Site-to-Site VPN

Definition

A site-to-site VPN is an encrypted network tunnel connecting two entire networks — typically an on-premises data center and a cloud VPC, or two cloud VPCs — so that resources on either side can communicate as if they were on the same private network, without traffic traversing the public internet unencrypted.

Overview

Site-to-site VPNs solve the problem of securely connecting whole networks rather than individual users. Unlike a client (remote-access) VPN, where an individual device connects to a private network, a site-to-site VPN establishes a persistent, encrypted tunnel — typically using the IPsec protocol — between two network gateways (for example, a customer's on-premises router/firewall and a cloud provider's VPN gateway), so that every device and service on each side can reach the other network transparently through standard routing, without each individual host needing its own VPN client or configuration. This pattern is foundational to hybrid cloud architectures: an organization migrating workloads to the cloud incrementally often needs on-premises application servers to talk to newly-cloud-hosted databases, or vice versa, without exposing either side directly to the public internet. Cloud providers offer managed site-to-site VPN services (AWS Site-to-Site VPN, Azure VPN Gateway, Google Cloud VPN) that terminate the customer's side of the tunnel and route traffic into the VPC according to configured route tables, typically providing redundant tunnels for high availability. Site-to-site VPNs are generally quicker and cheaper to set up than a dedicated private circuit like AWS Direct Connect or Azure ExpressRoute, since they run over the existing public internet with encryption providing confidentiality and integrity, but they inherit the internet's variability in latency, jitter, and bandwidth — making them well suited to moderate, non-latency-critical traffic, while workloads needing guaranteed bandwidth and consistent low latency (large data migrations, real-time replication) more often justify a dedicated interconnect. Many organizations use a site-to-site VPN as a fast-to-deploy starting point and later add a dedicated connection for their highest-volume or most latency-sensitive traffic, sometimes keeping the VPN as an encrypted failover path.

Key Concepts

• Encrypted tunnel (typically IPsec) connecting two entire networks, not individual clients
• Enables transparent routing between on-premises and cloud VPC networks, or between VPCs
• Runs over the public internet, unlike dedicated private circuits (Direct Connect, ExpressRoute)
• Cloud providers offer managed VPN gateway services with built-in redundancy
• Faster and cheaper to provision than a dedicated interconnect
• Subject to public-internet latency and bandwidth variability
• Commonly used as a hybrid-cloud bridge during incremental cloud migrations
• Often paired with or superseded by a dedicated connection for high-volume, latency-sensitive traffic

Use Cases

Frequently Asked Questions

Related in Cloud