Virtual Private Network (VPN)
Originally, the term Virtual Private Network (VPN) referred to a private network that is composed of local area networks (LAN), for example at the branch offices of a company, which is not directly connected to the public Internet.
The devices in the same LAN segment can directly communicate with each
other. For example, many network printers work like that: a
workstation joe can connect to a printer named a3-laser. If the
traffic is being routed between the LANs of different offices, a
particular printer or server could be directly accessible from other
offices.
Assuming that a company is registered in the Internet DNS
as example.com and its branch offices as helsinki.example.com and
stockholm.example.com, the fully qualified domain name of our
printer could be a3-laser.stockholm.example.com and that of the
workstation could be joe.stockholm.example.com. Thanks to the
network routing, also the workstation jane.helsinki.example.com
could directly send a print job to a device that is located in another
city.
It would be scary if a random user of Internet could knock on
a3-laser.stockholm.example.com and search for a neat security hole
that would allow large pictures to be printed out to annoy the people
at the office. Or worse, allow the printer to be used for a network
attack that the company could end up being liable for. However,
remote and mobile workers must be able to connect to the company
network.
VPN Gateway
A suitable solution is to connect all sites (both fixed office locations and remote or mobile work sites) to a virtual private network via a VPN gateway that relies on TLS certificates.
The sites of the network can have a private name space of domain names
and IP addresses, which is not routed to the Internet. Internal
addresses, such as a3-laser.tallinn.example.com, need not be visible
in the Internet.
Usability and security sometimes conflict with each other. For
instance, access to the email boxes of employees or
contractors imap.example.com may be restricted to the virtual
private network, or they may be made accessible from the public
Internet, using a strict TLS configuration.
Public Addresses
Some particular services, such as
www.example.com(the company home page) andvpn.example.com(the VPN gateway that connects the sites) are in the public domain name system and connected to a public IP address.