What is a VPN (virtual private network)?

VPN: definition and uses

A VPN builds an encrypted tunnel across the internet. Traffic inside it is protected from eavesdropping and tampering, and the device behaves as if it were connected directly to the company network. This lets employees reach file servers, ERP systems or internal web applications without those having to be exposed to the internet.

Typical forms are the remote-access VPN for individual users at home or on the road, and the site-to-site VPN, which permanently connects two locations, such as headquarters and a branch. Consumer VPN services are a different thing; they mainly aim to mask your location or protect you on public Wi-Fi.

How a VPN works

When the connection is set up, the device and the remote endpoint authenticate each other, then negotiate a key and encrypt all traffic through the tunnel. Common protocols are IPsec with IKEv2, OpenVPN and WireGuard. In companies, certificates or two-factor authentication ensure that only authorized people and devices get in.

With split tunneling, only traffic to company resources goes through the tunnel, while other browsing goes directly to the internet. With a full tunnel, everything is routed via the company network and its protection mechanisms. Which variant fits depends on security requirements and available bandwidth.

Real-world example: a tax firm working from home

A tax advisory firm with twelve employees works partly from home. Client data is stored on the firm’s server, which should not be reachable from the internet. The laptops connect through a VPN with two-factor login, the data stays inside the firm’s network, and access can be granted and revoked per person.

The accompanying measures matter: the laptops are encrypted and updated centrally, private devices stay out, and the VPN gateway is patched promptly. When someone leaves, their account is disabled the same day—a VPN is only as secure as its administration.

Limits, common mistakes and imple­menta­tion

A VPN protects the transmission path, not the endpoint. An infected laptop carries malware through the tunnel into the company network, and anyone connected often sees more than they need. VPN gateways have also repeatedly been a focus of attackers in recent years. Modern concepts therefore grant access to individual applications following the zero trust principle.

Nano Concepts sets up VPN access for the office, home office and locations, hardens and updates the gateways, and works with you to determine whether application-level access instead of network access is the better solution for your company. We can also set up the devices for your employees if you wish.

• VPN access with just a username and password, without a second factor
• Outdated firmware on the VPN gateway or firewall
• All users see the entire network instead of just their own systems
• Accounts of former employees and service providers remain active
• Private, unmanaged devices are allowed to connect