How does a site-to-site VPN work?

Q: How does a site-to-site VPN work?

A site-to-site VPN links two networks through an encrypted tunnel between gateways. Traffic is encapsulated and sent over the public internet, then decrypted at the far end. Whether it works depends on correct gateway configuration and compatible VPN settings. It’s typically used for network-to-network connectivity, not one device at a time.

Definition and high-level model

A site-to-site VPN is a secure way to connect two separate networks (for example, an office network and a data-center network) by creating an encrypted “tunnel” between the network gateways at each site. Instead of sending network traffic directly over the internet, the VPN wraps that traffic so it can cross the internet protected and then be forwarded into the destination network.

What happens when traffic flows

Two gateways establish the VPN tunnel. Before regular data can pass, each side agrees on parameters (for example, encryption and authentication methods). The exact handshake details vary by implementation.
Traffic is encapsulated and encrypted. When a device or service on Site A needs to reach something on Site B, the gateway captures that traffic and packages it into VPN messages. Those messages are encrypted so intermediate networks can’t easily read them.
The encrypted tunnel crosses the internet. The VPN-encapsulated traffic travels over the public network between gateways.
The far gateway decrypts and forwards. At Site B, the gateway decrypts the incoming VPN traffic and routes it into the internal network, typically based on destination IP addresses.

A helpful mental model is: site gateways act like tunnel endpoints, and routing decides which internal destinations should cross that tunnel.

Components and configuration choices that matter

A site-to-site VPN generally involves:

VPN gateways at both sites (hardware appliances or software VPN endpoints).
Network routing decisions for deciding which subnets at Site A should be reachable through the tunnel.
Addressing and compatibility settings so both ends agree on how to identify traffic and how to secure the tunnel.
Security/authentication mechanisms to prevent unauthorized tunnel establishment.

Important nuance: the encryption and tunnel setup are only one part. If routing and firewall rules don’t allow the required traffic, the VPN can be “up” yet still fail to deliver the expected connectivity.

Differences, limits, and when the answer changes

Site-to-site vs. remote-access VPN: Site-to-site focuses on network-to-network connectivity using gateways. Remote-access VPN is commonly used for individual client devices connecting to a network.
“Works” is not the same as “everything is reachable.” You’ll usually need to ensure the correct internal subnets are permitted on both sides, and that return paths are routed properly.
Performance and reliability depend on your setup. Tunnel throughput and latency are influenced by encryption overhead, internet paths, and device capacity—there’s no universal guarantee.
Compatibility constraints exist. If the gateways use incompatible VPN modes or settings, they may fail to establish a tunnel.

Practical ways to verify understanding

To check whether a site-to-site VPN concept matches what you’re dealing with:

Identify the two tunnel endpoints (the gateways) and confirm they are the devices responsible for encryption/decryption.
Verify which internal IP ranges (subnets) are expected to be reachable across the tunnel.
Confirm the firewall policies allow inbound VPN-related traffic at both sites and allow the decrypted traffic to reach the intended internal hosts.
If troubleshooting, start with tunnel establishment first, then validate routing for specific destination IPs.

When you can map “which source-to-destination subnets should communicate” to “which gateway tunnels carry them,” you have the core understanding needed to reason about how a site-to-site VPN works in practice.