Definition and core idea

A site-to-site VPN is a virtual private network that connects two (or more) separate network locations over the public internet. Instead of exposing the entire path, the networks communicate through an encrypted tunnel created between their gateway devices (often called VPN gateways or edge devices). From the perspective of applications inside the networks, the goal is to make traffic behave like it can reach the other site through a protected link.

The simple model: endpoints, tunnel, and rules

At a high level, a site-to-site VPN works in three parts:

  1. Endpoints (gateways): Devices at each site establish the VPN. These gateways sit at the network boundary and decide which traffic should be sent through the encrypted tunnel.
  2. Tunnel establishment: The gateways negotiate encryption and authentication for the tunnel. The exact mechanism can vary by implementation, but the result is that traffic is protected while crossing untrusted networks.
  3. Routing and access control: Network traffic is mapped so that packets destined for the remote site’s network ranges are forwarded into the tunnel, while other traffic follows normal routes.

If a packet matches a “remote network” rule, the gateway encrypts it and sends it to the other gateway. The receiving gateway decrypts it and forwards it to the internal destination.

What makes it different from other VPN types

A site-to-site VPN differs from a remote-access VPN because the connection is between networks (via gateways), not between a single user device and a VPN service.

  • Site-to-site: Traffic is routed at the gateway level. You usually configure which subnets at Site A should reach which subnets at Site B.
  • Remote-access: Individual laptops or phones connect to the VPN to access a corporate network.

This distinction matters because troubleshooting and design focus on routing tables, subnet overlap, and gateway-to-gateway policy rather than user client configuration.

Key exceptions and limits to keep in mind

Even when the tunnel is encrypted, a site-to-site VPN is only as “complete” as the underlying network policies and routing decisions.

  • Only allowed traffic is reachable: If the configuration does not include the relevant remote network ranges (or the gateway policies block it), connections will fail even though the tunnel exists.
  • Subnet overlap can break routing: If both sites use the same IP ranges for different purposes, gateways may not know where to send traffic.
  • “Secure tunnel” is not the same as “secure environment”: Encryption protects data in transit, but it does not automatically fix issues like misconfigured firewalls, insecure services inside a site, or incorrect identity and authorization at the application layer.
  • Performance depends on the path and endpoints: Additional encryption/decryption processing and the internet path characteristics can affect latency and throughput. Exact results vary by hardware and configuration, so treat capacity planning as context-specific.

How you can check it works in practice

To validate that a site-to-site VPN behaves as intended, focus on verifiable checks at the gateway and routing level:

  • Confirm the tunnel is established: Look for gateway status showing that peers are connected and the encrypted session is active.
  • Check route selection: Verify that traffic destined for the remote site’s subnet(s) is being sent into the tunnel by checking gateway routing and policy/rule matching.
  • Validate firewall/policy expectations: Ensure that inbound and outbound access between the specified networks is permitted according to gateway rules and any internal firewall rules.
  • Use test traffic scoped to the configured networks: Try connectivity to specific hosts/services in the remote subnet you expect to reach, rather than broad “internet-like” assumptions.

If connectivity fails, the most common causes are mismatched subnet definitions, blocked policies, routing conflicts (including overlap), or tunnel negotiation not completing. Because implementations differ, the most reliable next step is to compare the intended subnet-to-subnet policy with the gateway configuration and observed logs/status.

Recap

A site-to-site VPN connects two network sites by creating an encrypted tunnel between gateways, then using routing and security policies to decide which traffic moves through that tunnel. The tunnel’s existence alone doesn’t guarantee access—reachability depends on correctly matched network ranges and permitted paths.