Hack the Route Start free Open app Encryption and trust
Clientless VPN
Remote access through a web portal in the browser, over HTTPS, with nothing installed and no route into the network.
The user opens the VPN gateway's portal over HTTPS, logs in (usually with MFA) and reaches the internal applications it publishes from the browser: web pages, file shares, sometimes a remote desktop drawn in the page. The gateway works as a reverse proxy: it fetches each internal page itself and returns it inside the user's TLS session, rewriting its links to lead back through the portal. Nothing is routed: the device gets no tunnel address and no route into the network, only the listed applications, which suits contractors and unmanaged or borrowed computers.
A full-client VPN (an installed agent: IPsec, WireGuard or an SSL/TLS VPN client) puts the device on the network with an address from the pool, so every protocol works, split or full tunnel. An SSL VPN client and a clientless portal both ride TLS on TCP 443; what differs is whether an agent or the browser carries the traffic, and so how much of the network the device reaches.