A virtual private network (VPN) uses authentication and encryption to create a secure, private connection over an untrusted network such as the internet or a public Wi-Fi network. Organizations use VPNs to give remote workers secure access to internal resources and to connect offices to each other, while consumers use VPN services for privacy. This page explains how VPNs work, the main types and protocols, their benefits and risks, and how they compare with modern Zero Trust Network Access (ZTNA).

Last updated: November 9, 2026

How a VPN Works

A VPN client authenticates to a VPN server, or gateway, and the two establish an encrypted tunnel between them. On the client, the VPN typically creates a virtual network interface with its own IP address, and traffic destined for the private network is routed through the tunnel. Anyone observing the traffic on the untrusted network sees only encrypted data between the client and the gateway.

Types of VPNs

VPNs generally fall into three categories, including the following.

• Remote access VPN: A client on a laptop, tablet, or phone connects individual users or devices to the organization’s network. This is the most common type of enterprise VPN, and solutions such as Always On VPN connect automatically and transparently.
• Site-to-site VPN: Gateways connect entire networks, such as a branch office and a data center, or an on-premises network and a public cloud.
• Consumer VPN service: A commercial service that encrypts an individual’s internet traffic to the provider and masks their location and IP address.

VPN Protocols

Most VPNs are built on IPsec or TLS. Both are secure when properly configured, and each has trade-offs, including the following.

• IKEv2 (IPsec): Fast, efficient, and secure, with mutual authentication. It’s the preferred protocol for Always On VPN, but some networks block the UDP ports it uses.
• TLS-based protocols: Protocols such as Microsoft’s Secure Socket Tunneling Protocol (SSTP) run over TCP port 443, so they work from nearly any network, including those that block IPsec. Many third-party VPNs also use TLS.
• PPTP and L2TP: Legacy protocols that should no longer be used. Microsoft deprecated PPTP and L2TP in Windows Server Routing and Remote Access Service (RRAS) in October 2024, and new RRAS installations on Windows Server 2025 don’t accept them.

For stronger security, use certificate-based authentication rather than usernames and passwords alone. Learn more about digital certificates for strong, phishing-resistant authentication.

How VPNs Protect You

A VPN prevents anyone on the same network, such as a coffee shop Wi-Fi network, from reading or tampering with your traffic. For organizations, a remote access VPN keeps internal applications and data off the public internet while still making them available to authorized users, and it lets administrators manage company-owned devices wherever they are. Because most websites and cloud services already use HTTPS, a VPN adds less protection for everyday browsing than it once did, but it remains essential for reaching private resources.

VPN Risks

A VPN is not a complete security solution, and it introduces risks of its own, including the following.

• Consumer VPN providers see your traffic: A consumer VPN hides your activity from your internet service provider, but the VPN provider can see it instead, so choose a provider carefully.
• Stolen credentials: An attacker with a valid username and password can connect just like a legitimate user. Use certificate authentication or multifactor authentication to reduce this risk.
• Internet-facing gateways: VPN gateways must be reachable from the internet, which makes them frequent targets. Keep them patched and hardened.
• Broad network access: Most VPNs grant access to the entire internal network once connected, which allows an attacker on a compromised device to move laterally. This is the main problem Zero Trust approaches address.

Microsoft VPN Solutions

Windows includes a built-in VPN client that supports IKEv2 and SSTP and works with Windows Server RRAS and many third-party VPN gateways. Microsoft offers the following remote access solutions.

• Always On VPN: Seamless, always-on remote access for Windows devices, with optional pre-logon connectivity through the device tunnel.
• DirectAccess: Microsoft’s earlier always-on remote access solution, deprecated in June 2024. Microsoft recommends migrating to Always On VPN.
• Microsoft Entra Private Access: A cloud-delivered ZTNA service that provides per-application access without a traditional VPN.

VPNs and the Cloud

Moving applications and infrastructure to the cloud doesn’t eliminate the need for secure remote access. Remote users still need private, authenticated access to applications and data, and administrators need a secure channel to manage infrastructure. Cloud providers offer their own VPN gateways, and many third-party VPN appliances are available as virtual machines in Azure and AWS. Note that Microsoft doesn’t support Windows Server RRAS or DirectAccess on Azure virtual machines, although some organizations deploy RRAS in Azure without formal support.

VPN vs. Zero Trust Network Access

Traditional VPNs connect a device to the network. Zero Trust Network Access (ZTNA) instead grants access to specific applications, evaluating identity and device health on every request. ZTNA reduces lateral movement and removes the need for internet-facing VPN gateways, but VPNs still fill gaps such as pre-logon connectivity for domain-joined devices. For a detailed comparison, see Always On VPN vs. Entra Private Access.

Choosing an Enterprise VPN

Choosing a secure remote access solution depends on your devices, infrastructure, security requirements, and budget. For the factors I recommend evaluating and the solutions I work with, see Enterprise VPN and Secure Remote Access Consulting.

Additional Information

Security Architecture for the Internet Protocol (RFC 4301)

Internet Key Exchange Protocol Version 2 (RFC 7296)

Remote Access Overview (Microsoft Learn)

Always On VPN Protocol Recommendations for Windows Server RRAS

Microsoft Deprecates Legacy VPN Protocols

Start a Conversation

Want to learn more about your remote access options? Tell me about your environment, and I’ll follow up, typically within one business day.