What is a VPN gateway and how should you secure one?

A VPN gateway is the device or service that ends encrypted tunnels at the edge of a network. Remote users or other sites connect to it, and it passes their traffic onward. Because it faces the internet and holds the keys to your network, it needs prompt patching, strict access and good logging.

What does it do?

RFC 4301, the IPsec architecture, calls this role a security gateway: an intermediate system implementing IPsec, for example a firewall or router that has been IPsec-enabled. The RFC describes three connection shapes: between a pair of hosts, between a pair of security gateways, and between a gateway and a host. The last is the remote-access case, where a laptop connects to the company gateway. The second joins two offices.

NIST SP 800-77 Revision 1, the guide to IPsec VPNs, covers how organisations can use IPsec and the Internet Key Exchange to protect traffic, and it also describes alternatives to IPsec and when each fits. Not every VPN gateway uses IPsec, but the gateway role is the same.

Why is it a favourite target?

It is reachable from anywhere, it handles authentication, and a foothold on it leads inside. CISA's directive on end-of-support edge devices, BOD 26-02, says edge devices are attractive because of "their extensive reach into an organization's network and integrations with identity management systems." The directive lists load balancers and firewalls among edge devices, and the same reasoning covers a VPN gateway.

What are the common mistakes?

Delayed patches. An unpatched gateway turns a published flaw into an open door.

Password-only login. A stolen password then equals network access.

Wide tunnels. Once connected, a user reaches the whole network. Few users need that.

Exposed admin page. The management interface should not face the internet.

Silent logs. If connection logs are not kept and watched, a stolen credential is hard to spot.

Unsupported hardware. Gateway hardware that has reached end of support gets no fixes.

What does a constructed review find?

An IT manager at a 150-person firm audits the VPN. The gateway accepts passwords alone. Every user lands on one flat network. The management page answers on the public address. Three changes close most of it: add a second factor, give each group a route to only the systems it needs, and restrict management to an internal address.

NIST's zero trust architecture, SP 800-207, describes the broader direction: no implicit trust based on network location. A VPN gives network location. It should be one control, with identity and device checks behind it.

What about high availability?

A single gateway is a single point of failure for remote work. Many organisations run two, in an active-active or active-passive pair, so one can be patched while the other serves users. That also solves a common reason for delayed patches: nobody wants downtime. If you run a pair, keep their configurations in sync and test failover on a schedule. If you use a hosted gateway, ask how the provider handles patching and what notice you get before maintenance.

How to check or apply this

1. Find every VPN gateway you run, including ones set up by a former team.
2. Check each for vendor support status and the date of its last update.
3. Require multifactor login for all users.
4. Limit what each group can reach after connecting.
5. Move administration off the public interface.
6. Send connection logs to central storage and alert on logins from unusual places or at odd hours.
7. Plan for replacement before support ends, as BOD 26-02 expects of federal agencies.
8. Test revocation by disabling an account and confirming the session ends.

Quick check

Sources

• RFC 4301, Security Architecture for the Internet Protocol
• NIST SP 800-77 Rev. 1, Guide to IPsec VPNs
• CISA BOD 26-02, Mitigating Risk From End-of-Support Edge Devices
• NIST SP 800-207, Zero Trust Architecture

Last reviewed: 18 October 2026.