Skip to content
Knowledge Hub/Article
Article

What Is a VPN and How Does It Work? Enterprise VPN vs ZTNA

We explain how a VPN uses tunneling, encryption and authentication, how the protocols differ, and what split tunneling and ZTNA mean.

Oğuzhan Gerçek··10 min read
What Is a VPN and How Does It Work? Enterprise VPN vs ZTNA

Short answer: A VPN (virtual private network) builds an encrypted tunnel between two points across a public network such as the internet and carries traffic through it. Organizations use it in two ways: a remote access VPN connects an employee's device to the corporate network, while a site-to-site VPN joins two networks, such as a branch office and headquarters. Common protocols are IPsec/IKEv2, TLS-based VPNs, OpenVPN and WireGuard. Because the VPN gateway faces the internet, attackers target it too, which is why fast patching, MFA and logging are essential. ZTNA, by contrast, connects the user only to the permitted application, not to the network.

What is a VPN?

NIST's glossary quotes a definition from CNSSI 4009-2022: a protected information system link that uses tunneling, security controls and endpoint address translation to give the impression of a dedicated line. The definition adapted from RFC 4949 describes the structure instead: a restricted-use logical network constructed from the resources of a physical network, with the links of the virtual network encrypted and/or tunneled across the real one.

A VPN is one layer of network security; we cover the other layers in our network security article. There is a short definition of the term in our glossary.

How does a VPN work?

Taking IPsec as the example, three things happen together on a connection:

  • Tunneling (encapsulation): The original IP packet is placed inside a new packet that carries the gateway addresses. RFC 4301 (December 2005), which defines the IPsec architecture, calls this tunnel mode; whenever either end of the connection is a gateway, tunnel mode is mandatory, with two exceptions.
  • Encryption: According to RFC 4301, when ESP is used, protection covers the tunneled packet, not the outer header. An observer on the path can see a packet traveling between two gateways but cannot read the inner packet.
  • Authentication and key exchange: RFC 7296 (October 2014) defines IKEv2 as the protocol that performs mutual authentication between two parties and establishes and maintains security associations (SAs).

For remote access, IKEv2's configuration payload mechanism lets a roaming laptop request an IP address from the gateway to use inside the tunnel.

VPN protocols: IPsec, TLS, OpenVPN and WireGuard

  • IPsec/IKEv2: An IETF standard that operates at the network layer; IKEv2 became an Internet Standard in 2014.
  • TLS-based VPN (SSL VPN): According to NIST's SP 800-113 (July 2008), users connect to these VPN devices with their web browsers. The SSL in the name is a legacy: RFC 7568 (June 2015) prohibits SSL 3.0 and points to TLS as the replacement.
  • OpenVPN: According to the project's documentation, a full-featured SSL VPN that implements secure network extension at OSI layer 2 or 3 using SSL/TLS; it can authenticate clients with certificates, smart cards or username and password credentials.
  • WireGuard: According to its official site, a VPN that encapsulates IP packets over UDP. Its algorithms are fixed: Curve25519, ChaCha20/Poly1305 and BLAKE2s (protocol page). The design paper says it deliberately lacks cipher agility; if a hole is found in one of the primitives, every endpoint will have to update. Because it stays silent to unauthenticated packets, it is invisible to network scanners.

The two official guidance documents cited here both recommend IPsec, but they see TLS VPNs differently. The September 2021 joint guidance from the NSA and CISA advises avoiding non-standard products referred to as SSL/TLS VPNs, because custom features add risk even when the TLS parameters are secure. The UK's National Cyber Security Centre (NCSC), in its VPN guidance, sees very little difference in risk between the two.

Remote access and site-to-site VPNs

NIST SP 800-77 Rev. 1 (June 2020) describes three VPN architectures:

  • Site-to-site (gateway-to-gateway): The tunnel runs between the gateways of two networks. According to NIST, it is most often used to connect two secured networks, such as a branch office and headquarters; it is typically transparent to users, and their systems need no VPN client.
  • Remote access (host-to-gateway): Connects devices on unsecured networks, such as the laptops of traveling employees, to resources on secured networks through the organization's gateway.
  • Host-to-host: Runs between two specific devices, for cases where a small number of trusted users or administrators need remote access to a system.

CIS Controls v8.1 (Safeguard 12.7) requires users to authenticate to enterprise-managed VPN and authentication services before they access enterprise resources. In organizations with many branches, SD-WAN adds central policy and application-aware path selection on top of the tunnels (SD-WAN article). We handle branch connectivity in our network & traffic engineering service.

