So, wait, doesn't ingress act like VPN? Or does it only provide access to nodes in the network, while routing the rest of traffic normally?