VPNs, remote access and zero trust explained

Remote access is a design decision

A VPN can connect devices to private networks, sites to one another or individual users to remote resources. Application-level zero-trust access can instead grant a particular service without broad routing privileges. Start by identifying the target resource and user identity, then choose the smallest necessary connectivity.

A tunnel encrypts packets over an untrusted path, but it does not automatically make the device safe or authorize access to every internal application. Review MFA, device posture, least privilege, logging and revocation.

Protocol and access-model comparison

The table below compares network tunnels, overlay networking and application-level access. Do not infer a fixed speed ranking: endpoint CPU, hardware acceleration, MTU, NAT, WAN quality, tunnel settings and client implementation all matter. WireGuard’s own performance page cautions that its published benchmarks are old and insufficient for current rankings.

Compare and filter these access models in the interactive engineering lab.

The primary architectures

Client-to-site tunnels let devices route to selected private subnets. Site-to-site tunnels join gateways and require correct routes, overlapping-subnet planning and failover. Mesh overlays simplify remote peers and may use relays when NAT traversal fails. Application proxies deliver least-privilege access to web apps or certain services without general subnet reachability.

Split tunneling, DNS and routing

A full tunnel routes general traffic through the VPN, while split tunneling only directs selected destinations across it. This changes bandwidth demand, monitoring visibility and potential DNS leaks. Test both IPv4 and IPv6, MTU behavior, DNS search domains and whether a disconnected tunnel fails open or closed.

ip routeip -6 routeresolvectl status# Compare with the authorized VPN connected and disconnected.# Avoid publishing private IP ranges or peer keys.

Performance and security measures

Measure median and tail latency, throughput and packet loss with comparable endpoints and realistic workloads. Capture CPU usage, crypto acceleration, packet size, MTU, retransmits and path length. WireGuard is often efficient, but hardware-accelerated IPsec can perform very well; OpenVPN performance also depends on version, DCO support and cipher. No protocol name alone determines your Mbps.

• Verify authentication and key rotation responsibilities
• Test failover and device revocation
• Limit access to the required applications or networks
• Monitor failed connections and policy decisions without leaking credentials
• Prefer maintained protocols over legacy compatibility modes for new designs

Zero trust versus broad VPN access

NIST SP 800-207 describes zero trust as removing implicit trust based on network location. Policy decisions are based on identity, device and resource context. ZTNA gateways and private access products can apply controls per application, but their capabilities vary—some do not support arbitrary UDP or local discovery.

The decision is not VPN good versus ZTNA bad. A contractor accessing one web dashboard has a different need from a gateway connecting two branches with several protocols. Consider time-limited support grants and identity-aware audit trails.

Choose by use case

For a small team administering Linux hosts, a well-managed WireGuard overlay or a brokered zero-trust terminal may fit. For branch networking, compatible IKEv2/IPsec gateways may be preferable. When device and network compatibility is varied, OpenVPN remains useful. L2TP/IPsec is generally a legacy accommodation rather than a first choice. Test the configuration under real route, DNS and connectivity conditions before deployment.

FAQ: is a zero-trust solution always faster?

No. Performance depends on transport, location of proxies and gateways, network paths and application behavior. Do not compare a local hardware-accelerated IPsec tunnel with a cross-region application proxy using a single speed score. Test end-to-end user journeys and report measurement conditions.