What is a VPN? How virtual private networks work
A VPN (virtual private network) creates a secure, encrypted connection over a public network like the internet, so that data can travel privately between two points as if they were on the same private network. The idea shows up in two quite different everyday situations: an individual connecting securely to a company network from home, and a whole office or data centre connecting securely to a cloud provider. Both rely on the same underlying mechanism — an encrypted tunnel over infrastructure neither side fully controls. This article explains that mechanism, the two main uses in cloud contexts, how a VPN compares to a dedicated private connection, and where the topic shows up in networking certification study.
The plain idea and two main cloud uses
Strip away the acronym and a VPN is simple: it wraps your traffic in an encrypted tunnel before sending it across a network you do not trust, so that anyone intercepting the traffic in transit sees only unreadable data, not the actual content. In cloud contexts this shows up in two distinct forms. Site-to-site VPN connects two networks — most commonly an on-premises office or data centre network to a cloud VPC or VNet — so that resources on each side can reach each other as though they shared one network, without any individual device needing its own VPN software.
Client (or remote-access) VPN is the other form: an individual person’s device connects to a private network — a company’s internal systems, or a cloud environment — over an encrypted tunnel, typically using a VPN client application. This is the “VPN” most people are familiar with from remote work, and conceptually it is the same tunnel idea applied to one device rather than a whole network.
How it works, conceptually
Three ideas make a VPN work. First, the tunnel: traffic between the two endpoints is encapsulated and encrypted, so it can traverse the public internet without its contents being readable by anyone in between. Second, authentication: before the tunnel is established, both sides prove who they are — this stops an attacker from simply setting up their own end of the connection. Third, the result: once the tunnel is up, traffic behaves as if it were on a private network, even though the physical path may cross the open internet the whole way.
None of this requires the underlying network to be trustworthy — that is the entire point. A VPN does not make the public internet private; it creates a private channel through it.
How VPNs fit hybrid cloud
Site-to-site VPN is one of the standard ways organisations connect an on-premises network to the cloud, which is central to hybrid cloud architecture — running some workloads on your own infrastructure and others in a public cloud, connected securely, as covered in our explainer on public, private and hybrid cloud. Rather than exposing on-premises systems directly to the internet, or building a private physical link, a site-to-site VPN gives a reasonably quick and inexpensive way to join the two networks with encryption already handled.
VPN versus a dedicated private connection
A VPN over the internet is not the only way to connect on-premises infrastructure to a cloud provider. All three major clouds also offer dedicated private connections that bypass the public internet entirely — AWS Direct Connect, Azure ExpressRoute and Google Cloud Interconnect. These typically offer higher, more consistent performance than a VPN, because the traffic does not compete with general internet traffic or depend on internet routing at all.
The trade-off is straightforward: a VPN is quick to set up and works over infrastructure you already have (an internet connection), while a dedicated connection requires more setup and commitment but delivers steadier, more predictable performance. Many organisations use both — a dedicated connection for primary traffic, with a VPN as a backup path if the dedicated link fails.
VPN services in AWS, Azure and Google Cloud
Each major provider offers managed VPN services rather than expecting you to run your own VPN software on a server. AWS offers Site-to-Site VPN for network-to-network connections and Client VPN for individual remote access. Microsoft Azure offers VPN Gateway, which handles both site-to-site and point-to-site (individual client) scenarios. Google Cloud offers Cloud VPN. All three handle the encryption and tunnel management for you, and all three integrate with the provider’s own virtual network (VPC or VNet).
The security value here connects directly to encryption in transit — the same principle covered in our explainer on encryption in the cloud, applied specifically to data moving across a network rather than data sitting at rest.
Where VPNs appear in certification study
Networking is one of the most heavily tested areas at associate level, and VPN concepts sit squarely inside it. The AWS Solutions Architect Associate and CloudOps Engineer Associate exams both expect you to know when a VPN connection is the right choice for connecting networks, and how it compares to alternatives like Direct Connect. On Azure, the AZ-104 Administrator Associate exam includes VPN Gateway as part of its networking domain. Treat this article as the conceptual grounding, and use the networking lessons in our revision sections for exam-level detail on configuring each provider’s specific service.
Original practice questions, timed mock exams and revision notes. No card, nothing to pay.
Questions, answered
Get the study material as it lands
Occasional email when we publish a new certification, guide or set of practice questions. No spam, unsubscribe in one click.