I've seen this question pop up a few times, and having run Boundary in a test environment for a few months, I think the core difference is really about *access model*.
A traditional VPN typically gives you network-level access—you join the VPN and can "see" a whole subnet or set of resources. It's like getting a key to the entire office building. Boundary, on the other hand, is designed for *session-level* access to specific hosts and applications. It's more like a smart receptionist who escorts you directly to the one meeting room you need, without letting you wander the hallways.
Here's what that looks like in practice:
- You authenticate once to Boundary (using your existing IdP).
- You request access to, say, a PostgreSQL database or a Kubernetes API server.
- Boundary brokers a temporary, encrypted session *directly* to that single target, without exposing the underlying network. The target only sees a connection from the Boundary worker, not your original IP.
The big wins for me have been:
* **No standing network access** – connections are short-lived and purpose-specific.
* **No client-side network routes** – your local machine isn't on the remote network.
* **Centralized audit trail** – every session is logged with who, what, and when, tied to your identity.
It's not a replacement for a site-to-site VPN, but for granting secure, just-in-time access to internal applications and infrastructure, it feels like a more modern and least-privilege approach.
Ship fast, measure faster.