VPN tunnels may be established from a wireless user through a wireless network without requiring the wireless user to have a relationship with the wireless network. Instead, the wireless user interfaces with an authentication, authorization, and accounting service on a VPN host network. This allows the wireless user to sign on once to gain admittance to both the wireless network and the VPN host network. The VPN host network is able to establish accounts on various wireless network providers to alleviate the need for wireless users to have individual accounts with the wireless providers. Additionally, a wireless access point on the wireless network serves as a VPN gateway to interface between an encrypted session on the wireless network and a VPN tunnel formed between the wireless access point and the VPN host network. This allows the wireless access device to participate in a VPN tunnel without instantiating a VPN client.