What is a VPN gateway? How it works and how to choose one

What is a VPN gateway?

A VPN gateway is the central node that connects branch offices, remote workers, and cloud infrastructure to a corporate network. Every VPN tunnel into the corporate network ends at the VPN gateway, which is what “terminating” a tunnel means.

Online traffic travels through each VPN tunnel in encrypted form. The sender — either a remote worker’s device or the VPN gateway of another network — encrypts the data packets. Then the VPN gateway on the corporate network decrypts the incoming packets and encrypts the packets that travel back to the sender.

The VPN gateway also controls who or what can connect. Before opening a tunnel, it authenticates the user or device, usually with a digital certificate or a username and password. After decryption, the VPN gateway routes each packet to the correct device inside the corporate network.

A VPN gateway differs from a default gateway and a standard router. A default gateway is the router that forwards traffic from a local network to other networks and does not need to encrypt traffic. A standard router moves traffic between networks, which is a basic function in computer networking. A standard router is a VPN gateway only if it can also create and terminate VPN tunnels — a function that many business routers and firewalls include.

How does a VPN gateway work?

A VPN gateway works by authenticating the connecting user or device, creating an encrypted VPN tunnel, and routing traffic through that tunnel across the public internet. Establishing a connection through a VPN gateway involves:

1. 1. A connection request. The remote device or the other network’s gateway contacts the VPN gateway at the gateway’s public IP address, which is usually static so that the address never changes.
2. 2. Authentication. The VPN gateway checks the identity of the user or device and confirms that the user or device has permission to connect.
3. 3. Tunnel creation. The VPN gateway and the connecting side agree on encryption keys and open the tunnel.
4. 4. Encrypted transmission. The sender encrypts each data packet and sends the packet through the tunnel over the public internet.
5. 5. Decryption and delivery. The VPN gateway decrypts each packet and routes the packet to the correct device inside the private network.

Some VPN gateways also resolve DNS queries for internal servers and apply access control rules. Encryption and authentication are the two processes that protect each connection.

Encryption and tunneling

A VPN gateway protects data with two techniques that work together — encryption and tunneling.

Encryption converts the contents of a data packet into unreadable code. Only the holder of the correct key can convert that code back into readable data. Most VPN gateways use top-grade encryption algorithms such as AES-256 or ChaCha20.

Tunneling places the encrypted packet inside a new packet, a process also called encapsulation. The original packet carries the private addresses of the sender and of the receiving device inside the private network. The new outer packet carries only the public IP addresses of the two ends of the tunnel. Routers on the public internet read the outer packet to deliver the data and cannot read the packet inside.

Encryption provides confidentiality and integrity. Confidentiality means that a third party who intercepts a packet cannot read the contents. Integrity means that the VPN gateway can detect whether a packet was changed in transit. Each packet carries a check value, and the VPN gateway discards any packet that fails the check.

Authentication and access control

Authentication verifies the identity of the user or device connecting to the VPN gateway, while access control determines what they can access once connected.

A VPN gateway usually authenticates the connecting side with one of three methods:

• Certificates. The connecting device presents a digital certificate, a file issued by the organization that proves the device’s identity. The VPN gateway accepts only certificates from an issuer that the VPN gateway trusts.
• Credentials. The user signs in through a VPN client app with a username and password. The VPN gateway then checks the credentials against a user directory, such as Microsoft Entra ID or a RADIUS server.
• Pre-shared keys. In a site-to-site connection, both gateways hold the same secret key and use that key to confirm each other’s identity.

Multi-factor authentication (MFA) is an optional extra step. With MFA, the user confirms the sign-in with a second proof, such as a code from an authenticator app.

Access control applies after authentication succeeds. The VPN gateway, or a firewall behind the VPN gateway, follows rules that list which servers and applications each user or group can access. An accountant, for example, can access the finance system but not the engineering servers.

Many VPN gateways also give each connected device the address of an internal DNS server, which lets the device find internal servers by name. DNS translates names into IP addresses, which serves a different purpose from the encryption a VPN provides. For a detailed explanation, see the DNS vs. VPN comparison.

VPN gateway protocols

A VPN gateway protocol is a set of rules that determines how the VPN gateway and the device connecting to it authenticate, exchange keys, and encrypt data. Both ends of the VPN tunnel need to use the same protocol, so your options depend on which VPN protocols the gateway supports. The table below compares four common VPN gateway protocols.

Types of VPN gateway connections

The three main VPN gateway connection models are site-to-site, point-to-site, and cloud. A site-to-site connection links two networks, a point-to-site connection links one device to a network, and a cloud connection links resources hosted in the cloud to another network. Which model an organization chooses comes down to what resources it needs to connect.

