A site-to-site VPN connects whole networks rather than individual devices. A gateway at each location, such as an office, a warehouse, a shop or a cloud network, builds an encrypted tunnel to the others, so people and systems at every site can reach shared servers, printers and applications as if they were on one private network, without installing a VPN app on each device. Growing companies usually need one when they open a second location, move systems to the cloud or connect equipment at remote sites. ZoltVPN offers site-to-site VPN as part of its business services, alongside dedicated static IPs, satellite internet and business plans.
Site-to-site vs remote-access VPN
Both are called "VPN", but they solve different problems.
| Site-to-site VPN | Remote-access VPN | |
|---|---|---|
| What it connects | Networks to networks | Individual devices to a network or the internet |
| Where the software runs | On a gateway or router at each site | In an app on each laptop or phone |
| Who uses it | Everyone and everything at the site, automatically | Each person who opens the app |
| When it is on | All the time | When the user connects |
| Typical uses | Branch offices, shared servers, phone systems, cameras, cloud networks | Travelling staff, home workers, personal devices |
Most growing companies end up with both: site-to-site links between their locations, and an app for people working away from them.
How a site-to-site VPN works
Gateways
Each site has a gateway, usually a router or firewall, sometimes a small dedicated appliance or a virtual gateway in the cloud. The gateway is the only device that needs to know about the VPN. Laptops, printers and phones at the site use the network as normal.
Tunnels
The gateways build encrypted tunnels to each other across the public internet. Traffic between sites travels inside those tunnels, so anyone in between sees only encrypted data.
Routing
Each site has its own internal address range. The gateways know which ranges live at which site and send traffic down the right tunnel. A file request from the branch to the head office server goes into the tunnel; a normal web request can go straight out to the internet, depending on how you design it.
Topologies
- Hub and spoke. Every branch connects to one central site. Simple to manage, but the hub becomes critical.
- Full mesh. Every site connects to every other site. Faster site-to-site paths, more tunnels to manage.
- Hybrid with a cloud hub. Sites connect to a cloud network, which hosts the shared systems. Common once key applications move to the cloud.
Signs you're ready for one
- You've opened a second office, shop or warehouse that needs the same systems as the first.
- Staff at different sites share a file server, accounting or ERP system, or a stock database.
- You run IP phones, cameras or access control that need to reach a central system.
- You're moving systems to Azure, AWS or Google Cloud and want offices to reach them privately.
- You have remote or temporary sites, such as construction sites, farms or events, that need to reach head office.
A planning checklist
- Map every site and its address range. Overlapping ranges are the most common problem: if two offices both use their router's factory-default range, traffic can't be routed between them until one is changed.
- Decide what needs to talk to what. Not every site needs access to everything. Limiting access between sites reduces the damage if one location is compromised.
- Measure your traffic. Voice, video and backups have different needs. Phone systems care about delay; backups care about bandwidth.
- Check each site's internet connection. A tunnel can't be faster or more reliable than the line it runs over. Critical sites should have a second connection, such as 4G or 5G, or satellite where cables don't reach.
- Choose the hardware. Make sure each site's router or firewall can handle encrypted traffic at the speed you need.
- Plan security. Firewall rules between sites, multi-factor authentication for administration, and regular updates for every gateway.
- Plan monitoring. Decide who gets alerted when a tunnel goes down and how quickly it must be fixed.
Common mistakes
- Overlapping address ranges, discovered only after the hardware is installed.
- Sending all internet traffic through head office. Routing every branch's web browsing through the main site can overload its connection. Decide deliberately what goes through the tunnel.
- No backup link. If a site's single connection fails, it is cut off from everything.
- Packet-size problems. Tunnels add headers to every packet. If packet sizes aren't adjusted, some applications hang while others work fine, which is hard to diagnose.
- Forgetting name resolution. Sites need to find each other's servers by name, not only by address.
Sites in countries with strict networks
If one of your locations is in a country with heavy internet filtering, raise it at the planning stage. Standard site-to-site tunnels use well-known protocols whose traffic has recognisable fingerprints, so in strict networks they can be detected by deep packet inspection and throttled or cut, like any classic VPN. That calls for a different design from the start, not a fix after the fact. Our guide to working behind strict networks explains the wider challenge.
Where ZoltVPN fits
ZoltVPN's team has been building internet and network services for more than 25 years. Our business services cover the pieces a growing company usually needs together:
- site-to-site VPN to join your locations and cloud networks;
- dedicated static IPs, residential or cloud, a single address or a whole range, so your sites and staff appear from fixed addresses; see when your business needs a dedicated static IP and residential vs cloud static IPs;
- satellite internet for sites that cables and mobile networks don't reach;
- business plans for staff who need the ZoltVPN apps on their own devices.
Tell us about your sites, your systems and where your team works on the business page, and we'll help you plan it.
FAQ
Do employees need to install anything?
Not for site-to-site. The gateway at each site handles the tunnel, and devices use the network as normal. Staff who work away from the office use a VPN app instead.
Can a site-to-site VPN connect our offices to our cloud servers?
Yes. Azure, AWS and Google Cloud all support VPN connections into their virtual networks, so offices can reach cloud systems privately.
What happens if one site's internet goes down?
That site loses its tunnels until the connection returns. A second connection, such as mobile or satellite, keeps critical sites online.
How long does it take to set up?
It depends on the number of sites, the hardware already in place and how much planning is needed. Mapping your sites and address ranges first makes everything faster.
Planning a second site? Talk to our business team through the contact page, or download ZoltVPN to try the apps free for 7 days.
