5. HSA VPN tunnel