Add more details to the product overview, describe example topologies

### 4.3.1 Product overview

As a holistic product, a Virtual Private Network includes, at minimum, VPN client or server software running in two or more locations which establish a secure encrypted tunnel to communicate. Most typically that involves VPN servers communicating with other VPN servers and/or VPN client software running on one or more endpoints.

As a holistic product, a Virtual Private Network includes, at minimum, VPN client or software running in two or more locations which establish a secure encrypted tunnel to communicate. In addition to software necessary for establishing the communication tunnels, VPN products provide management capabilities to network administrators: user and group management, access control, logging and monitoring.

![A diagram illustrating an offsite device using a VPN client to encrypt traffic and send it through a public network, to a VPN server which decrypts the traffic.](./media/VPN%20diagrams.svg)

### 4.2.2 Architecture

![A diagram illustrating an offsite device using a VPN client to encrypt traffic and send it through a public network, to a VPN server which decrypts the traffic.](./media/VPN%20diagrams.svg)

Virtual Private Networks can differ in topologies used to transmit data and distribute configuration. Two common distinct topologies are hub-and-spoke networks and mesh networks; in practice, networks can use more complex mixed topologies that fall somewhere in between the two extemes.

In a hub-and-spoke network, multiple clients connect to a single VPN server/gateway, which provides both management and routing capabilities to the clients.

![A diagram illustrating a hub-and-spone network.](./media/hubspoke.drawio.png)

In a mesh network, clients and gateways establish direct tunnels between each other. A management server is used to authenticate VPN clients and gateways, and to configure them.

![A diagram illustrating a mesh network.](./media/mesh.drawio.png)

### 4.2.3 VPN client

VPN client is a piece of software responsible for connecting a single endpoint to a private network. It typically uses authentication credentials provided by the end-user to establish secure tunnel(s) to other participant(s) of the network: a VPN server, or other VPN clients and gateways (in case of a mesh network).

After establishing a tunnel, the VPN client changes configuration of the operating system to facilitate connections to the private network - this can include changes to DNS configuration, firewall rules, routing table, etc. This configuration is tailored to the end-user, and is based on a combination of local user preferences and policies configured centrally by the network administrator.

### 4.2.4 VPN server, VPN gateway, VPN concentrator

### 4.2.3 VPN server

A VPN server is responsible for maintaining tunnels with VPN clients, acting as a gateway to the private network for those clients.

TK

### 4.2.5 Management server

### 4.2.4 VPN gateway, VPN concentrator

Management server provides a way for network administrators to control configuration and membership of their network. This can include:

TK

* Identity and authentication: management of users and groups, authentication credentials.

* Access control: policies that permit or deny certain traffic within the network.

* Monitoring and logging: configuration logs, network logs, telemetry used for troubleshooting.

### 4.2.5 VPN client

Management server typically mantains configuration of the whole network, and provides configuration to individual clients as they connect (authentication, address assignment, routes, etc).

TK

In VPNs using a hub-and-spoke topology, management server is often implemented as part of the VPN server.

## 4.4 Use cases