The problem in concrete terms
You're on coffee-shop Wi-Fi. Your home server lives at 192.168.1.11 behind your router's NAT. From the coffee shop, you can't reach a 192.168.x.x address — the routing tables of the wider internet have no path to your private subnet. And even if you set up port forwarding, the coffee-shop network is shared with strangers and unencrypted.
What a VPN actually solves
A VPN creates an encrypted tunnel between your device and your network. Once the tunnel is up, it's as if you were physically present on the home/office LAN:
- Reach private IPs (192.168.x.x, 10.x.x.x) from anywhere.
- All tunneled traffic is encrypted — public Wi-Fi can't read it.
- No router port forwarding needed.
- Devices on the VPN can reach each other regardless of which network they're physically on.
Three flavors of VPN
| Type | Examples | Best for |
|---|---|---|
| Site-to-site | WireGuard, IPsec | Connecting two networks (offices, branches) |
| Remote access | WireGuard, OpenVPN | One device joining a network |
| Mesh | Tailscale, ZeroTier, Nebula | Every device speaks to every device, anywhere |
For a personal fleet, mesh wins almost always — it gives you the "reach any of my machines from any other" property without configuring per-pair tunnels.