In some implementations, a computer-implemented method includes establishing, by a network device, a communications connection between the network device and a destination host. The communications connection includes a first Virtual Private Network (VPN)-based sub-connection between the network device and a gateway device configured in a private network; and a second VPN-based sub-connection between the gateway device and a residential endpoint device configured in the private network. Each of the first and second VPN-based sub-connections is implemented using a tunneling protocol that encapsulates packets. The network device communicates with the destination host via the residential endpoint device using the first and second VPN-based sub-connections.