A single request can cross several kinds of networks.

A laptop may send a frame across a home WiFi network, pass traffic through an internet service provider's wide-area network, cross the public internet, and enter a cloud provider's private network. If the user connects through a VPN, the same request may also travel inside an encrypted tunnel.

The terms LAN, WAN, Internet, and VPN describe different aspects of connectivity:

These categories can overlap. A VPN can run across the Internet to connect two LANs, creating a WAN for an organization. Understanding the distinction requires looking at scope, ownership, and whether the network is an underlying transport or a logical overlay.

The path from a client to a service can include all four terms:

The client begins on a LAN. The provider operates a WAN that carries traffic from many customers. The request may then cross networks operated by other organizations before reaching the destination. A private cloud network handles the final part of the route.

No single label describes the complete path. The labels identify particular scopes and relationships within it.

The provider WAN can also be part of the Internet when it exchanges public routes with other networks. The boundaries in the diagram describe administrative and routing roles rather than physically separate systems.

Geographic size is the most familiar distinction, but size alone is insufficient.

A LAN usually covers a bounded site such as a home, office floor, building, or data-center area. A WAN connects networks across sites, cities, regions, or countries. A cloud provider can also operate a WAN inside one metropolitan area because the defining concern is connectivity across separate local networks.

Ownership and administration matter as well. One team or organization usually manages a LAN. A WAN often depends on carrier or cloud-provider infrastructure. The Internet has no single owner. It consists of networks that exchange reachability with one another.

The final distinction is between an underlay and an overlay.

The underlay is the network that carries packets between tunnel endpoints. Ethernet, provider circuits, and the Internet can form an underlay.

An overlay creates logical connectivity on top of that underlay. A VPN is an overlay because it wraps traffic and sends it through another network. Applications can use the virtual connection without seeing every intermediate underlay network.

A Local Area Network, or LAN, connects devices within a limited area under a common administrative boundary.

Common LANs include:

Ethernet and WiFi are common LAN technologies. Ethernet switches forward frames across wired links. WiFi access points connect wireless devices to the local network.

A Typical LAN

Home devices often combine the router, firewall, Ethernet switch, WiFi access point, DHCP server, and NAT gateway in one physical box. The functions remain separate even when one device implements all of them.

Communication Within a LAN

When two devices share the same IP subnet on the same local link, they can exchange link-layer frames without sending the traffic through an external provider.

For IPv4, a sender can use ARP to find the MAC address associated with a local destination IP address. IPv6 uses Neighbor Discovery for local-neighbor resolution. The sender then constructs a frame addressed to that neighbor.

When the destination belongs to another IP network, the sender directs the local frame to a router, usually its default gateway. The router forwards the packet beyond the LAN.

This creates an important boundary:

The sender uses its IP configuration and routes to decide which case applies.

LAN, Subnet, and VLAN

The terms LAN, IP subnet, and VLAN describe related but different concepts.

A LAN describes local connectivity and administrative scope.

An IP subnet defines a range of IP addresses that share a routing boundary.

A VLAN creates a logical Layer 2 segment over switching infrastructure.

Organizations commonly align one VLAN with one IP subnet, but this is a design convention rather than a definition. One physical switching system can carry many VLANs, and a routed LAN can contain several IP subnets.

LAN Characteristics

LANs often provide low latency and high bandwidth because links cover short distances and one organization controls the infrastructure. These are common properties rather than guarantees. Congested WiFi, damaged cables, overloaded switches, or poor configuration can make a LAN slower and less reliable than a well-operated WAN path.

A LAN is also not automatically trusted. An office network can contain unmanaged devices, compromised hosts, guest traffic, and misconfigured services. Access control and encryption remain necessary within local networks.

A Wide Area Network, or WAN, connects networks across separate locations.

An organization with offices in Bengaluru, London, and New York needs more than local switching. Each office can have its own LAN, while WAN connectivity lets devices and services communicate between sites.

A WAN may use:

The organization usually manages routers and policies at its sites, while a carrier or cloud provider manages much of the intermediate infrastructure.

WAN Is Not a Single Technology

WAN describes the role and scope of the connection. It does not require one frame format, routing protocol, or provider product.

A private carrier circuit and an Internet-based site-to-site VPN can both connect the same two offices. They offer different guarantees, costs, security properties, and operational controls, but both provide wide-area connectivity.

Distance and Performance

Physical distance creates propagation delay. Traffic between continents cannot achieve the same round-trip time as traffic within one building, regardless of available bandwidth.

WAN paths can also cross provider queues, congested links, and several administrative boundaries. Packet loss, variable latency, and routing changes are more likely to affect a WAN than a short controlled LAN.

Bandwidth and latency describe different properties. A high-capacity intercontinental link can transfer large amounts of data while still having a noticeable round-trip delay. Adding bandwidth does not remove the time required for signals to travel the distance.

