Three ways to work across several VPNs without confusion

Two customer tunnels, one laptop, and a browser tab that is still logged in somewhere it should not be. The difficult part of working across several private networks is not connecting; it is knowing which context a window belongs to when you switch. A workspace answers that question: one identity, one set of applications, one resolver policy and one place to look when something resolves wrongly. On a bad day it is the difference between a five-minute fix and a data leak.

Decide whether the work is concurrent

If the answer is no, stop here and use the simplest arrangement available. One approved connection at a time, connected and disconnected through the client that owns the profile, removes an entire class of failures before any of them can occur.

Concurrency is what raises the cost: overlapping prefixes, two resolver policies and two sets of application state all have to be separated deliberately rather than by time.

Write the requirement down honestly, because wanting to avoid a reconnect is not the same as needing both networks at once.

Sequential is the cheapest arrangement

Sequential work needs no extra infrastructure, and its failure mode is a stale session rather than a routing conflict. The discipline is in the handoff: finish the operation, close what holds a connection, disconnect, and confirm the next connection before starting work.

A browser tab or terminal that stays open does not carry its network context with it. Its next request goes wherever the machine now routes, which may be the other customer.

Label profiles by customer rather than by protocol, and keep the credential owner visible in the profile name. A profile called work2 tells nobody anything at the moment of a hurried switch.

The advantage of this arrangement is that it is auditable. At any instant there is one network context, and the log shows when it changed.

A workspace per customer costs isolation

A virtual machine or a remote development environment per customer puts the client, the applications and the names together in one place. Switching becomes a window change instead of a network change, and the two contexts cannot leak into each other through a stray route.

It is not free. You now maintain two or three systems, patch them, and decide where files and credentials live. The virtual machine also reaches the internet through the host, so its outer path is still your laptop's path.

Check that the client and any device-posture policy permit that environment before building the habit around it. A client that refuses to run in a virtual machine is a fact to discover early.

A shared gateway is infrastructure

A separate router carrying selected traffic turns the problem into a network design. It works well when several people need the same customer network, and it fails when someone treats it as a magic box that keeps every customer separate.

One gateway that switches its active tunnel is a single shared context with a queue, not several independent networks. Name who may change it, which sources it serves and what happens when two people need different customers at the same time. Without that answer the gateway becomes a source of outages that nobody owns. It also becomes the place where somebody quietly disables a check to make a deadline.

Write the handoff into a record

The record does not need to be sophisticated; it needs to be specific enough that someone else could follow it. On Linux, a namespace is the technical version of the same idea, with its own interfaces and routing table.

These commands create a namespace, run a command inside it, and show which connections the desktop client currently holds:

sudo ip netns add customer-a
sudo ip netns exec customer-a ip route
nmcli connection show --active

Applications still have to be launched inside the namespace, and the resolver configuration inside it is a separate file. Isolating interfaces does not isolate the clipboard, the SSH agent or a mounted share, and those are the leaks people forget.

Pick the smallest arrangement that preserves the separation you actually need, and keep the transition visible: window title, terminal prompt, profile name and credential owner should all agree before any private request is sent.