What Is a VPN Concentrator? How It Works and Who Needs One

HidVPN earns a commission if you buy through some of the links on this page. It doesn’t change what we write. Our affiliate disclosure.

So what is a VPN concentrator?

A VPN concentrator is a networking device that handles a large number of VPN connections into one network. Think of it as the front door of a company network for anyone who isn’t in the office: home workers, people travelling, contractors and whole branch offices all connect to it over the internet, and it lets each of them in through their own encrypted tunnel.

A normal VPN connection is one tunnel between your device and one server. A concentrator is built to sit at the other end of many tunnels at once, which is where the name comes from: it “concentrates” them in one place. It can be a dedicated hardware appliance, a feature of a firewall or router, or a virtual machine in the cloud.

How a VPN concentrator works

Every remote connection goes through the same few steps, and the concentrator handles each of them. If you’ve read our guide to how a VPN works, this is the same process seen from the company’s side.

1. Accepts the connection. A remote user’s VPN client, or a branch office’s router, contacts the concentrator’s public address on the internet.
2. Checks who it is. The concentrator verifies the user or device, usually with a username and password plus a second factor, a certificate, or both. Many companies connect it to their existing login system so the same account works everywhere.
3. Builds the tunnel. Both sides agree on encryption keys and a protocol, most often IPsec (with IKEv2) or an SSL/TLS-based VPN. Our VPN protocols guide explains the differences.
4. Gives the user an inside address. The remote device gets an IP address from the company’s internal range, so internal systems treat it like a computer in the office.
5. Decrypts and forwards. Traffic arrives encrypted, the concentrator decrypts it and forwards it to the file server, email system or app it was meant for. Replies go back the same way, encrypted again.
6. Applies the rules. The concentrator decides what each user may reach. A contractor might see only one app, while the IT team sees everything. It also logs connections for the company’s security team.

The point of doing this in one place is scale and control. Encrypting and decrypting traffic for hundreds of people takes a lot of processing power, so concentrators are sized for it, often with dedicated encryption hardware. And because every remote connection passes through one device, the company can apply one set of rules and one set of logs instead of managing access on each server separately.

Remote access and site-to-site: the two jobs it does

Concentrators handle two kinds of connection, and most handle both.

	Remote access VPN	Site-to-site VPN
Who connects	Individual people: home workers, travellers, contractors	Whole offices: a branch, a warehouse, a shop
What runs the other end	A VPN app on the person’s laptop or phone	A router or firewall at the branch
When the tunnel is up	When the person switches the VPN on	All the time, in the background
What staff notice	They open the company VPN app and sign in	Nothing. The branch network reaches head office on its own

In a site-to-site setup, the staff at the branch don’t run any VPN app. Their office router sends traffic for head-office systems through a permanent tunnel to the concentrator. Cisco Meraki’s documentation describes this kind of setup: a Meraki MX appliance in “VPN concentrator mode” sits in the data centre, branch MX devices send encrypted traffic to it, and the concentrator decrypts it and forwards the original packets into the data centre network (Meraki VPN Concentrator Deployment Guide). Meraki recommends a “one-armed” setup, with the concentrator behind the company’s edge firewall rather than sitting directly on the internet.

Concentrator vs VPN server vs VPN router

These terms overlap, which is why the question comes up so often in networking courses and forums. The difference is mostly about scale and where the device sits.

• VPN server: any computer or service that ends VPN tunnels. It can handle one connection or thousands. A concentrator is a VPN server built for a very large number of connections.
• VPN router: a router with VPN support. A small office router might connect to head office as a site-to-site client, or let a handful of staff dial in. It’s fine for a few connections, but it isn’t built for hundreds.
• VPN concentrator: sized and managed for many users and many sites at once, usually with central login checks, access rules per user, logging and the option to run two units for failover.
• Firewall with VPN features: today this is where most concentrator jobs live. Business firewalls from vendors such as Cisco, Fortinet and Palo Alto Networks include remote access and site-to-site VPN, so one box does both jobs.

A VPN concentrator also isn’t the same thing as a proxy. A proxy forwards your traffic for you, but a concentrator ends an encrypted tunnel and puts you inside a private network.

Are VPN concentrators still used?

Yes, but usually not as a separate box with “concentrator” on the label. The best-known dedicated units, such as Cisco’s VPN 3000 Series, date from the early 2000s, when remote access needed its own hardware. You’ll still meet the term in IT certification courses such as CompTIA Network+ and Security+, which is one reason so many people search for it.

Three things changed how the job is done:

• Firewalls took it over. Most companies now run remote access VPN on the firewall they already have at the edge of the network.
• It moved into the cloud. In November 2025, AWS launched a Site-to-Site VPN Concentrator. According to AWS, it lets up to 100 low-bandwidth sites (under 100 Mbps each) connect through a single attachment to AWS Transit Gateway, and it’s aimed at companies with 25 or more remote sites. Before that, customers had to run and manage their own virtual VPN appliances in AWS for the same job (AWS announcement, 19 November 2025).
• Some companies are replacing it. “Zero trust” access tools connect each user to one specific app instead of placing them inside the whole network. Many organisations run both side by side.