Site-to-site

A site-to-site connection links two networks through a VPN gateway at each end — for example, a branch office and a company’s headquarters. Devices on either network don’t need VPN software because the gateways create the encrypted connection between the networks. The tunnel of a site-to-site VPN usually stays open permanently. Organizations with many branch offices can use a dynamic multipoint VPN, which lets branch gateways open tunnels to each other when needed.

Point-to-site (remote access)

A point-to-site connection links one device to a private network. The user starts the connection from a VPN client app on a laptop or phone, and the VPN gateway authenticates that user. Point-to-site is the model behind a remote access VPN, which employees use to access company resources from home or over public Wi-Fi. The tunnel exists only while the user stays connected.

Cloud and VNet-to-VNet

A cloud VPN gateway is a VPN gateway that a cloud provider runs as a service. A cloud VPN connects resources hosted in the cloud to a data center in the organization’s own building, with a cloud VPN gateway at one end and the organization’s gateway at the other. A VNet-to-VNet connection links two virtual networks inside the cloud, with a cloud VPN gateway at each end. “VNet” is Microsoft Azure’s name for a virtual network, and Amazon Web Services (AWS) calls the same concept a virtual private cloud (VPC). Azure VPN Gateway and AWS Site-to-Site VPN are two examples of cloud VPN gateway services.

VPN gateway device options: Hardware vs. cloud

A VPN gateway runs either on a physical device or as a service in the cloud. A hardware VPN gateway is a router or dedicated appliance that an organization buys and installs in the organization’s building. A cloud VPN gateway is software that a cloud provider runs and bills by the hour. Hardware suits offices with a local network, and a cloud gateway suits organizations whose servers already run in the cloud.

Hardware VPN gateway devices and routers

A hardware VPN gateway device is a physical unit that connects a local network to the internet and terminates VPN tunnels. A VPN gateway router combines ordinary routing with VPN functions, while a dedicated appliance provides VPN and firewall functions. You pay upfront for the VPN hardware and then manage setup, updates, and repairs yourself.

Cloud and virtual VPN gateways

A cloud VPN gateway, also called a virtual VPN gateway, is a VPN gateway that runs as software in a cloud provider’s data center. The customer creates the gateway in the provider’s web console without installing any physical hardware. The provider maintains the servers, and the customer pays an hourly fee plus charges for transferred data. A cloud VPN gateway serves only the networks hosted with that provider, so an office that connects to the cloud still needs a gateway device of the office’s own at the other end of the tunnel.

Battle of the gateways: Finding the right VPN gateway for your cloud infrastructure

Microsoft’s Azure VPN Gateway and Amazon’s AWS Site-to-Site VPN are two major cloud VPN gateway services. Both connect an organization’s network to the provider’s cloud through IPsec tunnels. The two differ in how capacity is sold. Azure VPN Gateway offers tiers of up to 10 Gbps per gateway, while AWS Site-to-Site VPN provides two tunnels per connection at up to 1.25 Gbps each.

Azure VPN gateway: Core features and SKUs

Azure VPN Gateway is Microsoft’s cloud VPN gateway service for Azure virtual networks. Azure VPN Gateway supports site-to-site, point-to-site, and VNet-to-VNet connections. Microsoft sells the service in tiers called SKUs, and each SKU sets the throughput and the number of connections. Microsoft recommends the zone-redundant SKUs, marked “AZ,” for all new gateways. A zone-redundant gateway runs across several data centers in one region to keep the gateway available if one data center fails.

SKU figures sourced from Microsoft Learn on October 8, 2026. Microsoft states that the Basic SKU is for testing only and that throughput figures are benchmarks, not guarantees.

Azure ExpressRoute vs. Azure VPN gateway

Azure ExpressRoute is a Microsoft service that connects an organization’s network to Azure over a private line, which a network provider such as a telecom company installs. Azure VPN Gateway makes the same connection with encrypted traffic over the public internet. ExpressRoute suits large workloads that cannot tolerate interruptions, and Azure VPN Gateway suits lighter traffic. This is how the two compare:

AWS VPN gateway overview

The AWS VPN gateway is called a virtual private gateway and is part of the AWS Site-to-Site VPN service. A virtual private gateway attaches to one VPC and terminates IPsec tunnels from the organization’s gateway device, which AWS calls a customer gateway device. Every AWS Site-to-Site VPN connection includes two tunnels of up to 1.25 Gbps each, so traffic can continue through the second tunnel if the first tunnel fails. Remote employees connect through a separate service — AWS Client VPN — which uses an OpenVPN-based client.

