Classic VPN
With a classic VPN (remote access or site-to-site), a device builds an encrypted tunnel to a central gateway, usually the firewall. It is then logically inside the company network. This is proven and easy to understand, but traffic runs through a central point and access often extends to a whole network segment.
Mesh VPN
A mesh VPN connects devices directly, usually based on WireGuard, with central control for identities and rules. Access is released per device, user or group, for example only to one particular server. NetBird is an open-source solution of this kind.
Comparison
- Access model: classic is network-based, mesh is resource-based and more finely controllable (closer to Zero Trust).
- Performance: mesh uses direct connections when possible and relieves central gateways.
- Setup: mesh VPNs are usually faster to set up, especially with many sites and mobile devices.
- Integration: connection to identity providers and MFA is common in modern mesh solutions.
- Existing technology: firewalls such as Ubiquiti UniFi offer their own VPN functions that suit site coupling well.
Which choice for whom?
For two or three sites with a stable firewall, a classic site-to-site VPN is often enough. For distributed teams, home working and finely graded rights, a mesh VPN is attractive. Both can be combined. In every case MFA, current software and a concept of who may access what are important.