The VPN is needed because the university has disabled access to port 22 (used by NX and SSH) except from machines that are at ECU. (They have also disabled it for access from the PIRATES wireless network, but not from the BUCCANEER network.)
After you start the VPN, all packets that your computer tries to send to any machine in the ecu.edu domain will be sent instead to the VPN, which forwards them to the desired machine. It appears that the packets originated at the VPN, so they are allowed to get through.