So the device is less visible, but the job is still there: something has to accept all those encrypted connections and decide who gets in.

Why attackers go after concentrators

A concentrator has to be reachable from the internet, and it guards the way into the company network. That combination makes it one of the most attacked devices a company owns.

In September 2021, the US National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) published joint guidance on choosing and hardening remote access VPNs. They warned that because VPN servers are entry points into protected networks, they’re attractive to attackers, and that exploiting them can lead to stolen credentials, remote code execution and access to sensitive data such as configuration files and keys.

The two agencies advised organisations to choose standards-based VPN products over proprietary ones (CISA and NSA, 28 September 2021).

A real case: Ivanti Connect Secure, January 2024. Two vulnerabilities in Ivanti’s Connect Secure and Policy Secure gateways, CVE-2023-46805 and CVE-2024-21887, were exploited by several groups. CISA issued Emergency Directive 24-01, requiring US federal civilian agencies to apply Ivanti’s mitigations immediately, and described the flaws as “significant, unacceptable risks”. CISA warned they could allow attackers to move around inside a network, steal data and keep long-term access (CISA Emergency Directive 24-01).

For anyone who runs one: patch the concentrator as soon as the vendor releases a security fix, require a second factor for every login, turn off features and protocols you don’t use, and watch its logs. Of all the systems in a company network, this is the one where a slow update costs the most.

How this relates to the VPN app on your phone

Consumer VPN services do the same job at a much bigger scale. When you connect the NordVPN or PureVPN app, your device builds a tunnel to one of the provider’s servers, and that server ends tunnels for a very large number of customers at once. In that sense, every server in a consumer VPN network does what a concentrator does.

The difference is what happens after the tunnel ends:

• A company concentrator lets you into a private network: the file server, the email system, the internal apps. Your internet traffic may or may not go through it, depending on how the company has set up split tunneling.
• A consumer VPN server sends you out to the public internet with the server’s IP address instead of yours. It hides your traffic from the local network and your internet provider (here’s what your internet provider can see without one), but it doesn’t give you access to any private network.

The same safety habits apply to both. A kill switch stops traffic when the tunnel drops, and a DNS leak test confirms your lookups stay inside it.

Do you need a VPN concentrator?

At home: no. A concentrator solves a business problem: letting many outside people into one private network. For your own privacy on public Wi-Fi or at home, a VPN app on each device does the job. If you want everything in the house covered, including a smart TV or games console, set the VPN up on your router instead. Our guide to whether you need a VPN at all is a good starting point.

In a small business: probably not a separate one. If a handful of staff need to reach the office, the VPN feature in a business-grade router or firewall is usually enough. Look for one that supports IKEv2 or another standard protocol and a second login factor, and that still gets security updates.

In a larger organisation: it’s already there, whether it’s called a concentrator, a remote access gateway, a firewall VPN or a cloud VPN service. The questions that matter are how many people it handles at once, whether it requires a second factor, and how quickly it gets patched.

VPN concentrator questions

What is a VPN concentrator in simple terms?

It’s the device at a company that many VPN connections plug into at once. It checks who each person is, sets up their encrypted tunnel and lets them into the company network.

Is a VPN concentrator the same as a VPN server?

A concentrator is a type of VPN server, built to handle a large number of connections at once, with central login checks and access rules. Every concentrator is a VPN server, but a small VPN server isn’t a concentrator.

Are VPN concentrators still used?

Yes. Separate concentrator boxes are rarer, but the job is now done by business firewalls, routers and cloud services. AWS added a Site-to-Site VPN Concentrator in November 2025.

What is the difference between a VPN concentrator and a VPN router?

A VPN router handles a few connections, for example one branch office or a few staff. A concentrator handles hundreds or thousands, with per-user rules, logging and failover.

Can a VPN concentrator be software?

Yes. Many run as virtual machines or cloud services. Meraki, for example, offers virtual MX appliances that can run in concentrator mode in the cloud.

Do I need a VPN concentrator for my home network?

No. A VPN app on your devices, or a VPN on your router, covers personal use. Concentrators are for organisations that need to let many outside users into one private network.

One device, every tunnel: what to remember

A VPN concentrator is the part of a company network that accepts everyone’s VPN connections at once: it checks who you are, builds your tunnel and lets you in. The separate box has mostly disappeared into firewalls and cloud services, but the job hasn’t, and because it faces the internet it needs fast patching and a second login factor.

For personal use you need a VPN service, not a concentrator. If you’re choosing one, compare them on our VPN comparison table or read our NordVPN review (one of the four VPNs we’ve tested ourselves, see how we test). See NordVPN’s current plans · See PureVPN’s current plans · See FastestVPN’s current plans. Prices change often, so check the current plan before you buy. Our VPN pricing comparison lists all 17 providers side by side.