A VRF represents an isolated instance on a device of a routing and forwarding table. A VRF belongs to a site and is assigned to a interface (logical or physical). This interface is used to peer to the CE to exchange routing updates and packets. These updates and packets are identified in the core (provider network) by a ROUTE DISTINGUISHER and thus making it unique where there is a overlap of addressing schemes from different VRFs.
A VPN is a service which provides security and isolation normally found in a private network over a shared provider infrastructure. The scope of a VPN is contained by what routing and forwarding is required by a organizations network. Therefore a VPN can entail multiple VRFs if it requires access to networks in different VRFs. The ROUTE TARGET is used to determine what routing information to import or export from a VRF and thus creating the scope of the VPN.
