VPN Types Explained: Remote Access vs Site-to-Site
Learn the difference between remote-access and site-to-site VPNs, tunneling protocols like IPsec and WireGuard, with interview Q&A.
Expected Interview Answer
A VPN (Virtual Private Network) creates an encrypted tunnel over an untrusted network like the internet, and the two most common types are remote-access VPNs, which connect an individual device to a private network, and site-to-site VPNs, which permanently connect two entire networks together.
A remote-access VPN (client-based, e.g., using OpenVPN or WireGuard) lets an individual user — a remote employee, for example — securely reach a company network as if they were physically on-site, encrypting all traffic between their device and a VPN gateway. A site-to-site VPN instead connects two whole networks, such as a branch office and headquarters, through gateway devices (routers or firewalls) that establish a persistent encrypted tunnel, so every device on each side can reach the other network transparently without running individual client software. Site-to-site VPNs are commonly built with IPsec, encapsulating and encrypting packets between the gateways. A third variant, the client-to-site (SSL) VPN accessed through a browser, offers remote access without installing dedicated client software, often used for limited, application-specific access. All types rely on tunneling (encapsulating private traffic inside another protocol) and encryption to keep data confidential across a network the organization does not control.
- Encrypts traffic across untrusted public networks
- Remote-access VPNs let individual users reach private resources securely
- Site-to-site VPNs connect whole office networks without per-device setup
- Tunneling protocols like IPsec and WireGuard provide the underlying security
AI Mentor Explanation
A remote-access VPN is like a single player being given a secure, screened tunnel from the team hotel straight onto the pitch, so no outsider can intercept them along the way. A site-to-site VPN is like a permanent covered walkway built between two grounds owned by the same club, letting the whole squad move between venues without individual escorts each time. Both use a protected passage instead of walking openly through the crowd, but one serves a single player and the other serves an entire team’s route.
Step-by-Step Explanation
Step 1
Choose the model
Decide between remote-access (individual device) or site-to-site (whole networks) based on who needs connectivity.
Step 2
Establish the tunnel
A VPN client or gateway negotiates an encrypted tunnel (e.g., IPsec, WireGuard, OpenVPN) with the remote endpoint.
Step 3
Encrypt and encapsulate
Private traffic is encrypted and wrapped inside the tunneling protocol before crossing the public network.
Step 4
Deliver transparently
Decrypted traffic emerges on the private network side, letting the device or remote network behave as if locally connected.
What Interviewer Expects
- Clear distinction between remote-access and site-to-site VPN use cases
- Knowledge of common tunneling protocols (IPsec, OpenVPN, WireGuard)
- Understanding that VPNs provide confidentiality via encryption over an untrusted network
- Awareness of SSL/client-to-site VPNs as a browser-based alternative
Common Mistakes
- Assuming VPN always means installing a personal client app
- Confusing a VPN with a proxy (a VPN encrypts and tunnels; a proxy just forwards)
- Not knowing site-to-site VPNs are configured at the gateway/router level, not per device
- Forgetting that VPNs protect data in transit but do not replace endpoint security
Best Answer (HR Friendly)
“A VPN is a private, encrypted tunnel through a public network. A remote-access VPN is what an individual employee uses to securely reach the office network from home, like a personal secure lane. A site-to-site VPN is a permanent secure bridge between two whole office locations, so everyone at both sites can share resources without setting anything up individually. Both keep data safe as it crosses the open internet.”
Code Example
# Generate a key pair for a WireGuard VPN peer
wg genkey | tee privatekey | wg pubkey > publickey
# Bring up the VPN interface defined in wg0.conf
sudo wg-quick up wg0
# Verify the tunnel and see connected peers
sudo wg show
# interface: wg0
# peer: <public-key>
# endpoint: 203.0.113.10:51820
# allowed ips: 10.8.0.0/24Follow-up Questions
- What is the difference between IPsec and SSL/TLS-based VPNs?
- How does split tunneling change what traffic goes through the VPN?
- Why is WireGuard often preferred over OpenVPN for performance?
- What security risks exist if a VPN gateway is misconfigured?
MCQ Practice
1. Which VPN type connects an individual device to a private network?
A remote-access VPN connects a single user/device securely to a private network.
2. Which VPN type is configured at the router/gateway level to link two whole networks?
Site-to-site VPNs use gateway devices to permanently connect two entire networks.
3. What is the primary purpose of a VPN tunnel?
A VPN tunnel encrypts and encapsulates traffic so it stays confidential across an untrusted network.
Flash Cards
Remote-access VPN? — Connects an individual device to a private network via an encrypted client tunnel.
Site-to-site VPN? — Permanently connects two whole networks via gateway devices, e.g. using IPsec.
Common VPN protocols? — IPsec, OpenVPN, WireGuard, and SSL/TLS-based client-to-site VPNs.
What does a VPN provide? — Confidentiality via encryption and tunneling over an untrusted network like the internet.