Definition
A site-to-site VPN connects two entire networks rather than individual users. Each side has a VPN gateway — typically a router, firewall appliance, or cloud gateway — and the gateways maintain a permanent encrypted tunnel between them. Devices on either side can communicate with devices on the other as if they were on the same physical network. Users do not run VPN clients themselves; the gateways handle everything.
Common Use Cases
Connecting branch offices to corporate headquarters. Joining on-premises data centers to cloud environments (AWS, Azure, Google Cloud each offer site-to-site VPN gateways). Linking partner organizations for shared access to specific resources. Replacing or supplementing dedicated leased lines (MPLS, point-to-point fibre) with cheaper internet-based encrypted tunnels.
Protocols
IPSec is the dominant protocol for site-to-site VPNs because it is supported by virtually every networking vendor and runs cleanly between gateways without per-user state. WireGuard is a newer entrant that is gaining traction for its simpler configuration and better performance, particularly in cloud-to-cloud scenarios. SD-WAN solutions and SASE platforms increasingly subsume site-to-site VPN functionality into broader managed services.
In Practice
Site-to-site VPNs are usually built with IPsec on routers or firewalls, or with managed cloud gateways from AWS, Azure or Google Cloud. They are business infrastructure rather than something a consumer VPN app provides. If you only want to reach your home network while away, a remote-access setup or a mesh tool such as Tailscale is simpler.