the tunnel exists between the specific device and the corporate gateway, so protection travels with the user regardless of which network they are physically connected to, such as a coffee shop's Wi-Fi. This also means remote-access VPNs typically require stronger per-user authentication, often combined with multi-factor authentication, since any single compromised laptop and credential pair could grant tunnel access. The packet view illustrates why intercepted VPN traffic reveals little to an eavesdropper: the original headers and data are wrapped inside encryption, with only the new outer tunnel header visible in transit.
Cricket analogy: A site-to-site link between two team offices protects communications only while inside those buildings, not a coach's phone once they leave for a scouting trip, while a remote-access setup like a personal secure line protects the coach wherever they travel, requiring stronger identity checks like a second verification code since a single stolen phone and password could grant access; an eavesdropper watching that line sees only an unreadable outer wrapper, not the actual scouting notes.
Key Takeaways
- A VPN's core mechanism combines tunneling (encapsulation) with encryption (confidentiality and integrity).
- Site-to-site VPNs connect two networks transparently through gateways, with no client software needed on individual devices.
- Remote-access VPNs connect an individual device to a network via a client and gateway, ideal for traveling or remote employees.
- VPN traffic observed from outside the tunnel appears as encrypted, opaque data rather than readable packet contents.
Practice what you learned
1. What are the two core mechanisms that make up a VPN's protection?
2. Which VPN model connects two entire office networks transparently through gateways, without needing client software on every device?
3. An employee connects to the corporate network from a hotel Wi-Fi using a VPN client on their laptop. What type of VPN is this?
4. Why does intercepted VPN traffic reveal little useful information to an eavesdropper?
Was this page helpful?
You May Also Like
Network Security Overview
A layered introduction to protecting networks, tying together firewalls, IDS/IPS, VPNs, and segmentation into a defense-in-depth strategy.
TLS/SSL Basics
Understand how the TLS handshake establishes a secure session, and why SSL is the deprecated predecessor to modern TLS.
Multi-Factor Authentication
Understand how MFA combines multiple distinct authentication factor categories to dramatically reduce the risk of account takeover.
Network Segmentation
How dividing a network into isolated zones, such as VLANs or subnets, limits lateral movement when a segment is compromised.