VPN gateway device and hosting system

A VPN gateway (A11) includes: a WAN interface (A111) for transmitting/receiving a packet to/from client nodes (C1, C2, D1, D2) via IPsec tunnels (B11-B14) set at the side of WAN; a LAN interface (A112) for transmitting/receiving a packet to/from server nodes (A131-A136) connected to the LAN side; a session relay unit (A114) for temporarily terminating a first communication session to be set for a server node from a client node and setting a second communication session relaying the first communication session to the server node; and an SSL processing unit (A116) for making the second communication session into an SSL. Thus, it is possible to dynamically allocate the servers in the data center (A1) to the VPN, permit only the authenticated server to communicate with another node in the VPN, and prevent wiretap and false altering of the communication performed by the server.