What is a site-to-site VPN and how does it work?

A site-to-site VPN connects two whole networks, such as an office and a data center, over the internet using an encrypted tunnel between two gateway devices. Users on either side reach the other network as if it were local, without running VPN software themselves. Most are built on IPsec.

How is it different from a remote access VPN?

A remote access VPN connects one person's device to a network. A site-to-site VPN connects two networks, and the gateways do the work for everyone behind them. The laptops and servers on each side send ordinary traffic, and the gateway wraps it.

How does IPsec build the tunnel?

RFC 4301 describes the IPsec architecture. It says IPsec can be implemented in a host, in a security gateway, or as an independent device, and that a security gateway is an intermediate system implementing IPsec, such as a firewall or router that has been IPsec-enabled. That gateway model is what a site-to-site VPN uses.

The protection is based on a Security Policy Database, set up by an administrator, which decides what happens to each packet. As the RFC describes, packets are selected for one of three treatments: protected, discarded, or allowed to bypass IPsec. In plain terms, you write rules saying which traffic between which networks goes into the tunnel.

NIST SP 800-77 Revision 1 explains that IPsec configuration is usually performed using the Internet Key Exchange protocol, and gives practical guidance on implementing IPsec services in different circumstances. The first phase of IKE authenticates the two gateways and agrees on keys. After that, the data flows protected.

What can go wrong?

• Weak authentication: a shared secret that is short, reused or emailed around.
• Old algorithms: leaving legacy cipher choices enabled.
• Over-broad rules: the tunnel carries "any to any," so a compromise on one side reaches everything on the other.
• No monitoring: the tunnel is up, so nobody checks what crosses it.
• A single gateway: when it fails, the sites lose each other.

The tunnel protects traffic in transit. It does not protect against an infected machine behind the gateway, because the tunnel is a trusted path by design.

A constructed example

A small firm has an office and a cloud network. They link the two with a gateway at each end. The first design allows the whole office range to reach the whole cloud range. A contractor's laptop, infected at a coffee shop and then plugged in at the office, can now scan every cloud server. In the second design, only the finance subnet can reach the accounting servers on two ports, and everything else is dropped by the gateway firewall. The tunnel is the same. The exposure is not.

How does this relate to zero trust?

NIST SP 800-207 describes zero trust as moving defenses from static network perimeters to users, assets and resources, with no implicit trust based on network location. A site-to-site VPN extends a network. Under zero trust thinking, you still authenticate and authorize each request across it. Many organizations use both: the VPN for site connectivity, and identity-aware controls for access to applications.

How to check or apply this

1. Document which networks connect, and why.
2. Use certificate-based or strong pre-shared key authentication for the gateways, and store keys in a secrets manager.
3. Follow current NIST guidance on algorithms and disable legacy options.
4. Restrict tunnel traffic by source, destination and port, instead of allowing all traffic.
5. Log tunnel events and traffic summaries, and alert on tunnel flaps and unusual volumes.
6. Plan redundancy with two gateways or two tunnels.
7. Test failover and policy at least once a year, and after any change.

Quick check

Sources

• RFC 4301, Security Architecture for the Internet Protocol
• NIST SP 800-77 Rev. 1, Guide to IPsec VPNs
• NIST SP 800-207, Zero Trust Architecture

Last reviewed: 18 October 2026.