Definition and plain-language model
A site-to-site VPN connection is a type of VPN that creates an encrypted tunnel between two network gateways so that traffic can move securely from one network to the other.
In practice, the “sites” are usually networks such as an office LAN, a branch network, or a data center network. Instead of securing one person’s laptop, it focuses on connecting networks.
How the connection typically works
Most site-to-site VPN setups follow the same high-level pattern:
- Two gateway devices (VPN endpoints) establish a VPN tunnel.
- Traffic that matches permitted policies is encrypted at the source gateway and decrypted at the destination gateway.
- Routing determines which internal subnets can reach which other internal subnets.
- Authentication and key management control which gateways are allowed to form the tunnel.
The important idea is that the endpoints are responsible for the tunnel and for enforcing which network traffic is allowed to traverse it.
What it includes (and what it usually excludes)
Site-to-site VPN connections are commonly used to:
- Provide ongoing connectivity between offices or between an office and a private network.
- Allow hosts in one site’s subnet to reach hosts in the other site’s subnet.
- Extend private network reachability without exposing internal services directly to the public internet.
They typically exclude:
- User-by-user mobility features (that’s more common in remote-access VPNs).
- Automatic “everything can talk to everything” behavior—communication is constrained by routing and VPN policies.
Differences, limits, and key exceptions
A site-to-site VPN is different from a remote-access VPN, where individual users connect from anywhere to a central network using a client. With site-to-site, the tunnel is between gateways; with remote-access, the tunnel is between a user device and a VPN server.
Also note that a secure VPN design does not remove all risk. The practical security outcome depends on choices such as:
- The strength and correctness of encryption/authentication settings.
- Whether routing and firewall rules are configured to limit traffic to only what’s intended.
- How IP addresses (subnets) are planned across sites.
Finally, if the networks use overlapping IP ranges, routing can become ambiguous and may require additional planning or translation—this is a frequent reason site-to-site VPNs need careful design.
What you can verify to understand a specific setup
If you’re evaluating or troubleshooting a site-to-site VPN connection, you can usually check:
- Which gateway devices form the tunnel and whether they both agree on the authentication method.
- Which internal subnets are intended to be reachable across the VPN.
- How routing is done (static routes vs. dynamic routing) and whether both sides advertise the right networks.
- Which firewall rules apply at each side for traffic entering from the VPN.
If you can map “source subnets → destination subnets” and confirm the tunnel policies match, you’ll have a solid understanding of what the connection is truly doing.