WAN Resilience

A site with one carrier circuit has a single external path. A cable cut, provider outage, or failed edge router can isolate the site.

Redundant WAN designs use multiple links, providers, routers, or physical paths. The design must also route traffic onto the surviving path when a failure occurs. Two circuits that share the same underground conduit can fail together, so logical redundancy does not always provide physical independence.

The Internet is the global network of interconnected IP networks.

Internet service providers, cloud providers, universities, enterprises, mobile carriers, and content delivery networks each operate their own networks. They connect through commercial transit arrangements and direct peering.

Each independently managed routing domain can be represented as an Autonomous System, or AS. Networks exchange information about which IP prefixes they can reach. Routers use that information to move traffic across organizational boundaries.

The Internet has no central router and no single operator that controls every path. Each network manages its own infrastructure and routing policy while cooperating through shared protocols.

Public Reachability

An internet-connected device does not need to accept unsolicited traffic from everyone.

Firewalls, NAT, private addressing, and application access controls determine which traffic can reach a device. A server can use a public IP address while accepting only HTTPS. A laptop can access public services through a NAT gateway without having a directly reachable public address.

Private IPv4 address ranges such as 10.0.0.0/8 and 192.168.0.0/16 are not globally routed on the public Internet. Different organizations can reuse these ranges internally. NAT gateways, proxies, or VPNs connect private networks to other destinations.

IPv6 provides a much larger address space and often gives interfaces globally scoped addresses. A globally scoped address still does not imply unrestricted access. Firewall policy remains separate from addressing.

Internet Is Not the Same as the Web

The web is one application system that uses the Internet. HTTP and HTTPS carry web traffic, while the Internet also carries email, voice and video, remote access, file transfer, gaming, and many custom protocols.

An organization can also operate an intranet, which uses internet protocols for services available only inside the organization. The protocols can be the same as those used by public websites even though routing and access policies keep the service private.

Best-Effort Connectivity

The Internet forwards packets using a best-effort service. It does not promise a fixed route, guaranteed delivery, constant latency, or a minimum bandwidth for an ordinary connection.

Applications and transport protocols handle loss, reordering, timeouts, and retries according to their requirements. Providers can offer service guarantees within controlled networks, but those guarantees do not automatically extend across every public internet path.

A Virtual Private Network, or VPN, creates logical private connectivity over another network.

The network that carries the VPN is the underlay. The private connectivity created by the tunnel is the overlay.

For a remote employee, the underlay may include home WiFi, an ISP WAN, and the public Internet. The overlay behaves like a path into the organization's internal network.

The laptop creates an outer packet addressed to the VPN gateway. Inside it, the VPN carries protected traffic addressed to an internal destination. Internet routers forward the outer packet without needing a route to the private inner address.

At the VPN gateway, the system authenticates the tunnel, removes the outer protection, and forwards the inner packet into the private network.

Security Properties

Common VPN protocols provide:

IPsec, WireGuard, and TLS-based VPNs can provide these properties with different protocol designs.

The term VPN does not guarantee encryption in every product. Some provider services called VPNs provide logical traffic separation without end-to-end encryption. MPLS Layer 3 VPNs are a common example. Security depends on the protocol and configuration, not the label.

Remote-Access VPN

A remote-access VPN connects an individual device to an organization's network. The client authenticates a user or device, creates a virtual network interface, and installs routes for destinations reachable through the tunnel.

The organization can then expose internal APIs, databases, code repositories, and administrative tools without making them publicly reachable.

Site-to-Site VPN

A site-to-site VPN connects entire networks through gateways.

The gateway in one office encrypts traffic for another office's private prefixes and sends it across the underlay. The remote gateway decrypts the packets and forwards them into its LAN. Individual devices can communicate without each one running a VPN client.

Site-to-site VPNs also connect data centers to cloud networks or connect separate cloud environments over the Internet.

Host-to-Host Tunnel

A tunnel can connect two specific systems. This approach can protect traffic between servers or administrative endpoints when a full network-to-network connection is unnecessary.

The term VPN is used less consistently for this case, but the overlay principle remains the same: packets between two logical endpoints travel through an encapsulated path over an underlay.

A VPN client changes routing decisions on the device.

In a full-tunnel configuration, the VPN becomes the path for most or all traffic. Requests to internal services and public websites both travel to the VPN gateway first.

In a split-tunnel configuration, only selected destinations use the VPN. Public internet traffic continues through the local gateway.

A simplified split-tunnel route selection might look like:

The more specific internal routes send corporate traffic through the tunnel, while the default route handles other destinations.

Full tunneling gives the organization a central point for filtering, logging, and egress policy. It also adds path length and gateway load to public internet traffic.

Split tunneling reduces VPN bandwidth use and can provide a shorter route to public services. It requires careful DNS, routing, and endpoint-security design because the device communicates with the private network and local internet at the same time.

