Editing Virtual private network (section)

===Authentication===
In order to prevent unauthorized users from accessing the VPN, most protocols can be implemented in ways that also enable [[authentication]] of connecting parties. This secures the joined remote network confidentiality, integrity and availability.

Tunnel endpoints can be authenticated in various ways during the VPN access initiation. Authentication can happen immediately on VPN initiation (e.g. by simple whitelisting of endpoint IP address), or very lately after actual tunnels are already active (e.g. with a [[Captive portal|web captive portal]]).

Remote-access VPNs, which are typically user-initiated, may use [[passwords]], [[biometrics]], [[two-factor authentication]], or other [[cryptographic]] methods. People initiating this kind of VPN from unknown arbitrary network locations are also called "road-warriors". In such cases, it is not possible to use originating network properties (e.g. IP addresses) as secure authentication factors, and stronger methods are needed.

Site-to-site VPNs often use passwords ([[Pre-shared key|pre-shared keys]]) or [[digital certificates]]. Depending on the VPN protocol, they may store the key to allow the VPN tunnel to establish automatically, without intervention from the administrator.