Site-to-Site vs Client VPNs

VPNs come in two main flavors based on what they connect. A site-to-site VPN links whole networks together, while a client (remote-access) VPN connects a single user device to a network.

Both build encrypted tunnels, but they serve different needs: joining offices versus giving individual workers secure access from anywhere.

A site-to-site VPN connects two entire networks, like a head office and a branch, over the internet. The tunnel is built between the two sites routers or firewalls, called VPN gateways.

Once established, devices at each site communicate as if on one network, with no software needed on individual machines. The gateways handle all the encryption transparently.

In a site-to-site setup, every device at Site A sends traffic destined for Site B to its local VPN gateway. That gateway encrypts the traffic, sends it through the tunnel to Site B gateway, which decrypts and delivers it locally.

The users never configure anything; the always-on tunnel between gateways makes two distant offices feel like one continuous LAN.

A client VPN connects one device to a network. The user runs VPN client software that builds a tunnel to a VPN concentrator or firewall at the office, authenticating the individual user.

This is the classic work-from-home setup: a laptop anywhere in the world tunnels into the corporate network, gaining secure access to internal resources as needed.

The key differences:

• Site-to-site: gateway-to-gateway, always on, connects whole networks, no per-device software.
• Client: device-to-gateway, on demand, connects one user, needs client software.

Use site-to-site for permanent links between locations; use client VPNs for mobile and remote individuals.

Client VPNs can route traffic two ways. Full tunnel sends all of the device traffic through the VPN, even general web browsing, maximizing security and control.

Split tunnel sends only company-bound traffic through the VPN while normal internet traffic goes directly out. Split tunneling saves bandwidth but reduces the organization visibility and control over the user general traffic.

Organizations with many remote users deploy a VPN concentrator, a device built to terminate large numbers of client VPN tunnels at once, handling the heavy encryption load.

It authenticates users, assigns them internal addresses, and applies access policies. Often this role is built into the firewall, serving as the single secure entry point for all remote workers.

Site-to-site tunnels usually authenticate the two gateways using pre-shared keys or certificates, since the endpoints are fixed and trusted devices.

Client VPNs must authenticate individual people, so they rely on user credentials, certificates, and increasingly multi-factor authentication to ensure each remote user is genuinely who they claim to be before granting access.

Pick based on the connection need: connecting a branch office to headquarters permanently calls for a site-to-site VPN; enabling employees to work securely from home or the road calls for a client VPN.

Many organizations run both: always-on site-to-site links between offices, plus client VPN access for their mobile and remote workforce.

Newer approaches like ZTNA (Zero Trust Network Access) and SASE (Secure Access Service Edge) are evolving remote access. Rather than granting broad network access, they verify each request and connect users only to specific approved applications.

These build on VPN ideas but apply zero-trust principles, granting least-privilege access instead of dropping a user onto the whole network.

Site-to-site VPNs link whole networks gateway-to-gateway, always on, with no client software, ideal for connecting offices. Client VPNs connect individual devices on demand using VPN software, ideal for remote workers, and can use full or split tunneling. A concentrator handles many client tunnels, while ZTNA and SASE modernize the model.

Test your VPN type knowledge.

Site-to-site VPNs connect whole networks via VPN gateways, always on and software-free, joining offices. Client VPNs connect one device on demand with VPN software, ideal for remote users, supporting full or split tunneling. A VPN concentrator terminates many client tunnels, and ZTNA/SASE modernize remote access.