VPN(虚拟专用网 )是专用网络在公共网络 (如 In-ternet)上的扩展。对于跨越 Internet的大型企业网络而言 ,VPN可以用来建立端到端的安全通信。但是如果企业内部的各部门之间需要通过 Internet进行安全通信 ,将会产生一些新的问题 ,如包传送效率低 ,不支持非对称 VPN连接等。本文首先分析了 VPN在多层子网环境中的缺陷 ,然后提出一种分布式 VPN模型。这种模型实现了网络包高效传送 ,用户认证和资源存取控制功能 VPNs (Virtual Private Networks) are extensions of private networks on public networks such as In-ternet. For large corporate networks that span the Internet, VPNs can be used to establish end-to-end secure communications. However, if various departments within the enterprise need to communicate securely through the Internet, some new problems will arise, such as inefficient packet delivery and non-symmetric VPN connections. This paper first analyzes the shortcomings of VPN in multi-layer subnet environment and then proposes a distributed VPN model. This model enables efficient delivery of network packets, user authentication, and resource access control