Site-to-site VPN, explained
How two offices become one network over the internet, and how to choose between WireGuard, IPsec, and OpenVPN.
A VPN is a private, encrypted tunnel across the public internet. Most people meet the idea through a laptop or phone connecting back to work. A site-to-site VPN is a different, older use of the same idea: joining two whole offices together, permanently, rather than one device.
What a site-to-site VPN actually does
Picture a head office and a branch office, each with its own local network. A site-to-site VPN builds one always-on tunnel between the two firewalls. Once it is up, a computer at the branch can reach a server at head office the same way it reaches a server down the hall.
Nobody at either office has to open an app or type a password to use it. The tunnel is a property of the network itself, running between the two firewalls, not between two people.
How it differs from the VPN a laptop uses
A remote-access VPN connects one device to one network. A staff member starts it before working, and stops it when they are done. It exists because that one person is not on the office network right now.
A site-to-site VPN connects two networks to each other, all the time, for every device on both sides. Nobody starts or stops it. It stays up because two whole offices need to behave like one network, continuously, not just when someone remembers to connect.
- Remote access: one laptop, connected on demand, for one person at a time.
- Site-to-site: two networks, connected permanently, for everyone at both locations.
When a business actually needs one
A site-to-site VPN earns its keep once a company has more than one location that needs to share the same systems. A shared file server, a shared printer queue, an internal accounting tool, a phone system, these are the usual reasons.
A company with one office and staff who occasionally work from home usually needs a remote-access VPN instead, not a site-to-site one. The site-to-site kind is for joining buildings, not people.
WireGuard vs IPsec vs OpenVPN for this job
All three can build a site-to-site tunnel. They differ in speed, compatibility, and how much setup they need.
WireGuard
WireGuard is the newest of the three, and the fastest to set up and to run. Its small size makes it easier to trust and easier to run on modest hardware. It is a strong default choice when both ends are firewalls that support it.
IPsec
IPsec is the long-established standard. Almost every firewall and router from any vendor supports it. Choose IPsec when one end of the tunnel is equipment from a different manufacturer, since IPsec is the option most likely to already be there.
OpenVPN
OpenVPN works almost anywhere, including networks that block other kinds of VPN traffic, because it can look like ordinary encrypted web traffic. It is a sensible fallback when a location has an unusually restrictive internet connection.
What actually breaks without one
Without a site-to-site VPN, two offices are simply two separate networks with no shared path. Any connection between them has to either cross the open internet unprotected, or go through some manual workaround, like emailing files back and forth or opening a public port on a server.
Both of those carry real risk. A site-to-site VPN removes the need for either, because the two networks already share a private path.
What it costs to run
A site-to-site VPN uses a small, steady amount of extra processing at both ends, since every packet crossing the tunnel gets encrypted and decrypted. On a modern firewall appliance, this is rarely noticeable for typical office traffic like file access and email.
It becomes worth checking only when a lot of data moves between sites constantly, for example large video files or a shared database that both offices update all day. In that case, look at the appliance's rated VPN throughput, not just its overall throughput, since the two numbers can be quite different.
Setting one up with Firecradle
Firecradle supports WireGuard, IPsec, and OpenVPN, and includes a guided wizard for building a site-to-site tunnel between two Firecradle appliances or between Firecradle and another vendor's equipment. You pick the two ends and the protocol, and the wizard builds the tunnel and the matching firewall rules together.