> Which of course is completely untrue. You still want VPNs to connect sites or even client/network and any security expert worth their salt will surely recomme

> Which of course is completely untrue. You still want VPNs to connect sites or even client/network and any security expert worth their salt will surely recommend you to have layered security. Opening up your internal network to the internet and rely on every app to do security correctly is a ridiculously bad strategy. Having done FedRAMP and also running Tor servers, I'm also at the conclusion that using IP in any sort of rules is a bad practice. You should be identifying/verifying/authorizing/logging the connection regardless how it came to you. Consistently doing that means you now can control user access at a chokepoint (usually an IdP or similar token passing credentialled login). If you have a malicious entry, you do not want lateral transfer to end up hitting less secure stuff on the network because of implicit network trust. Zero-Trust is about removing those implicit things. And if everything has service-level IdP token checks, not even replay attacks will work. As a malicious hacker, you're stuck there. Less scope of damage. Same with Tor. For anyone running a Tor client or operating a Onionserver, all connections are actually an IPv6 overlay with routers that only support TCP (not UDP/ICMP). And since those absolutely will be randomized every 10m on average, you absolutely must verify the connection AND NOT the source/destination.