Neither mode is universally safer or faster. The appropriate policy depends on access requirements, endpoint controls, compliance rules, traffic volume, and the capacity of the VPN infrastructure.

Establishing a tunnel does not guarantee that applications can reach internal services. The client also needs correct routes and name resolution.

The VPN can install routes for internal IP prefixes. If a required prefix is missing, the client may send private traffic to its ordinary default gateway, where it cannot be routed.

The VPN can also configure DNS servers and search domains for internal names. A company might want:

Public DNS should not need to publish this private mapping. A VPN client can send queries for corp.example to an internal resolver while using a public or local resolver for other names. This arrangement is called split DNS.

Incorrect DNS policy can send internal queries to the public resolver, return the wrong address, or make public names fail while the VPN is active.

VPN encapsulation adds an outer IP header plus tunnel, encryption, and integrity information. The inner packet must share the path's size limit with these additional fields.

If the underlay supports a 1500-byte IP packet and the VPN adds 60 bytes of overhead, an inner 1500-byte packet no longer fits without fragmentation or another size adjustment.

VPN software can lower the virtual interface's MTU, adjust TCP segment sizes, or rely on path MTU discovery. Incorrect size handling often produces an asymmetric symptom: small requests succeed while larger transfers stall or time out.

VPN processing can also add latency and consume CPU for encryption. A distant gateway makes traffic travel farther, particularly in a full-tunnel design.

Cloud providers offer logically isolated networks commonly called Virtual Private Clouds, virtual networks, or VPCs.

A VPC resembles an enterprise private network from the customer's perspective. It has IP ranges, subnets, routes, gateways, and security policies. The provider implements it over shared physical data-center and WAN infrastructure.

A VPC should not be treated as one physical LAN. Its instances may run on different hosts, racks, or availability zones while the provider's network creates logical connectivity between them.

Organizations commonly connect to cloud networks using:

A dedicated circuit provides private wide-area connectivity, but applications may still use TLS. Private routing reduces exposure and changes the path; it does not replace endpoint authentication or application-layer protection.

A LAN or WAN can carry public or private addresses. A VPN can cross either a private carrier network or the public Internet. The Internet can serve as one part of a WAN design.

The categories answer different questions:

Consider a developer working from home and requesting:

The request crosses several network contexts:

If public websites work while the internal API does not, the home LAN and basic Internet connection are probably functioning. The remaining checks include VPN authentication, tunnel state, internal DNS, the installed private route, gateway policy, and reachability inside the corporate network.

This separation makes the failure boundary clearer. "The network is down" does not distinguish a local WiFi problem from an ISP outage, a public routing issue, a failed VPN tunnel, or a missing internal route.

Network type does not define trust.

A device on the same LAN can be hostile. A VPN-connected endpoint can be compromised. A private WAN can carry traffic through provider-managed infrastructure. An internet-facing service can still enforce strong authentication and encryption.

Security controls should follow the sensitivity of the service and the identity of the requester. Useful controls include endpoint authentication, encrypted application protocols, least-privilege authorization, firewalls, segmentation, and monitoring.

A VPN protects traffic only between its tunnel endpoints. After a VPN gateway decrypts a packet, the remaining path needs its own security controls. HTTPS can continue protecting application data from the client to the service even when part of the route already uses a VPN.

A commercial consumer VPN also does not make activity invisible. It moves the first external trust boundary from the local ISP to the VPN provider. Destination services still observe requests, and the VPN provider can observe traffic metadata and any unencrypted content passing through its gateway.

A structured investigation follows the path across network boundaries.

LAN: Confirm interface state, WiFi association or Ethernet link, local addressing, and reachability of the default gateway.

WAN or ISP: Check whether the provider connection is active, whether other destinations work, and whether loss or latency begins after the local gateway.

Internet: Verify public DNS results, routes, destination reachability, and whether a remote provider or public service reports an outage.

VPN: Check tunnel authentication, assigned virtual address, installed routes, internal DNS, encryption state, gateway policy, and MTU behavior.

Destination network: Confirm that the target subnet is routed, security policies allow the traffic, and the service listens on the expected address and port.

The first failed boundary narrows the systems and teams involved. Local link failures belong to the LAN. Provider circuit failures belong to the WAN path. A healthy underlay with an unusable tunnel points to the VPN configuration or private network.

A LAN connects devices in a limited area under common administration. A WAN connects separate local networks over distance or provider infrastructure, the Internet connects independently operated IP networks worldwide, and a VPN creates a logical private overlay across an underlay such as the Internet.

LANs, subnets, and VLANs are related but distinct, and a WAN is a role rather than one technology. Internet reachability does not mean unrestricted access, while a VPN provides encryption only when its protocol and configuration do so.

A single request may cross a LAN, provider WAN, public Internet, VPN tunnel, and cloud private network; identifying each boundary clarifies ownership, routing, performance, security, and failure isolation.