As far as my knowledge goes, if the used logs into the tunnel, he can only access the LAN at the other end of the tunnel. Or if the user has the ISP account, he can login using that account to access the Internet. The access server decides whether the user is a VPDN user (in which case the tunnel is set up to the Homegateway) or ordinary user in which case the ISP allows the user to use the Internet.