Site-to-Site vs Remote Access VPNs: Choosing the Right Topology

VPNs come in two primary shapes based on what they connect. A site-to-site VPN joins two whole networks, allowing devices on each side to reach the other as if it were local — no software is needed on the devices. A remote access VPN connects one device (such as a laptop or phone) into a network using a client that runs when needed.

Site-to-Site VPN

Overview

• Networks: Connects networks to networks.
• Gateways: The gateways at each end — routers or firewalls — hold the tunnel, and everything behind them rides across automatically. A laptop in Office A talks to a server in Office B by its normal address; neither device knows a VPN exists.
• Always-on and Transparent: The tunnel stays up continuously, and endpoints need zero configuration.
• Authentication: Between the two gateways — a pre-shared key or certificates identify the sites to each other (not individual users).
• Use Cases:
  • Branch office to headquarters
  • Hybrid cloud (on-premises network to a cloud VPC)
  • Homelab linking your lab to a cheap VPS for public presence behind CGNAT

Example Diagram

flowchart TD
    A[Office A] --> B[Gateway A]
    C[Office B] --> D[Gateway B]
    B --> E[Network A]
    D --> F[Network B]

Remote Access VPN

Overview

• Device: Connects one device to a network.
• Client: The user runs a client that dials in when needed; the connection is brought up and torn down as needed.
• Authentication: Of the user — typically a username and passphrase plus multi-factor, often checked against a directory or RADIUS server.
• Use Cases:
  • Working from home into the corporate LAN
  • Reaching your homelab's services from a phone while traveling
  • Contractors and "road warriors"

Example Diagram

flowchart TD
    A[User Device] --> B[VPN Client]
    B --> C[Network]

Full Tunnel vs Split Tunnel

• Full Tunnel: Sends all of the client's traffic through the VPN — most secure but adds latency and backhauls personal browsing.
• Split Tunnel: Sends only specific corporate or lab subnets through the VPN, allowing other traffic to go directly to the internet — faster and lighter but less visibility for the network owner.

Example Diagram

sequenceDiagram
    participant UserDevice
    participant Client
    participant NetworkA
    participant NetworkB
    UserDevice ->> Client: Connect
    Client ->> NetworkA: Full Tunnel (all traffic)
    Client ->> NetworkB: Split Tunnel (specific subnets only)

Beyond the Two

• Hub-and-Spoke: Connects many remote sites back to one central hub — simple but the hub is a chokepoint and single point of failure.
• Full Mesh: Connects every site to every other — resilient but N-squared tunnels to manage.
• Overlay / Mesh-VPN Products: Built on WireGuard, they make every device and network a peer in one flat mesh, so "site-to-site" and "remote access" stop being separate setups. Examples include Tailscale, Netbird, ZeroTier.

Consumer-VPN Clarification

When an ad says "get a VPN," it typically refers to a remote access VPN into the provider's network for privacy and location change — not a third category. It does nothing to connect you to your own network.

Example Diagram

flowchart TD
    A[Consumer Device] --> B[Provider Network]

Choosing Between Topologies

• Site-to-Site: Use when joining networks that should always see each other (offices, lab-to-cloud).
• Remote Access: Use when individual people or devices need to reach a network from wherever they are.
• Many Setups Run Both: A homelab commonly has a site-to-site tunnel to a VPS and remote access for the owner to reach services from a phone. Modern overlay networks like WireGuard mesh can handle both.

By understanding these differences, you can choose the right topology for your network needs.

Related: IPsec vs SSL VPNs · IPsec fundamentals · CGNAT · RADIUS