Recognize common VPN jobs

Several different jobs hide behind the word VPN. Naming the job you have is the most useful thing you can do before building anything.

A remote-access VPN connects one device to a private network. The classic example: your laptop at home reaching the internal wiki at 10.0.1.100. Each device runs a client and holds its own credentials.

A site-to-site VPN joins two networks. The office network and the datacenter network behave like one routed system. The tunnel runs between two gateways, and the devices behind them never know it exists.

An egress VPN sends your Internet traffic out through another location. You are not trying to reach anything private. You are changing where your traffic exits and who can watch it locally. A consumer VPN usually does this job.

Let’s put them side by side:

job              connects                the question it answers
remote access    one device ⇄ network    "can my laptop reach the internal wiki?"
site-to-site     network ⇄ network       "can the office reach the datacenter?"
egress           device ⇒ Internet       "which address do websites see, and who watches locally?"
app access       one user ⇒ one app      "can Ana open the admin panel, and nothing else?"

That last row matters more every year. A company often needs identity-based access to a few internal applications, not broad network access. If the requirement is “Ana can use the dashboard”, handing Ana a route to an entire subnet is far more access than the job needs.

The designs differ, and that is why the label misleads. Remote access needs per-device keys and enrollment. Site-to-site needs gateways and agreed routes on both sides. Egress needs NAT and careful DNS handling. App access might not need a network tunnel at all.

So don’t choose a product from the word VPN alone. Start from the traffic that must move and the resources that must become reachable. Write it as one sentence: “this device must reach that resource.” The design follows from the sentence.

Here is the sentence for the lab we build in this course: “my laptop must reach 10.14.0.1 on a server I run.” That is remote access, so we need one client key pair and one server. Nothing more.

The common mistake is buying a consumer egress VPN to reach an office network. It changes where your Netflix traffic exits. It brings you no closer to 10.0.1.100. People lose whole afternoons on this before someone asks which job they were solving.

Try this on your own setup: write the one sentence for every VPN you currently use. If you can’t finish the sentence, you probably don’t know what that VPN is for.