Definition and purpose
A site-to-site VPN is a type of VPN that connects two separate network locations—such as an office network and a branch network—through an encrypted tunnel across the internet. Instead of protecting one user’s device, it enables the networks themselves to exchange traffic securely.
In practical terms, the goal is often to allow internal services (like shared applications or access to servers) to work across locations while keeping traffic protected and centrally governed.
A simple model of how it works
You can think of a site-to-site VPN as two “network gateways” (VPN devices or VPN-capable routers) that establish a secure tunnel to each other.
- Each site has its own gateway connected to its local network.
- The gateways authenticate each other and then negotiate encryption.
- When traffic is sent to destinations in the other site’s network range, it is encapsulated and sent through the tunnel.
- At the receiving gateway, the traffic is decrypted and forwarded to the destination inside that remote network.
Whether traffic successfully flows depends heavily on IP addressing, routing decisions, and filtering rules at both ends.
Components you typically configure
Site-to-site VPN setups commonly involve:
- Local and remote network identifiers (which IP ranges should be reachable through the tunnel).
- Tunnel parameters (encryption and authentication choices).
- Routing behavior (static routes or dynamic routing, depending on how the network is designed).
- Access control (firewall rules that permit only the expected traffic).
Because these elements must align, two “VPN tunnels” with different routing or firewall policies may not interoperate as expected. If details are unclear, the observable symptom is usually that some traffic reaches the tunnel but doesn’t reach the target network.
Key differences, limits, and when it changes the answer
A site-to-site VPN is different from a remote-access (client) VPN: remote-access focuses on individual devices joining a private network, while site-to-site focuses on connecting whole networks via gateways.
It also has limits you should account for:
- Reachability is not automatic: only the network ranges you configure (and allow through firewalls) will typically be reachable.
- Routing matters: misconfigured routes or overlapping IP subnets can prevent correct forwarding.
- Security depends on configuration: encryption/authentication choices and firewall policies determine how well the tunnel is protected in practice.
If your “sites” are not fixed networks (for example, many roaming devices), a client-based approach may fit better. If your “sites” are meant to exchange only a small set of services, you can often restrict traffic to reduce exposure—exact outcomes depend on your routing and filtering choices.