A company VPN and a personal VPN are different tools that happen to share a name. The company VPN connects your laptop to the office network so you can reach internal systems, and it is configured and monitored by your employer's IT department. A personal VPN protects your own traffic from the network you are on and from your ISP, and you control it. Both may live on the same laptop, but they should not run at the same time without a plan, and understanding what each one sees prevents both privacy mistakes and support tickets.
What the company VPN does
It creates a tunnel to the employer's network. Depending on how IT set it up, either only traffic to internal systems goes through it (split tunnel) or everything does (full tunnel). In a full-tunnel setup, your employer's gateway sees all your traffic while connected, including personal browsing, and can log or filter it. That is normal and usually stated in the acceptable-use policy. The practical rule: while on the company VPN, treat the laptop as being in the office.
Company VPNs typically use IKEv2, IPsec, SSL VPN clients, or increasingly zero-trust access tools that are not tunnels at all.
What a personal VPN does
It encrypts all the device's traffic to a server you chose, hiding site names and your address from the local network and the ISP. Your employer's gateway is not involved. What it protects and does not is in what is a VPN.
Why running both at once is a problem
Two active tunnels stack: the personal VPN's traffic goes inside the company tunnel or the other way around, depending on which started first and how each sets routes. Results range from "internal systems unreachable" to "personal traffic visible to the employer after all" to "nothing works." Some corporate clients refuse to connect if another VPN is active. The clean approaches:
- Sequential. Personal VPN for everything, disconnect it, connect the company VPN when you need internal systems, disconnect, reconnect the personal one. Simple and predictable.
- Split tunnel on the company side. If IT configured the company VPN to carry only internal traffic, the personal VPN can handle the rest, but only if the personal app is set to exclude the company's address ranges; ask IT for those. This is fiddly and easy to get wrong.
- Two devices. Work laptop on the company VPN, personal device on the personal VPN. The least elegant and the most reliable.
Never assume the two coexist correctly without testing: connect both, open What Is My IP, and check which address appears; then check that an internal system still loads.
Hotel Wi-Fi and coworking spaces
The company VPN protects the path to the office; on a full tunnel it also covers the rest of your traffic while connected. But between sessions, or on a split tunnel, your personal browsing on hotel Wi-Fi is exposed like anyone else's. The routine that works: personal VPN on by default with a kill switch, off only for the duration of a company VPN session. Why hotel networks deserve this is in is public Wi-Fi safe.
Some hotel and conference networks block the ports company VPNs use. If the corporate client will not connect, mobile data or a hotspot usually will; a personal VPN cannot fix a blocked corporate protocol.
Working from abroad
Two separate issues. First, your accounts: banks, email and some work tools flag logins from a new country. A personal VPN server in your home country keeps sessions looking normal; the checklist is in do I need a VPN when traveling. Second, your employer's policy: many companies restrict where work may be done for legal and tax reasons, and a VPN does not change where you physically are. Ask before you go, not after.
What each side sees
| Company VPN (full tunnel) | Company VPN (split) | Personal VPN | |
|---|---|---|---|
| Employer sees personal browsing | yes, while connected | no | no |
| Local network sees site names | no | yes, for non-work traffic | no |
| Internal systems reachable | yes | yes | no |
| Controlled by | IT | IT | you |
Practical rules
- Personal VPN by default, company VPN on demand, never both without testing.
- Do not do personal things on a full-tunnel company VPN; it is the office.
- Do not install a personal VPN on a managed work laptop without checking policy; IT may prohibit it or it may be removed automatically.
- Keep the personal VPN's kill switch on for the gaps between sessions.
404 VPN is a personal VPN: VLESS or WireGuard tunnel, DNS inside it, a kill switch, split tunneling to exclude address ranges where you need to, and servers across Europe, the Americas, Asia and the Middle East for home-country logins from abroad. Get started here.