A relay device disposed within a LAN for connecting a client apparatus (6a, 6b, 6c, 6d) with a virtual network via a server on the Internet, including a server address storage section for storing a global address of the server on the Internet; the relay device including: a tunneling connection establishing section for establishing a tunneling connection between the relay device and the server based on the global address of the server, thereby enabling communication destined to a virtual network address of the virtual network, wherein the relay device is disposed between an upstream Ethernet network and a downstream Ethernet network of the LAN, and the client apparatus is connected to the downstream Ethernet network on the LAN; a bridge module provided between a local communication protocol stack and a network device (10, 11) located between the upstream Ethernet network and the downstream Ethernet network, the bridge module for determining a destination of a packet received via the network device, and bridging between the upstream Ethernet network and downstream Ethernet network of the LAN by letting the packet pass through and passing the packet to the local communication protocol stack only if the packet is addressed to the relay device, for broadcasting or if the packet is a request packet addressed to the virtual network, the bridge module also being for capturing and forwarding a request packet that is originated from the client apparatus (6a, 6b, 6c, 6d) in the downstream Ethernet network and is destined to a virtual network address of the virtual network, to a capsulating processing section and passing the packet to the local communication protocol stack, the capsulating processing section for receiving the request packet and capsulating the packet after adding to the packet a virtual network address of the client apparatus (6a, 6b, 6c, 6d) as an originating address, and sending the capsulated packet to the server via the tunneling connection; and a decapsulating processing section for decapsulating a packet addressed to the relay device itself received through the local communication protocol stack via the tunneling connection, converting a destination virtual network address included in the decapsulated packet into a private IP address of the client apparatus on the LAN, and sending the packet to the client apparatus by the bridge module. a tunneling connection establishing section for establishing a tunneling connection between the relay device and the server based on the global address of the server, thereby enabling communication destined to a virtual network address of the virtual network, wherein the relay device is disposed between an upstream Ethernet network and a downstream Ethernet network of the LAN, and the client apparatus is connected to the downstream Ethernet network on the LAN; a bridge module provided between a local communication protocol stack and a network device (10, 11) located between the upstream Ethernet network and the downstream Ethernet network, the bridge module for determining a destination of a packet received via the network device, and bridging between the upstream Ethernet network and downstream Ethernet network of the LAN by letting the packet pass through and passing the packet to the local communication protocol stack only if the packet is addressed to the relay device, for broadcasting or if the packet is a request packet addressed to the virtual network, the bridge module also being for capturing and forwarding a request packet that is originated from the client apparatus (6a, 6b, 6c, 6d) in the downstream Ethernet network and is destined to a virtual network address of the virtual network, to a capsulating processing section and passing the packet to the local communication protocol stack, the capsulating processing section for receiving the request packet and capsulating the packet after adding to the packet a virtual network address of the client apparatus (6a, 6b, 6c, 6d) as an originating address, and sending the capsulated packet to the server via the tunneling connection; and a decapsulating processing section for decapsulating a packet addressed to the relay device itself received through the local communication protocol stack via the tunneling connection, converting a destination virtual network address included in the decapsulated packet into a private IP address of the client apparatus on the LAN, and sending the packet to the client apparatus by the bridge module.