A site-to-site VPN is an encrypted tunnel between two network gateways, such as an office router and a cloud network gateway, so devices on either side talk as if the networks were joined. Use it for fixed locations with steady traffic, and restrict what may cross it.
How does a site-to-site VPN work?
Most use IPsec. RFC 4301 describes the Security Architecture for IP, designed to provide security services for traffic at the IP layer. NIST SP 800-77 Rev. 1 calls IPsec a widely used network layer security control and notes that configuration is usually done with the Internet Key Exchange (IKE) protocol, which sets up the keys and parameters for the tunnel.
In plain terms: the two gateways authenticate each other, agree on keys, and then encrypt the traffic between chosen address ranges. Users and servers on each side do nothing special. Their packets are wrapped by the gateway.
The gateways are the endpoints. Individual laptops and servers are not part of the tunnel, which separates this design from a remote access VPN where each user runs a client.
When is it the right choice?
- Joining a branch office to headquarters when both have fixed gateways.
- Connecting an on-premises network to a cloud virtual network.
- Linking two cloud networks across providers or regions.
- Giving a partner access to one small system, with strict limits.
It is a poor fit for individual remote workers, for large numbers of changing devices, and for cases where you want per-application access control. For those, remote access with identity-based controls or a zero trust approach suits better. NIST SP 800-207 describes zero trust as removing implicit trust based on network location, which is the opposite of what a broad tunnel grants.
What goes wrong?
The classic failure is over-broad routing. A tunnel set up in a hurry advertises the whole office range and the whole cloud network. Years later a compromised printer on one side can reach a database on the other.
Other common problems: pre-shared keys that are weak or never rotated, old cryptographic settings left enabled for compatibility, mismatched settings that make the tunnel drop and silently fail over to an unencrypted path, and gateways that are not patched. CISA's guidance on edge devices names VPN gateways among devices attackers target and urges administrators to keep them hardened and logged.
A constructed example
A design studio connects its office to a cloud network that hosts a render farm. The first config allows 10.0.0.0/8 on both ends, because it was quick. The review narrows it: office workstations subnet to the render subnet on two ports. Nothing else crosses. The cloud security group also restricts the other direction, so the render farm cannot initiate connections back to workstations.
The tunnel did not change. The routes and rules did, and that is where the security lives.
How to check or apply this
- Write down which systems must talk across the tunnel and on which ports. Start from that list, not from "connect the networks."
- Advertise the smallest address ranges that satisfy it.
- Use modern algorithm settings and certificates or strong, unique pre-shared keys. Check them against your policy and your platform's current guidance.
- Apply firewall rules on both sides. The tunnel is transport, not authorization.
- Monitor tunnel state and alert on flaps. Confirm traffic never falls back to an unencrypted route.
- Patch gateways promptly and restrict their management interfaces.
- Review the tunnel list yearly. Remove ones for projects that ended.
- For redundancy, build two tunnels over different links and test failover.
How is it different from a remote access VPN?
Site-to-site joins networks through gateways. Remote access connects an individual device to a network through client software. The first is for places, the second for people. Many organizations use both, and the controls differ: certificates on gateways for one, user authentication and device checks for the other.
Quick check
Is a site-to-site VPN secure by default?
It encrypts traffic between gateways, which protects against eavesdropping on the path. It does not limit what the two networks can reach, so routing and firewall rules still decide your exposure.
Should a small office use one or a zero trust service?
If you need to join two fixed networks, a site-to-site tunnel works. If the need is access to specific applications for staff, an identity-based approach gives finer control.
Sources
- RFC 4301: Security Architecture for the Internet Protocol
- NIST SP 800-77 Rev. 1: Guide to IPsec VPNs
- NIST SP 800-207: Zero Trust Architecture
- CISA: Guidance and Strategies to Protect Network Edge Devices
Last reviewed: 18 October 2026.
