There are two common implementations for a VPN: Site-to-Site and Client-to-Site.
Site to Site
Some office configurations require sharing information across multiple LANs. Initiating a secure VPN tunnel between two office gateway devices allows sites to share information across the LANs without fearing that outsiders could view the content of the data stream. This site-to-site VPN is a one-to-one VPN tunnel. Two servers or routers set up an encrypted IP tunnel to securely pass packets back and forth over the Internet. The VPN servers create a logical point-to-point connection over the Internet. Routing can be configured on each gateway device to allow packets to route over the VPN link or out the default network link.
Client-to-Site When a client requires access to a site's internal data from outside the network's LAN, the client needs to initiate a client-to-site VPN connection. This will secure a path to the site's LAN, allowing the client to access a private network address. The client-to-site VPN is a many-to-one VPN tunnel. One or more clients can initiate a secure VPN connection to the VPN server, thus securely accessing internal data from an insecure remote location. The client receives an IP address from the server and appears as a member on the server's LAN.VPN can reduce wide area networking costs by eliminating the need for private dedicated connections.