PacketBrief

Enterprise & business VPN reference

The VPN concepts your network actually runs on

Business and enterprise VPNs, explained correctly: IPsec, site-to-site vs remote-access, split tunneling, SSL VPN, the protocols underneath, and where zero trust takes over.

Business VPN guideIPsec explained
Remote-access VPNLaptopPhonepublic internetVPNgatewayHQ LANAppFiles
Site-to-site VPNOffice AHostHostGWOffice BGWHostHostIPsec tunnel · ESP
Two VPN models: remote-access terminates one tunnel per user device; site-to-site joins whole networks with one gateway-to-gateway tunnel.

Latest briefs

All briefs →
BRIEF-13Oct 26, 2026

What Is a Corporate VPN? What It Does, and What Your Employer Can See

A corporate VPN connects you to company systems through a gateway IT runs. Full vs split tunnel, TLS inspection and what managed devices reveal.

Read →BRIEF-12Oct 13, 2026

Always On VPN in 2026: Device Tunnel vs User Tunnel, and What Microsoft Pushes Next

Always On VPN for IT teams: device vs user tunnels, requirements, how it compares with Entra Private Access, and when to migrate.

Read →BRIEF-11Oct 13, 2026

What Is GlobalProtect? Palo Alto's VPN Client, Explained for Users and IT

Palo Alto's GlobalProtect client explained: portals vs gateways, the four connect methods, HIP checks and what its errors mean.

Read →BRIEF-10Sep 21, 2026

IPsec vs SSL VPN: How to Choose for the Enterprise

IPsec and SSL VPN solve remote access differently. How each works, where they beat the other, and how to choose per use case rather than by which is 'more secure'.

Read →BRIEF-09Sep 21, 2026

Remote-Access VPN: How It Works for a Distributed Workforce

A remote-access VPN connects individual devices to the corporate network. How the client and gateway work, full vs split tunnel, and the protocols used.

Read →BRIEF-08Sep 21, 2026

Site-to-Site VPN: How It Works and When to Use It

A site-to-site VPN joins whole networks with one gateway-to-gateway tunnel. How it works, policy-based vs route-based, and how cloud providers implement it.

Read →

PacketBrief is a vendor-neutral reference on business and enterprise VPNs, written for the people who run them. We explain the mechanisms — IPsec, remote-access and site-to-site tunnels, split tunneling, SSL VPN, the protocols underneath and where zero trust fits — without the marketing gloss that fills most VPN pages.

Why the network angle

Because that is where the real decisions are. Consumer VPN sites rank apps by price and streaming unblocks; enterprise teams care about what connects to what, which protocol survives the firewalls in between, and how much of the network a single compromised laptop can reach. Those are architecture questions, and they are what these briefs answer.

Start with the business VPN guide for the full picture of remote-access versus site-to-site, or go straight to how IPsec VPNs work if you are designing a tunnel today.

What you will find here

Short, correct explainers with dates and sources. Every technical claim is one we can point to a standard or a vendor document for, and anything we cannot verify we label rather than guess. We name providers where it helps and disclose the few affiliate links we carry — but the picks that matter most here, like self-hosted WireGuard, Tailscale and Mullvad, pay us nothing.

Common questions

What is the difference between a business VPN and a consumer VPN?
A consumer VPN is one company's app that tunnels a single device to a shared exit server, mainly for privacy and geo-unblocking. A business VPN gives an organisation centrally managed access to its own private network and cloud resources, with user provisioning, access control and audit logging. The technology overlaps, but the buying criteria are almost entirely different.
Is a remote-access VPN the same as a site-to-site VPN?
No. A remote-access VPN connects individual user devices, each running a client, to a gateway that fronts the corporate network. A site-to-site VPN joins entire networks — typically two offices or an office and a cloud VPC — with a single always-on tunnel between their gateways, so hosts behind them talk without any client software.
Should we use IPsec or SSL VPN?
IPsec is the usual choice for site-to-site tunnels and always-on device connectivity; SSL/TLS VPN (an HTTPS-based remote-access VPN) is easier to run through firewalls and NAT and is common for clientless or browser-delivered access. Many enterprise firewalls offer both. The decision turns on what you are connecting and how restrictive the networks in between are, not on which is 'more secure' in the abstract.
Is zero trust replacing the corporate VPN?
For remote application access it increasingly is — Zero Trust Network Access (ZTNA) grants per-application access after verifying identity and device posture, rather than dropping a user onto a flat network as a classic VPN does. But VPNs still underpin site-to-site connectivity and full-tunnel needs, so most organisations run both during a multi-year transition rather than flipping a switch.
Does a VPN make our traffic anonymous?
No — that is a marketing overstatement. A VPN encrypts traffic in transit and moves the point of trust to whoever runs the gateway; it does not erase identity, defeat application-layer tracking, or protect data once it leaves the tunnel. For a business, the honest framing is that a VPN controls where the network boundary sits and who can cross it, not that it makes anyone untraceable.