Techniques for virtual private network (VPN) services over optical networks. Client data is received from a source device connected to a first node in an optical communication network. The client data is for transmission over the optical communication network to a destination device connected to a second node in the optical communication network. The client data is transmitted from the source device to the destination device using a layer 2 (L2) virtual network connection between the source device and the destination device. This includes transmitting the client data from the first node to the second node over an optical transport network (OTN) path through the optical communication network using a frame. The second node is configured to receive the frame and transmit the client data to the destination device based on an identifier in the frame.