Recognize common VPN jobs

Several different jobs hide behind the word VPN. Naming the job you actually have is the most useful thing you can do before building anything.

A remote-access VPN connects one device to a private network. The classic example: your laptop at home reaching the internal wiki at 10.0.1.100. Each device runs a client and holds its own credentials.

A site-to-site VPN joins two networks. The office network and the datacenter network behave like one routed system. The tunnel runs between two gateways, and the individual devices behind them never know it exists.

An egress VPN sends Internet traffic through another location. You are not trying to reach anything private; you are changing where your traffic exits and who can observe it locally. A consumer VPN usually focuses on this job.

job              connects                the question it answers
remote access    one device ⇄ network    "can my laptop reach the internal wiki?"
site-to-site     network ⇄ network       "can the office reach the datacenter?"
egress           device ⇒ Internet       "which address do websites see, and who watches locally?"
app access       one user ⇒ one app      "can Ana open the admin panel, and nothing else?"

That last row matters more every year. A company may need identity-based access to a few internal applications instead of broad network access. If the requirement is “Ana can use the dashboard”, handing Ana a route to an entire subnet is far more access than the job needs.

The designs differ, which is why the label alone misleads. Remote access needs per-device keys and enrollment. Site-to-site needs gateways and agreed routes on both sides. Egress needs NAT and careful DNS handling. App access might not need a network tunnel at all.

Do not choose a product from the word VPN alone. Start from the traffic that must move and the resources that must become reachable. Write it as one sentence: “this device must reach that resource.” The design follows from the sentence.

The common mistake: buying a consumer egress VPN to reach an office network. It changes where your Netflix traffic exits. It brings you no closer to 10.0.1.100.