VPNs: Client vs. Site-to-Site

"I'm Working From Home Today"

A VPN (Virtual Private Network) solves a fundamental problem: you have a secure private network (the office LAN), and you need to extend it to somewhere else over the public, untrusted internet. The VPN creates an encrypted tunnel — a private pipe through the public internet — so that traffic traveling between the two endpoints is protected from eavesdropping and tampering.

There are two architecturally distinct types of VPN, and confusing them in an interview is a red flag.

1. Remote Access VPN (Client-to-Site)

This is the "work from home" VPN. An individual device connects to the corporate network over the internet.

• Scenario: An engineer is at a coffee shop and needs to SSH into an internal server that has no public IP.
• Setup: The engineer installs VPN client software on their laptop (Cisco AnyConnect, GlobalProtect, OpenVPN, WireGuard). The corporate firewall runs a VPN concentrator that accepts incoming connections.
• Flow: The laptop negotiates an encrypted tunnel to the firewall. The firewall assigns the laptop a virtual IP address from the corporate range (e.g., 10.10.50.5). From that point, the laptop behaves as if it is physically plugged into the office — it can reach internal servers, printers, and services by their private IP addresses.
• Split tunneling: A common configuration decision. With split tunneling off, all traffic (including YouTube) goes through the corporate VPN — the company can inspect it, but it adds latency. With split tunneling on, only traffic destined for corporate IP ranges goes through the tunnel; everything else goes directly to the internet. Most enterprises use split tunneling on for performance, but security-conscious organizations disable it.

2. Site-to-Site VPN

This is the "branch office" VPN. Two entire networks are connected, not individual devices.

• Scenario: Main office in New York (10.10.0.0/16) and a branch office in London (10.20.0.0/16).
• Setup: No software on individual laptops. The firewall in New York establishes a permanent encrypted tunnel to the firewall in London. Both firewalls use IPsec (Internet Protocol Security) to negotiate encryption keys and maintain the tunnel.
• Flow: A London employee opens a file on a New York file server. Their laptop sends a packet to 10.10.5.20. The London firewall sees the destination is in the NY range, encrypts the packet, and sends it through the tunnel. The NY firewall decrypts it and forwards it to the file server. The London employee never configures anything — the routing is transparent.

Protocol Landscape: