The 4 Main Types of VPN

A personal VPN service connects you to a remote VPN server, which can be anywhere in the world.

This VPN server then acts like a middleman between your device and the online services you want to access.

The personal VPN – sometimes also called a ‘consumer’ or ‘commercial’ VPN – encrypts your connection, hides your identity online, and lets you spoof your geographic location.

A personal VPN service differs from a remote access VPN in that it doesn’t give you access to a private network.

Instead, a personal VPN works by giving you access to the public internet, using an encrypted connection to a server typically located in a data center.

Personal VPNs are what my team and I write about in our VPN reviews, recommendations, and guides.

The most common type of personal VPNs are the subscription services offered by providers such as ExpressVPN, NordVPN, and Private Internet Access, or free services like Windscribe and Proton VPN.

However, just as with remote access VPNs, it is possible to set up your own personal VPN, although it is less common.

There are several reasons to use a personal VPN. Some of the most popular ones include:

• Unblocking geo-restricted content: A personal VPN allows you to stream movies and TV shows from different regions. For instance, connecting to a US-based VPN server allows you to access American Netflix’s extensive content library from anywhere in the world.
• Bypassing censorship: A personal VPN helps you overcome internet restrictions in countries with strict online censorship. Connecting to a VPN server in another country not only allows you to access blocked content but also protects your browsing activity from government surveillance.
• Enhancing internet privacy and performance: Personal VPNs prevent your internet service provider (ISP), governments, hackers, and anyone else from monitoring your online activity. This not only safeguards your privacy but can also prevent ISPs from throttling your connection speeds during high-bandwidth activities like streaming or gaming.

Commercial personal VPNs work the same way whether they’re free or paid: you simply install the provider’s app on your device.

Your provider manages the server network, which typically spans many locations worldwide, either physically, virtually, or both.

Self-managed, or “roll your own”, personal VPNs come in many forms and, like remote access VPNs, require you to spin up your own server.

Unless you rent a Virtual Private Server (VPS) in another country, though, this type won’t let you spoof your location the way a commercial VPN service can.

That said, some DIY setups give you both a remote access and a personal VPN at once.

Here’s how a personal VPN from a service provider works:

1. Install software from your VPN service provider onto your device.

   Personal VPN apps are available on all sorts of devices, including smartphones, streaming devices, and gaming consoles.

   Alternatively, you can install the VPN software on your router to protect all the devices that connect to it.

   The setup process usually just requires a one-time sign-in or an activation code.

2. Connect to a server in your VPN provider’s network.

   Personal VPNs are very straightforward. You just tap connect, and authentication happens automatically between the client and server.

   The tunnel is established in the same way as with a remote access VPN.

   Personal VPNs tend to have large server networks to choose from. If you just want to protect your privacy, connect to a local server for the fastest speeds.

   To unblock streaming content, choose a server in the country where that content is available.

3. Browse the internet as normal.

   While connected, all your internet traffic routes via the remote server you selected.

   Your connection is encrypted, your IP address is replaced with the VPN server’s, and you can access geo-blocked content from other countries.

Collectively, our team has tested hundreds of free and paid personal VPNs since 2016. Currently, our three highest-rated VPNs are ExpressVPN, NordVPN, and Surfshark.

A remote access VPN, sometimes called client-based VPNs or client-to-server VPNs, lets you use the internet to securely connect to a private network, such as your home network or your company’s office network, from another location.

Once installed on your device, a remote access VPN client creates an encrypted tunnel between you and the private network you want to access.

At one end of the scale, big tech companies like Fortinet, Palo Alto, and Cisco all offer sophisticated and expensive software solutions aimed at larger businesses.

At the other, it’s also perfectly possible to set up your own VPN server for free if you have the appropriate hardware to hand.

Of everything I’ve set up, Tailscale was by far the easiest way to build a remote access VPN, and it’s free for individual use. It’s built on top of WireGuard and creates a mesh network across all your devices, so they can reach each other as if they were on the same private network. You can also nominate any device as an exit node, routing all your internet-bound traffic through it.

I like it enough to put it on a Raspberry Pi at my mother’s house, so I can fix issues with her network and devices remotely. What used to be a painful support call over the phone is now a quick, simple job.

Remote access VPNs can be used in different ways, for example:

1. Traveling for work: You can use a remote access VPN to connect securely to your company network on your hotel Wi-Fi. Not only are you able to access all your usual files and software, but the VPN also protects your data from security threats on public networks.
2. Working from home: This type of VPN provides secure access to sensitive company systems that have been locked down by IP address. Your computer simply functions as if it were on the corporate network, with all the data encrypted as it travels across the public internet.
3. Access to personal files: A remote access VPN will allow you to directly access files on any device connected to your home network, such as photos saved to your desktop PC or music and movie files on a home media server, from wherever you are.
4. Securely access networked devices: As well as files, this type of VPN will allow you to securely control and monitor IoT devices on your network while you are away, such as surveillance cameras or smart home systems, which if exposed to the internet can be vulnerable to attack.

EXPERT TIP: While remote access VPNs are very useful, cloud storage might be a more straightforward alternative if all you want to do is to access files remotely. Cloud storage (such as Dropbox or Drive) uses an encrypted browser connection to protect your data, and is much easier to set up than a VPN.

To use a remote access VPN, you typically install client software on your device, or configure your operating system to connect to the VPN. There also needs to be a VPN server at the network end of the connection.

You can connect as many devices and users as you need to.

The client software and VPN server handle the connection between them.

There are many versions of a remote access VPN, but fundamentally you have two choices: pay for a service, or manage it yourself.

If you go the DIY route, it really comes down to how you set up the VPN server that acts as the gateway to your private network. Popular options include:

1. An always-on PC, server, or Raspberry Pi-style device running WireGuard or OpenVPN
2. A flashed router with WireGuard or OpenVPN installed
3. Tailscale on a PC, mobile device, or Raspberry Pi

Alternatively, if you’d rather pay for a managed service, the main types of remote access VPN include:

• Client-to-site VPN
• Cloud VPN
• SSL VPN Portal
• SSL VPN Tunnel
• NordVPN’s Meshnet feature

If you’re setting up remote access for a business, there’s something you should know before you commit: the traditional corporate VPN is rapidly falling out of favor. VPNs that were once the default way to connect remote workers are increasingly one of the most attacked parts of corporate networks.

The 2025 Verizon Data Breach Investigations Report backs this up: edge devices and VPNs were behind 22% of the breaches that started with a software vulnerability, up from just 3% the year before. That’s over a sevenfold jump.

Worse still, only 54% of those flaws were fully patched, and the median fix took 32 days.

The problem isn’t going away. Zscaler’s ThreatLabz 2025 VPN Risk Report found that VPN vulnerabilities grew by over 80% between 2020 and 2025, with roughly 60% rated high or critical.

It’s no surprise, then, that businesses are moving on. Gartner has forecast that at least 70% of new remote-access deployments will be served mainly by Zero Trust Network Access (ZTNA) rather than VPNs, up from under 10% in 2021.

In Zscaler’s own survey, 65% of organizations planned to replace their VPN within the year, and 81% were moving toward a zero trust architecture.

So what makes these alternatives different? Rather than dropping you onto an entire network, ZTNA, Software-Defined Perimeter (SDP), and Secure Access Service Edge (SASE) only let you reach the specific applications you’re cleared to use. That shrinks the attack surface and stops an intruder moving freely across your network if your credentials are stolen.

Let’s be clear, though: this shift is a business concern. If you just want to secure your own connection or reach your home network while you’re away, a traditional remote access VPN is still a perfectly good choice.

Examples of remote access VPNs for business include:

• Access Server by OpenVPN, which is free for up to two simultaneous VPN connections.
• Cisco AnyConnect, which integrates with Cisco’s enterprise security solutions.
• Check Point Harmony SASE (formerly Perimeter 81).
• Check Point Remote Access VPN, which comes as an IPsec Client and an SSL Portal.
• NordLayer, from the same company behind our highly-rated personal VPN service, NordVPN.

Other popular remote access VPN products include FortiClient, Palo Alto GlobalProtect, Ivanti Connect Secure, SonicWall SSL VPN, and Juniper Secure Connect.

To show you what a self-managed remote access VPN looks like in practice, here’s the one we set up for our own team to support hybrid working.

A WireGuard VPN server runs on a Linux box in our office. WireGuard was the logical choice for us: it’s built into Linux, and it’s simpler and faster than OpenVPN.

The client software on our team’s laptops is free and open-source too. We use the official WireGuard client for both Windows and Mac.

This gives the team secure access to our back-end systems and other shared resources whenever they work remotely.

This setup is free, highly secure, and completely in the hands of our own sysadmins.

I should note that any VPN server software that is exposed to the internet requires maintenance. Software updates are issued by vendors, either to add new functionality, or to patch security issues in the software. When maintaining a remote access solution, it’s your responsibility to keep on top of these software updates. VPN servers are heavily targeted by hackers to gain unauthorized access to the networks they sit in front of.

A mobile VPN, also known as an “always-on VPN”, is a better option than a remote access VPN when you’re unlikely to have a stable connection, on the same network, for a whole session.

The key difference is that a mobile VPN connection persists even if you switch Wi-Fi or cellular network, lose signal, or turn your device off for a while.

Mobile VPNs tend to be offered by the same big tech companies that provide standard remote access VPN services.

You should use a mobile VPN if you are constantly on the move and it’s critical that you maintain an uninterrupted connection to a remote private network.

This type of VPN also provides the convenience of a connection that adapts to network changes. For example:

• First responders like firefighters and police officers rely on mobile VPNs to maintain access to critical resources such as vehicle databases, location tracking systems, and emergency dispatch applications as they move throughout their service area.

• Remote professionals in regions with unreliable internet can use a mobile VPN to maintain a secure office connection throughout the workday. This type of VPN avoids the inconvenience of constant re-authentication or the challenge of whitelisting revolving IP addresses.

In day-to-day use, connecting to and using a mobile VPN feels much the same as using a remote access VPN.

The main differences are under the hood: a mobile VPN uses specialized protocols to hold your connection open as you move between networks, whether you’re switching cellular towers or dropping from Wi-Fi to mobile data.

That’s why mobile VPNs typically use UDP-based protocols like IKEv2, which can re-establish a connection quickly without a full VPN handshake when your network changes. It’s also the same resilience that makes UDP-based protocols the default in the mobile apps of personal VPN services, though most of those now use WireGuard rather than IKEv2.

It’s no coincidence that the newest protocol developments tend to reach providers’ mobile apps first.

The same network-switch resilience that makes UDP- and QUIC-based protocols ideal on the move is exactly why features like QUIC obfuscation and post-quantum encryption usually debut on mobile.

Since the basics work just like a remote access VPN, here’s the part that’s unique to mobile VPNs: what happens when you switch networks.

1. Your device switches networks (e.g., from Wi-Fi to cellular), changing its IP address in the process.
2. Your VPN client detects the change.
3. It sends a reconnection request using the unique ID assigned to the session.
4. The VPN gateway validates that session and seamlessly resumes the connection.
5. Even if you switch your device off to save battery, the VPN is still connected when you turn it back on.

Behind the scenes, mobile VPNs work hard to make this seamless, tolerating brief drop-outs, reconnecting with minimal overhead, and compressing data on slow networks, all while trying not to drain your battery.

Many also offer user-facing extras like split tunneling, automatic connection rules based on the network you’re on, and integration with Mobile Device Management (MDM) for business fleets.

Mobile VPN examples include:

• Bittium SafeMove Mobile VPN
• Cisco Mobile VPN
• Ivanti Connect Secure VPN
• Microsoft Always On
• Digi Mobile VPN is specifically designed for first responders.
• Absolute Secure Access, previously known as Netmotion Mobility VPN.
• Radio IP software: enables mobile VPNs across all wireless network technologies.

Site-to-site VPNs connect entire networks in different locations, for example linking the corporate networks of a company’s multiple offices.

Unlike remote access VPNs, which connect individual users to a network, site-to-site VPNs bridge two or more separate local area networks (LANs) over the internet.

This lets offices share resources and communicate as if they were part of the same network, while encryption keeps everything secure.

You can also extend a site-to-site VPN to trusted business partners, giving external companies secure access to parts of your network.

A site-to-site VPN is ideal when you need to connect multiple networks securely, for instance:

• Intranet-based VPN: connects different branches of the same company into a unified private wide area network (WAN). Employees from each location can access shared resources across all branches seamlessly.
• Extranet-based VPN: allows companies to securely share specific resources with external business partners by connecting their respective networks. It’s useful for suppliers, contractors, and collaborative ventures.

There are three main ways to implement a site-to-site VPN:

1. IPsec tunnel.
2. Dynamic Multipoint VPN (DMVPN).
3. Layer 3 VPN (L3VPN).

IPsec tunnel

IPsec tunnels create encrypted pathways between networks, set up through the routers at each connected site. This method is also known as a router-to-router VPN, and it comes in two variants:

1. A route-based IPsec tunnel acts as a virtual wire between networks, letting all traffic pass through.
2. A policy-based IPsec tunnel uses specific rules to control the flow of traffic between IP networks.

Pros	Cons
Widely supported by most firewalls and routers	Point-to-point nature limits scalability
Strong security through encryption	Can become complex to manage in large networks
Relatively simple to implement for small-scale deployments	Speed is limited by internet connection, affecting performance

Dynamic Multipoint VPN (DMVPN)

DMVPN tackles the scalability problem of traditional IPsec tunnels. This Cisco-proprietary technology suits large organizations with many sites, which would otherwise need thousands of individual router-to-router IPsec connections. Instead, DMVPN uses a hub-and-spoke architecture, where:

• Branch sites (spokes) connect to a central location (hub)
• Dynamic IP addressing is supported
• Direct spoke-to-spoke connections are possible with extra configuration

Pros	Cons
Highly scalable for large networks	Vendor-specific (Cisco only)
Supports dynamic addressing	May require specialized expertise to implement and manage
Reduces configuration complexity in hub-and-spoke topologies	Still subject to internet performance limitations

MPLS-based Layer 3 VPN (L3VPN)

The IPsec and DMVPN approaches both sit on top of the internet, so they can’t guarantee consistent performance.

L3VPNs instead operate at the network layer of the OSI model and use Multiprotocol Label Switching (MPLS) to guarantee quality of service across different transport media. These are typically sold by service providers as managed WAN solutions.

Pros	Cons
Guaranteed performance and QoS	Significantly higher cost compared to internet-based VPNs
Traffic prioritization capabilities	Limited flexibility in terms of service changes
Provider-managed infrastructure	Dependency on service provider coverage
Protocol and transport medium agnostic

As with remote access, the multi-site world is shifting too. Many businesses now fold site-to-site connectivity into a broader SD-WAN or SASE setup, which bundles network links and cloud-delivered security into a single managed service, rather than maintaining site-to-site tunnels on their own.

Examples of site-to-site VPN products include:

• OpenVPN Access Server: allows for secure site-to-site connectivity using the OpenVPN protocol.
• Cisco’s Meraki Auto VPN: one of a number of site-to-site VPNs by Cisco, Meraki promises single-click VPN tunnel creation to link compatible devices.
• AWS Site-to-Site VPN: enables secure, scalable connectivity between on-premises data centers and Amazon Virtual Private Cloud (VPC).
• Fortinet Firewall: provides secure site-to-site connectivity with advanced traffic optimization and security features.

The seven protocols above are the established options, but they’re not all the VPN protocols available today.

As governments and networks have gotten better at spotting and blocking VPN traffic, providers have built a new generation of protocols designed to slip past those filters, either obfuscation layers that disguise an existing protocol, or brand-new proprietary ones.

NordWhisper, which NordVPN launched in January 2025, is a good example.

It disguises your VPN traffic as ordinary web browsing, so deep packet inspection struggles to detect and block it, and NordVPN has since made it the default on its obfuscated servers in place of OpenVPN.

Mullvad took a different route, becoming the first major VPN to add QUIC obfuscation to WireGuard, while Proton VPN built its own Stealth protocol, and ExpressVPN and Surfshark created modified versions of OpenVPN.

Worth busting one myth here: not every proprietary protocol is just WireGuard with a new name.

ExpressVPN’s Lightway was built from scratch on the wolfSSL library, rewritten in Rust in 2025 for better memory safety, and supports both TCP and UDP, which vanilla WireGuard doesn’t.

If you regularly connect from somewhere that blocks VPNs, such as a school, an office, or a censored country, these are the protocols to look for.