Definition
A site-to-site VPN is a VPN that connects two separate network sites through an encrypted tunnel. Instead of protecting a single user’s traffic on a laptop, it typically links networks (for example, a company office network to a branch office network or to a partner network) by sending traffic between the sites through a gateway-to-gateway connection.
In practical terms, devices in Site A can reach selected destinations in Site B over that encrypted tunnel, and vice versa, as long as the VPN and the network routing rules are set up to allow it.
A simple model of how it works
You can think of a site-to-site VPN as three cooperating parts:
- Two endpoints (gateways): Each site has a network gateway that accepts traffic destined for the other site.
- An encrypted tunnel: The gateways establish a secure channel so that traffic crossing the internet is protected in transit.
- Routing and forwarding rules: Network devices decide which traffic should be sent to the tunnel (often via static routes or dynamic routing).
When a client inside Site A wants to reach a resource in Site B, the request is routed to the Site A gateway. The gateway forwards it through the tunnel to the Site B gateway, which then delivers it to the destination network.
Components you’ll usually need
To make a site-to-site VPN work, you typically configure:
- Tunnel endpoints: The gateways (often firewall appliances or router features) must support the same VPN protocol and compatible settings.
- Cryptographic/authentication parameters: The tunnel needs authentication and encryption policies shared between endpoints.
- Traffic selection (what is allowed): Many setups define which subnets are reachable over the tunnel.
- Routing controls: Rules must map “traffic to X” at one site to “send it through the tunnel” at the other site.
- Security controls at the endpoints: A VPN helps protect data in transit, but the gateways and the networks behind them still need appropriate hardening.
If any of these are mismatched or incomplete, the tunnel may come up but traffic may still fail.
Differences and limits compared with other VPNs
Site-to-site vs user/device VPNs
A user/device VPN focuses on protecting traffic from an individual device (for example, a remote employee) to a private network or service. A site-to-site VPN focuses on connecting networks via gateways. This means the operational and troubleshooting responsibilities often shift toward gateway configuration and routing.
Common constraints and exceptions
- Routing complexity: Reachability depends on correct routing and subnet definitions. Misconfigured routes are a frequent cause of “the tunnel is up but nothing works.”
- Selective connectivity: Many deployments do not automatically allow all traffic between sites; they allow specific networks or ports.
- Endpoint trust assumptions: The VPN typically protects traffic as it travels between gateways, but it does not automatically make the devices inside each network trustworthy.
- Performance sensitivity: Encryption and tunnel handling add overhead. How noticeable it is depends on traffic patterns and gateway capacity—so you can’t assume all environments behave identically.
Because these aspects vary by environment and configuration, it’s reasonable to treat site-to-site VPNs as a design task rather than a single “plug-and-play” feature.
Practical checks you can do
If you’re trying to understand or validate a site-to-site VPN in your own context, you can check:
- Which networks/subnets are supposed to be reachable across the tunnel.
- Whether the endpoints agree on protocol and tunnel settings (mismatches can prevent establishment).
- Whether routing points to the tunnel for the remote subnets (and not to a dead end).
- Whether firewall rules permit the intended traffic at both sites.
- Whether gateway security controls are in place (since the tunnel terminates at the endpoints).
If the tunnel is established but connectivity fails, focus on routing, subnet selection, and firewall/ACL rules first.