​
Overview

Five blocks on one screen, covering three genuinely different jobs. Knowing which block you want saves most of the confusion here.
Navigation: Networking → VPC → click a VPC → VPN Connections.

​
Which block do you want?

All three need a VPN gateway on this VPC first.

​
Connect to another VPC

A banner offering Connect VPC, which opens the Fabric connection flow.
The button relabels itself to Another Zone required when no eligible peer exists, and the guidance line above says what’s missing. Fabric links go between VPCs in different zones — two VPCs in the same zone are not eligible peers.

​
Managed Fabric connections

Links Fabric maintains for you — “Automated bidirectional VPN links managed by Networking → Fabric.” Retry appears on failed links; disconnect on completed or failed ones.
Connecting is a normal intermediate state, not a fault. A Fabric link is two tunnels, one per side, and it reports Connecting until both come up. Give it a minute before retrying — a retry restarts the whole build.
These rows are managed. Don’t reach around them: deleting the underlying VPN gateway breaks the link without Fabric noticing, and you get a connection that reports Connected while carrying no traffic. Always disconnect from Fabric or from this list.

​
Site-to-Site Connections

Manual tunnels to a network you run yourself. Add Connection asks for three things: Row actions are Reset and Delete.
Passive means this side waits rather than initiating. Use it when the far end is behind NAT or has a dynamic address, so it must be the one to dial out. If both sides are passive the tunnel never comes up, which is a genuinely easy mistake to make and produces no error — just a tunnel that stays down.
Reset has no confirmation. It drops and re-establishes the tunnel the moment you click it, interrupting everything crossing it. Delete does ask.The two icons sit next to each other, so the destructive-looking one is the safe one. Read before you click.
The crypto settings live on the customer gateway, not on the connection. When a tunnel won’t come up, that’s where the mismatch almost always is — IKE version, encryption, hash, DH group and lifetime all have to match the far end exactly.

​
Remote Access VPN

For individual people rather than site-to-site — “Give your team secure VPN access to this VPC’s private network from any device — no client software required.” Enable it by choosing a public IP. Once on you get:
The pre-shared key is shared by every VPN user — it’s a property of the VPN, not of a person. Anyone holding the key plus a valid VPN user account can connect.So revoking one person’s access properly means deleting their user and rotating the key, which forces everyone to reconfigure. Plan for that before handing the key to a contractor.
Disabling asks: “Disable Remote Access VPN? All users will lose access immediately.” There is no grace period and no drain — sessions drop.

​
VPN Users

Accounts allowed to use remote access. Add with a Username and Password inline; remove with the delete icon on hover.
One user per person, never a shared account. This list is your only record of who can connect — a shared login makes both revocation and attribution impossible, and there’s nothing else to reconstruct it from.
VPN users are separate from console users. Deleting someone from Users does not remove their VPN access, and vice versa. Offboarding means both lists.

​
Worked example: give a new engineer access to private machines

1

Confirm the VPC has a VPN gateway

VPN Gateway. Remote access needs a public IP to terminate on.
2

Enable Remote Access VPN if it is off

Choose a public IP. Prefer one that isn’t doing anything else.
3

Add a VPN user for that person

Their own username. Set a real password — this pairs with a shared key, so the password is the only thing unique to them.
4

Send them the server address and their credentials

And the platform steps from How to connect. Send the pre-shared key separately from the password, over a different channel.
5

Check the firewall policy allows what they need

Remote access puts them on the private network; the tier’s firewall policy still decides what they can reach. A working VPN with nothing reachable behind it looks like a broken VPN.
6

Note the access in Comments

Who has VPN access and why, in Comments. Access nobody remembers granting is access nobody revokes.

Fabric

Managed links between VPCs.

Customer Gateways

The far end of a site-to-site tunnel.

VPN Gateway

What all three kinds are built on.

Site-to-Site VPN

The account-wide view of tunnels.