VPN

A VPN (Virtual Private Network) connects a device or an entire site to a remote network over an encrypted tunnel, as if no public internet sat in between. The point is to protect data in transit across an untrusted network from being read or altered, while still allowing access to internal resources that would otherwise only be reachable on site. There are two basic forms: site-to-site VPNs between two locations, and client VPNs for individual users working from home or on the road.

In practice, an employee working from home logs into a VPN client and from then on works as if sitting in the office, with access to file servers or internal applications. Between two company sites, a site-to-site VPN usually runs permanently in the background through each location's firewall, invisible to staff. Common technical foundations for this include IPsec and WireGuard.

A common mistake is opening individual ports directly from the internet to an internal server to enable remote access, instead of using a VPN – that creates a permanent, unencrypted hole inward rather than a controlled connection. A VPN on its own also doesn't replace access control: someone connected via VPN still only needs the rights inside the network that they actually require.