AWS figures sourced from the AWS Site-to-Site VPN and AWS Client VPN documentation on October 8, 2026.

Brume 2 and Brume 3: Hardware VPN gateway alternatives

The Brume 2 VPN security gateway and the Brume 3 high-speed VPN security gateway are small wired hardware gateways from GL.iNet. Both devices suit a home office or small office that needs a VPN gateway for a local network and has no servers in Azure or AWS. Both devices run WireGuard® and OpenVPN and can work as a VPN server and a VPN client. The Brume 2 lists WireGuard speeds of up to 355 Mbps, and the Brume 3 lists up to 1,100 Mbps. A Brume device cannot replace Azure VPN Gateway or AWS Site-to-Site VPN for networks hosted in those clouds.

Speed figures sourced from GL.iNet’s product pages on October 8, 2026. GL.iNet measured the speeds on a local network.

VPN gateway vs. consumer VPN

A VPN gateway is network infrastructure that connects authorized users and networks to a private network, such as a company’s internal servers. A consumer VPN encrypts traffic between one person’s device and a VPN server, and the traffic continues from that server to the public internet. Both use encrypted tunnels, but for different purposes.

For example, a company’s IT team might set up a VPN gateway so an accountant working from home can securely access the company’s finance system. An organization that needs to connect users or networks to private resources needs a VPN gateway. A consumer VPN is for people who want more privacy when using the internet on a personal device.

NordVPN is one example of a consumer VPN that gives internet users more privacy and security online. Privacy online is a right, and a consumer VPN helps you exercise that right in two ways. 

First, a consumer VPN encrypts your online traffic, which means that your internet provider or the operator of a public Wi-Fi network cannot read what you do online. Second, a consumer VPN changes your IP address, so websites see the VPN server’s IP address in place of your own. Encrypted traffic and a changed IP address are among the main benefits of a VPN for everyday internet use.

Which one do you need?

You need a consumer VPN such as NordVPN if you want more privacy and security on your personal device. A VPN gateway, on the other hand, is designed to connect networks or give users access to a private network. If your servers run in the cloud, choose a cloud VPN gateway. If your servers are in an office or your team works remotely, go with a hardware VPN gateway or a managed remote access service. 

The table below shows which one to use and when:

VPN gateway benefits and limitations

The main benefit of a VPN gateway is that it grants controlled, encrypted access to a private network from any location. The main limitation is that an organization has to set up and maintain the VPN gateway, which has a fixed capacity and can potentially fail.

Benefits

A VPN gateway gives an organization more control over who reaches the private network and more security for traffic that crosses the public internet. In practice, the organization gets:

• One place for security rules. IT staff set authentication and access rules on the VPN gateway, and the rules apply to every user and network that connects.

• Remote access to internal resources. Employees can access internal servers and applications from home or over public Wi-Fi, and the organization does not have to expose those resources directly to the public internet.

• Protection for data in transit. Traffic crosses the public internet in encrypted form, so a third party who may intercept the traffic cannot read the contents.

Limitations

A VPN gateway needs skilled setup and regular maintenance, and every VPN gateway has a capacity limit. An organization that runs a VPN gateway has to plan for:

• Setup and expansion work. Each new site or tunnel needs configuration at both ends, and a configuration mistake can block traffic.

• Fixed capacity. The hardware or the cloud tier sets a maximum throughput, and connections slow down when traffic reaches that maximum.

• Costs that rise with capacity. Faster appliances and higher cloud tiers cost more, and cloud providers also charge for transferred data.

• A single point of failure. If a single VPN gateway stops working, every connection through that gateway stops too. A second gateway or a second tunnel reduces the risk.

• Regular updates. A VPN gateway faces the public internet, so attackers can target a VPN gateway that runs outdated software.

A VPN gateway also does not check which websites users visit. A secure web gateway, which is a separate tool that filters web traffic, performs that check.

How to choose and set up a VPN gateway

When choosing a VPN gateway, you first need to decide what type of connection your organization needs. Then compare the available options based on capacity, authentication methods, availability, and cost.

1. Define your use case 

The use case decides the connection type.

• Site-to-site connects an office network to the cloud or to another office.
• Point-to-site gives remote employees secure access to a private network.
• VNet-to-VNet connects cloud networks to each other.

2. Evaluate key criteria 

The key criteria determine which provider and which tier fit the organization.

• Throughput. The VPN gateway has to carry the organization’s peak traffic. For example, Azure VPN Gateway SKUs range from 100 Mbps (Basic) to 10 Gbps (VpnGw5AZ), and AWS Site-to-Site VPN provides up to 1.25 Gbps per tunnel.
• Authentication. The VPN gateway must be compatible with the organization’s existing authentication infrastructure, including certificate-based authentication, RADIUS servers, or Microsoft Entra ID.
• Compliance. The provider has to hold the certifications the organization must meet, such as ISO 27001, SOC 2, HIPAA, or PCI DSS.
• Availability. The connection should continue if one component fails. Providers address this need in different ways, with zone-redundant gateways on Azure and two tunnels per connection on AWS.
• Cost. VPN gateway costs typically include an hourly charge and data transfer fees. Azure and AWS, for example, charge for gateway usage and data transfer.
• Fit with existing systems. The VPN gateway should work with the tools the organization already uses. For instance, Azure VPN Gateway supports Microsoft Entra ID sign-in for point-to-site users, and AWS Site-to-Site VPN can attach to a transit gateway, a hub that links several VPCs.

How to set up Azure VPN gateway

Setting up a site-to-site connection on Azure VPN Gateway takes seven steps, according to the Azure portal. The steps below follow Microsoft’s official tutorial:

1. 1. Create a virtual network with an address range that does not overlap with the office network’s range.
2. 2. Add a subnet named GatewaySubnet with a size of /27 or larger.
3. 3. Create the VPN gateway and choose a SKU, such as VpnGw2AZ. Azure can take 45 minutes or more to create the gateway.
4. 4. Create a local network gateway (the Azure object that represents the office’s VPN device) with the device’s public IP address and the office’s address ranges.
5. 5. Configure the office’s VPN device with a shared key and the public IP addresses of the Azure VPN gateway.
6. 6. Create the connection in Azure with the same shared key.
7. 7. Check the connection status in the Azure portal. A working connection shows “Connected.”

Steps sourced from Microsoft Learn’s site-to-site VPN tutorial on October 8, 2026.

How to set up AWS Site-to-Site VPN

Setting up AWS Site-to-Site VPN requires an existing VPC and involves seven steps, as outlined in AWS’s official getting-started guide:

1. 1. Create a customer gateway (the AWS record that describes the office’s VPN device) with the device’s public IP address.
2. 2. Create a virtual private gateway and attach the gateway to the VPC.
3. 3. Enable route propagation in the VPC’s route table so the VPC learns the routes to the office network.
4. 4. Update the VPC’s security group to allow inbound traffic from the office network.
5. 5. Create the VPN connection between the customer gateway and the virtual private gateway. AWS sets up two tunnels.
6. 6. Download the configuration file for the office’s VPN device from the AWS console.
7. 7. Configure the office’s VPN device with the settings from the file.

AWS notes that the downloaded file is a sample with minimum encryption settings, so the settings should be raised to stronger algorithms before use. The connection is ready when the tunnel status in the AWS console shows “Up.”

Steps sourced from the AWS Site-to-Site VPN getting-started guide on October 8, 2026.

Best practices for Azure and AWS VPN gateways

Azure and AWS both build a backup path into a VPN gateway connection, but the backup works only if the administrator configures both sides of that path. On AWS, that means both tunnels. On Azure, that means both gateway instances. A connection that uses only one can drop during the provider’s maintenance.

Dynamic routing also helps if the VPN device supports Border Gateway Protocol (BGP). With BGP, the two sides exchange routes automatically, and traffic moves to the second tunnel if the first tunnel fails. Logging and monitoring should be enabled from day one, since Azure Monitor and Amazon CloudWatch record tunnel status and can send an alert when a tunnel goes down.

The administrator also needs to think about shared keys and documentation. Shared keys should be long and changed regularly. Microsoft recommends at least 32 characters, and AWS can store the key in AWS Secrets Manager. A written record of the settings helps with troubleshooting and compliance audits.

References

• Microsoft Learn. About Point-to-Site VPN. opens in a new tab
• Amazon Web Services. What is AWS Site-to-Site VPN? opens in a new tab
• WireGuard. Protocol. opens in a new tab
• Microsoft Learn. About gateway SKUs. opens in a new tab
• Microsoft Learn. Connect an on-premises network to Azure. opens in a new tab
• Amazon Web Services. How AWS Site-to-Site VPN works. opens in a new tab
• Amazon Web Services. What is AWS Client VPN? opens in a new tab
• Microsoft Azure. VPN Gateway pricing. opens in a new tab
• Microsoft Learn. Tutorial: Create a site-to-site VPN connection in the Azure portal. opens in a new tab
• Amazon Web Services. Get started with AWS Site-to-Site VPN. opens in a new tab
• Amazon Web Services. AWS VPN pricing. opens in a new tab