What is a site-to-site VPN?

Q: What is a site-to-site VPN?

A site-to-site VPN connects two networks (sites) using encrypted tunnels over the internet. It’s commonly used for connecting offices or data centers with predictable inter-site access. It differs from remote-access VPNs, which focus on individual users. You typically need network planning: addressing, routing, and security policies. Performance depends on bandwidth, latency, and encryption overhead, not just the VPN name.

Definition and purpose

A site-to-site VPN (also called a gateway-to-gateway VPN) is a secure way to connect two separate private networks over a public network, such as the internet. Instead of creating a tunnel for one person’s device, it links whole networks so that traffic can flow between them according to defined routing and security policies.

In practical terms, organizations use it to treat two sites—like an office and a branch office, or an office and a data center—as if they are connected through a controlled private connection.

Simple model of how it works

Think of two VPN gateways (one at each site). Each gateway:

establishes an encrypted tunnel to the other gateway
accepts traffic from its local network that is allowed to travel across the tunnel
forwards traffic to the remote network when it matches the configured routing policies

The VPN’s encryption helps protect data in transit on the public network. The allowed traffic is usually limited by configuration such as which IP ranges may be reached and which protocols are permitted.

Core components you must understand

Site-to-site VPN setups generally involve:

VPN gateways (devices or software endpoints) at both sites
Private network ranges (e.g., internal IP subnets) that should be reachable
Routing rules that determine where network traffic goes
Security policies that define what traffic is allowed across the tunnel

A key point is that “site-to-site” refers to network-to-network connectivity, not a guarantee that every application or every device across the sites can communicate automatically.

Differences and limits vs. other VPN types

A common comparison is with remote-access VPNs. Remote-access VPNs focus on connecting individual user devices to a network. Site-to-site VPNs focus on connecting networks at the gateway level.

Important limits to keep in mind:

You still need correct network addressing and routing; overlapping IP ranges can complicate connectivity.
Encryption protects data in transit, but it does not automatically fix application-level security issues.
Performance can vary with internet bandwidth, latency, and encryption overhead, especially for high-throughput traffic.

Because there are many deployment styles, exact behavior depends on the specific configuration at the gateways, such as which traffic selectors and routing methods are used. If you see mismatched expectations between sites, it is often a configuration and routing-policy issue rather than a “VPN type” issue.

Practical checks before you rely on it

To validate that a site-to-site VPN meets your needs, you can check:

Whether the intended remote subnets are actually routed and reachable through the tunnel
Whether DNS, IP addressing, and firewall rules align with the cross-site traffic you expect
Whether the performance characteristics (latency and throughput) are acceptable for your applications

If anything fails, start with the basics: confirmed IP ranges, routing paths, and whether the gateways’ security policies allow the traffic you are testing. Uncertainty remains possible when documentation is missing, so you may need to review the gateway configuration details to confirm how your specific tunnel is set up.