Consumer VPN services vs enterprise VPNs

Both use the same technology; what differs is who sits at the far end of the tunnel. According to consumer guidance from the US Federal Trade Commission (FTC), a VPN app makes traffic appear to the websites you visit as if it came from a server operated by the VPN provider. In the FTC's words, you are trusting the VPN with potentially all of your traffic: trust shifts from your internet service provider or public Wi-Fi network to the VPN app provider. The FTC adds that such an app generally won't make you entirely anonymous.

In an enterprise VPN, the organization's own gateway sits at the end of the tunnel, and the goal is to reach resources on the corporate network. A proxy, on the other hand, carries only the traffic of the application directed to it; we compare the two in our proxy article.

Split tunneling: which traffic should use the tunnel?

According to NIST SP 800-77 Rev. 1, in a split-tunnel VPN only traffic destined for the organization enters the tunnel, while internet traffic leaves through the device's own connection. When all traffic uses the tunnel, internet-bound traffic also reaches the gateway and is inspected by the organization's firewall.

The NCSC recommends a full-device VPN and advises against split tunneling: it raises the risk of sensitive data reaching an unprotected network, and attackers could pivot through the device to internal resources. Microsoft, on the other hand, says a small group of service endpoints in the Optimize category accounts for around 70% to 80% of the volume of Microsoft 365 traffic. Its recommendation is to route those endpoints outside the tunnel and apply security at other layers. The real question is where the traffic outside the tunnel gets inspected.

Why are VPN gateways a target?

In Verizon's 2026 DBIR, which covers incidents from November 1, 2024, to October 31, 2025, VPN's share among the vectors in System Intrusion breaches stayed at roughly last year's level, around 16%. CISA's Known Exploited Vulnerabilities (KEV) catalog also lists flaws in VPN components: a vulnerability in Fortinet FortiOS SSL-VPN (CVE-2023-27997) was added on June 13, 2023, and one in the VPN web server of Cisco ASA (CVE-2025-20333) on September 25, 2025. The second was the subject of an emergency directive CISA issued the same day (firewall article). The main NSA and CISA recommendations are:

  • Patching: Known vulnerabilities are sometimes exploited in less than 24 hours, so patches should be applied immediately (patch management article).
  • Strong authentication: Client certificates where supported; otherwise another form of MFA that stops logins with stolen passwords (MFA article).
  • Smaller attack surface: Non-VPN features are disabled; for IKE/IPsec, only UDP ports 500 and 4500 and ESP are allowed in from outside (port article). The management interface is reachable only from a dedicated internal management network.
  • Logging: VPN user activity is recorded in local and remote logs and analyzed continuously; we cover the SOC side in our SIEM and SOC article.

VPN vs ZTNA

A VPN is a tool of the perimeter security described in our network security article: it brings the user inside the corporate network. NIST SP 800-207 (August 2020) spells out the weakness of that model: authenticated subjects are given access to a broad collection of resources once on the internal network, and once attackers breach the perimeter, their lateral movement is unhindered.

In Cloudflare's definition, ZTNA (Zero Trust Network Access) provides secure remote access to applications based on defined access control policies, and it does not expose IP addresses to the network. According to SP 800-207, a remote user should not have to connect back to the enterprise network over a VPN to reach a service hosted by a public cloud provider, such as email. The document also expects most enterprise infrastructures to operate in a hybrid zero trust and perimeter-based mode for some time.

There is a short definition of zero trust in our glossary, and we cover the identity foundation behind access decisions in our IAM article. We handle the identity side in our identity management service and the VPN layer in our network security service.

Frequently asked questions

What does VPN stand for? Virtual private network: a technology that builds an encrypted tunnel between two points across a public network.

What is a VPN used for? It lets remote employees reach resources on the corporate network securely and connects branch offices to headquarters.

What is the difference between a VPN and a proxy? A VPN carries a device's network traffic through an encrypted tunnel. A proxy only relays the traffic of the application that is directed to it.

What is split tunneling? Sending only organization-bound traffic through the VPN tunnel while internet traffic leaves through the device's own connection. It improves performance, but the organization no longer inspects the traffic outside the tunnel.

What is a site-to-site VPN? A VPN that connects two networks, such as a branch office and headquarters, through a tunnel between two VPN gateways. Users' devices need no VPN client.

What is the difference between a VPN and ZTNA? A VPN connects the user to the corporate network. ZTNA grants access only to permitted applications; the two models can run side by side for some time.

Sources