A small manufacturer needed its outsourced IT provider to reach one file server, so someone forwarded TCP 3389 on the firewall straight to it. Within a day the server's Security log held tens of thousands of event 4625 failed logons from addresses around the world, and within a month one of the guesses succeeded. Almost every organization needs remote access, and the way it's built decides whether it is a controlled entry point or an open one.
On the CompTIA Security+ SY0-801 exam, VPNs, tunneling and remote access sit under objective 3.2, which presents scenarios and expects you to choose the architecture that best protects the infrastructure. This lesson covers how tunneling works, site-to-site and remote access VPNs, IPsec and TLS VPNs, full and split tunneling, always-on VPN, gateways and bastion hosts for administration, and how user management keeps remote access least privileged. The protocol details of IPsec, including AH, ESP and its two modes, are in the encryption in transit lesson.
Tunneling wraps one packet inside another to carry it across a network
Tunneling is encapsulation. The original packet, headers and all, becomes the payload of a new packet with a new outer header. Routers along the path read only the outer header and forward the packet to the far end of the tunnel, which strips the outer header and delivers the original packet as if it had arrived on a local network.
Inside the branch office:
IP 10.20.5.14 -> 10.10.1.30 | TCP 445 | data
After the branch gateway encapsulates it:
IP 203.0.113.10 -> 198.51.100.7 | ESP header | [ IP 10.20.5.14 -> 10.10.1.30 | TCP 445 | data | ESP trailer ] | ESP auth
(everything in brackets is encrypted)
That is how private addresses such as 10.20.5.14 cross the internet: the routers in between only ever see the public addresses of the two gateways.
Tunneling and encryption are separate ideas. GRE and VXLAN tunnels carry traffic with no encryption at all; they solve a routing problem, not a confidentiality problem. A VPN is a tunnel plus encryption and authentication, which is what makes it safe across untrusted networks. On the exam, "encapsulation" means tunneling, and a requirement to protect the contents means the tunnel must also be encrypted.
Encapsulation has a cost. Every added header uses bytes from the standard 1,500-byte Ethernet MTU, so less room remains for data in each packet. Tunnels that don't account for this cause fragmentation and odd failures where small requests work and large transfers hang, a familiar ticket after a VPN rollout.
Site-to-site VPNs connect networks, remote access VPNs connect people
A site-to-site VPN links two networks through gateways at each end, usually firewalls or routers. The tunnel stays up permanently, and users at the branch run no VPN software and don't know the tunnel exists; their traffic to headquarters subnets is simply routed into it. Site-to-site links typically use IPsec in tunnel mode, with the gateways authenticating each other by certificate or pre-shared key. Certificates scale better and avoid a shared secret that has to be typed into both devices and is rarely changed.
A remote access VPN connects one device to a network. Client software on the laptop authenticates the user, ideally with MFA, and the concentrator, also called the VPN headend, assigns the laptop an address from an internal pool. From then on the laptop behaves as if it were plugged into a port on the corporate network, which is both the convenience and the risk.
| Site-to-site | Remote access | |
|---|---|---|
| Connects | Network to network | One device to a network |
| Endpoints | Gateways at each site | Client software and a concentrator |
| Who authenticates | The gateways | The user, and ideally the device |
| Uptime | Always up | Per session, or always on |
| Typical protocol | IPsec tunnel mode | IPsec with IKEv2, or TLS |
Concentrators face the internet by design, and attackers target them constantly. Several widely used VPN appliance product lines have had critical, actively exploited flaws in recent years, and in 2024 the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive ordering federal agencies to mitigate one. Patch concentrators on an emergency schedule, require MFA, and send their logs to the SIEM.