The network designer knows that encrypted data cannot be filtered until it is unencrypted at the VPN server endpoint. For that reason, the location of the VPN server in the network is very important. It must be located at a point where incoming packets can be examined and filtered before being delivered to the internal network resources.