In security-focused deployments, VPN gateways or clients commonly authenticate peers and use a cryptographic protocol such as IPsec or Transport Layer Security to protect traffic across an untrusted path. The exact security properties depend on the VPN type and configuration.
VPN is also used for provider-provisioned Layer 2 or Layer 3 services that separate customer forwarding without necessarily encrypting traffic. Topologies include individual remote access and gateway-to-gateway links between sites. Every design must define its attachment points and trust boundary, permitted resources, forwarding or routing behavior, name resolution, address assignment, and downstream policy; tunneled designs must also define tunnel endpoints and traffic selectors.
Key points
Protection goalsState whether the design provides confidentiality, integrity, peer authentication, replay protection, traffic separation, or only some of these properties.
Access policyAuthenticate appropriate users, devices, or gateways and restrict reachable networks and services instead of treating tunnel membership as unrestricted trust.
OperationsUse current protocols and cryptography, protect credentials and keys, monitor establishment and use, patch exposed gateways, and plan revocation and recovery.
Important limitationCryptographic tunnel protection normally ends at the tunnel endpoints, while forwarding separation alone does not provide confidentiality or integrity. A VPN does not establish that a user, endpoint, destination, or application is safe, and broad routes can extend the impact of a compromised device.