A Remote Access VPN (Virtual Private Network) allows individual users to establish a secure, encrypted connection to their corporate network from an untrusted public network, such as a coffee shop Wi-Fi or their home internet. This provides the user with the same access to internal corporate servers and applications as if they were physically sitting at a desk in the office.
Remote Access vs Site-to-Site VPN
| Feature | Remote Access VPN | Site-to-Site VPN |
|---|---|---|
| Primary Goal | Connect a single user/device to the corporate network. | Connect two entire office networks together permanently. |
| Endpoint | A software client (app) installed on a laptop or phone. | A hardware firewall or router at the branch office. |
| IP Address | Dynamically assigned from a VPN Address Pool. | Uses the permanent, static local LAN subnets. |
How It Works: The Traffic Flow
When a remote employee needs to access an internal payroll server, the process looks like this:
- The Client: The user opens the VPN application on their laptop and enters their credentials.
- Authentication: The laptop connects to the corporate VPN Gateway's public IP over the internet. The gateway verifies the username, password, and typically a Multi-Factor Authentication (MFA) token. It may also check for a valid machine certificate.
- Tunnel Establishment: Once authenticated, an encrypted tunnel (using IPsec or SSL/TLS) is built between the laptop and the firewall.
- IP & DNS Assignment: The firewall assigns the laptop a virtual private IP address from a dedicated VPN Address Pool and assigns the corporate DNS servers to the laptop's virtual network adapter.
- Access: The user can now securely reach the internal payroll server through the encrypted tunnel.
Split Tunnel vs Full Tunnel
When a user connects, the VPN administrator dictates how the user's internet traffic is routed:
- Full Tunnel: Absolutely all traffic from the laptop is forced through the encrypted tunnel. If the user tries to watch YouTube, the video streams from YouTube, into the corporate firewall, through the VPN tunnel, and down to the laptop. This is highly secure but consumes massive corporate bandwidth.
- Split Tunnel: Only traffic destined for corporate IP addresses (e.g.,
10.0.0.0/8) enters the tunnel. General internet traffic (like YouTube) goes directly out the user's local home Wi-Fi. This saves corporate bandwidth but means the user's internet traffic is not protected by the corporate web filters.
Common Troubleshooting Scenarios
1. Authentication Failures
The most common help desk ticket. The user cannot connect at all. Verify their Active Directory account isn't locked out, their password hasn't expired, and their MFA app (like Duo or Microsoft Authenticator) is approving the push notification. If using certificates, ensure the machine certificate hasn't expired.
2. VPN Connects, but Internal Resources Unavailable
The tunnel says "Connected," but the user can't load the intranet. Check the VPN Address Pool. If the pool only holds 100 IP addresses, and the 101st user connects, the tunnel may negotiate, but they won't get an IP address to route traffic.
Another common cause is DNS. If the VPN client fails to apply the corporate DNS servers to the virtual adapter, the laptop won't be able to resolve internal hostnames like intranet.local.
3. Overlapping Home Networks
A classic, difficult-to-diagnose problem. The corporate network uses 192.168.1.0/24. The user's home Wi-Fi router also uses 192.168.1.0/24. When the user tries to ping the corporate file server at 192.168.1.50, their laptop thinks the server is on the local home Wi-Fi and refuses to send the traffic across the VPN tunnel. Resolution: The corporate network must stop using default consumer subnets like 192.168.1.x.
Security Best Practices
Because Remote Access VPNs punch a hole from the internet into the internal network, they are a massive target for ransomware operators.
- Enforce MFA: A password alone is no longer acceptable for VPN access. Always enforce Multi-Factor Authentication.
- Patch VPN Gateways: Vulnerabilities in VPN appliances are routinely exploited. Keep firmware updated.
- Least Privilege: Do not allow the VPN Address Pool unrestricted access to the entire network. Use a Stateful Firewall policy to restrict remote users strictly to the servers they need.