A virtual private network is provided across a Provider Link State Bridging (PLSB) network between a first node connected to a private LAN and a second node connected to a roaming device. The roaming device is authenticated. A successful authentication results in a Service Identifier for the VPN being sent to the second node. Connectivity between members of the VPN service instance is maintained as part of the PLSB Link State process for forwarding table maintenance, rather than by any form of explicit signalling. A single Customer Virtual Bridge/Virtual Switch Instance can be located at the first node to provide point-to-point connectivity to each roaming device. A virtual Residential Gateway function can be combined with the Customer Virtual Bridge/Virtual Switch Instance.