# What is a Site-to-Site VPN?

> A site-to-site virtual private network (VPN) connects two or more networks through VPN gateways across another network, commonly the internet.

- Canonical URL: https://yellowcube.eu/glossary/site-to-site-vpn/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

In a cryptographic implementation, the gateways authenticate each other and protect selected traffic between sites. Hosts behind the gateways can often communicate without running individual VPN client software.

IPsec tunnel mode is a common implementation. Each gateway encapsulates an original packet inside a protected IP packet for transit and restores it at the far end. Static routes, dynamic routing, or policy-based traffic selectors determine which destinations use the tunnel. Multi-site designs may use hub-and-spoke, partial-mesh, or full-mesh topologies.

### Key points

- **Peer and key management:** Authenticate gateways with appropriately managed credentials, use current cryptographic settings, automate renewal where safe, and maintain tested revocation procedures.
- **Routing and policy:** Prevent overlapping or unintended prefixes, validate route exchange, restrict permitted inter-site services, and preserve segmentation after decryption.
- **Availability:** Plan redundant gateways and underlays, monitor tunnel and application health, test failover, and account for maximum transmission unit and fragmentation behavior.
- **Important limitation:** A cryptographic site-to-site VPN authenticates and protects the gateway relationship, not every host behind it. A compromised endpoint or excessive route can use the tunnel to reach the other site, and encryption does not prevent malicious traffic from an authorized network.

### Related terms

[Virtual private network (VPN)](<https://yellowcube.eu/glossary/virtual-private-network/>) · [Remote-access VPN](<https://yellowcube.eu/glossary/remote-access-vpn/>) · [Wide area network (WAN)](<https://yellowcube.eu/glossary/wide-area-network/>) · [Network segmentation](<https://yellowcube.eu/glossary/network-segmentation/>) · [Firewall](<https://yellowcube.eu/glossary/firewall/>)

### Sources

[NIST SP 800-77 Rev. 1: Guide to IPsec VPNs](https://csrc.nist.gov/pubs/sp/800/77/r1/final) · [IETF RFC 4301: Security Architecture for IP](https://www.rfc-editor.org/info/rfc4301) · [IETF RFC 7296: Internet Key Exchange Protocol Version 2](https://www.rfc-editor.org/info/rfc7296)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.