Site-to-Site VPN for Home and Small Office

A phone with a VPN app protects one device. But some situations are not about a device at all. A family wants the photo storage at home to be reachable from a parent's flat across town. A small shop wants its till system to talk to the printer and files at the owner's house. A designer wants the studio network and the home office to behave like one place. For these, the tool is a site-to-site VPN: a tunnel that joins two entire networks.

This article explains the idea in plain terms, shows what to plan before you build one, walks through the main design choices, and lists the mistakes that cause most failures. It does not give a step-by-step configuration for a particular router, because menus differ widely. It also makes one point clear early: a site-to-site VPN is not the same thing as a VPN service you buy to protect your browsing, and mixing them up leads to wasted effort.

What a site-to-site VPN is

Imagine two private networks. The home network uses one range of addresses, the office another. On the internet they are separate and cannot reach each other's private devices. A site-to-site VPN places an encrypted tunnel between a router or firewall at each location. After that:

• A laptop at the office can open a file share on the home NAS by its private address.
• A printer at home can be used from the office.
• Neither laptop runs any VPN software. The routers at each end do the tunnelling.
• Only traffic meant for the other site goes through the tunnel; everything else uses the normal internet.

The routers are the gateways. Each knows two things: the address range of the other site, and how to reach the other gateway across the internet. When a packet is addressed to the far network, the local gateway encrypts it, sends it across the internet to the other gateway, which decrypts it and delivers it. The principles behind IPsec-style tunnels are described in the NIST guide to IPsec VPNs, and modern lightweight alternatives such as WireGuard can do the same job.

How it differs from other VPN setups

People often use "VPN" for three quite different things.

Type	What connects	Typical use
Consumer VPN app	One device to a provider's server	Protecting traffic on public Wi-Fi, privacy from the local network
Remote-access VPN	One device to one private network	A worker dials into the office or home
Site-to-site VPN	One whole network to another	Two locations sharing devices and files
Mesh VPN	Many devices to each other directly	Reaching your own devices without opening ports (see mesh VPNs explained)

A paid pass for a consumer VPN service belongs in the first row. It is designed to connect your devices to the provider, and it is not designed to join your home and your shop into one network. If you want that, you build the link between your own gateways. For the differences between business and personal VPNs, see business VPN vs personal VPN, and for the trade-offs of running your own, self-hosted vs commercial VPN.

Questions to answer before you build

Most site-to-site failures come from skipped planning. Spend an evening on these questions.

1. What must be reachable? List the actual things: the NAS, the printer, the till, a camera recorder. A short list keeps the design simple and the firewall rules tight.
2. Who connects, and when? A link that is always on suits a shop with a shared printer. A link used once a week for backups can be started on demand.
3. Which devices can build the tunnel? Many routers and firewalls support some tunnel type. Consumer routers often do not. Check the specifications of both ends, and check whether they share at least one common tunnel technology.
4. How will each side find the other? At least one gateway must be reachable from the internet. Fixed public addresses make this easy. Home connections often change address, which is solved with a dynamic DNS name that always points to the current address.
5. Are the address ranges different? This is the single most important planning item, covered in the next section.
6. Who is allowed to do what? Decide whether the office can reach everything at home or only the NAS, and write that as firewall rules.
7. Who will maintain it? A link that only one person understands is a risk. Keep notes.

The address plan: the most common cause of trouble

Home and small-office networks nearly always use ranges from the private block defined in RFC 1918. The common default for home routers is 192.168.0.0/24 or 192.168.1.0/24. If both your home and your shop use 192.168.1.0/24, the tunnel has no way to know whether "192.168.1.20" means the printer at home or the till at the shop. Routing breaks.

Rules for a clean plan:

• Give each site its own range. For example, home 192.168.10.0/24 and shop 192.168.20.0/24.
• Change the range before you build, not after. Changing a range later means changing every device with a fixed address.
• Avoid the most common defaults such as 192.168.0.x and 192.168.1.x on both ends. Many visitors' networks and many hotels use them, which also causes trouble if you ever add a remote-access VPN on top.
• Leave room. If you may add a third site, reserve another range now.
• Write it down. A small table of site name, range, gateway address and purpose is enough.

If one of the two networks cannot be re-addressed, for instance because it belongs to a landlord, a different design, such as a mesh tool or per-device software, may be simpler.

Reachability: public addresses, dynamic addresses and shared carrier addresses

The gateways must be able to find each other.

• Fixed public address on one or both sides. Easiest. The side with the fixed address waits for the connection, and the other side initiates.
• Changing public address. Use a dynamic DNS name. Many routers and firewalls can update it automatically. Allow a minute or two of downtime when the address changes.
• No inbound connection possible. Some internet providers put many customers behind shared addressing, using the block described in RFC 6598. Then customers cannot receive incoming connections, and a direct link between two such homes will not work. Options include asking the provider about a public address, placing a small relay server somewhere with a public address, or using a mesh tool that arranges the connection through a coordination service.
• Double NAT. If your gateway sits behind an ISP box, you need to forward the tunnel's port to the gateway or put the ISP box in bridge mode. The concept is explained in VPN port forwarding explained.

Only the port used by the tunnel needs to be open on the side that receives the connection, and it should be limited to what the tunnel technology requires.

Routing and firewall rules

Once the tunnel is up, two more things must be correct.

Routes. Each gateway needs to know that the other site's range is reached through the tunnel. In many systems this is added automatically when you define the allowed networks; in others you add a static route. If one side lacks a route, traffic goes out one way and replies never return, which looks like "tunnel is up but nothing works".

Firewall rules. Treat the tunnel like a new network interface. Start by allowing nothing, then permit only what you decided in the planning list. For example:

• Shop to home: allow the NAS file-sharing service only.
• Home to shop: allow the printer and the till web page.
• Everything else: blocked and logged on your own equipment.

This matters because a site-to-site link joins networks that may contain devices with weak security: an old camera, a smart TV, a visitor's phone. If one network is compromised, a wide-open tunnel gives the intruder a path into the other. The modern view of limiting trust inside a network is discussed in zero trust vs VPN.

Three practical scenarios

Two family homes. The Costas keep a family photo NAS at their house. Grandparents live across town. A tunnel between the two routers lets the grandparents' tablet browse the NAS at its private address. The Costas allow only file-sharing from the grandparents' side. When the grandparents' internet address changes, a dynamic DNS name keeps the link alive.

A small shop and the owner's home. Priya runs a bakery. The till runs in the shop, and the accounts spreadsheet lives on a PC at home. She links the networks so the home PC can read daily sales files from the shop's share, with a rule allowing only that share. The shop and home ranges are different, which she planned before buying a firewall.

A studio with a spare room. Two designers share project files stored at the studio. One works from home three days a week. A site-to-site link would work, but a single remote-access connection from her laptop is simpler, since only one device needs to reach the studio. Choosing the smaller tool saves maintenance. This is a good reminder that site-to-site is for joining networks, not for one person's laptop.

Common mistakes

Mistake	Result	Better approach
Both sites use 192.168.1.0/24	Routing confusion	Give each site a unique range before building
Allowing everything through the tunnel	One weak device exposes both networks	Allow only the services you listed
Forgetting the router firmware	Known flaws stay open	Update both gateways on a schedule
Using a consumer VPN subscription as the link	It cannot join your networks	Build the link between your own gateways
No monitoring or notes	Nobody notices when the link fails	Keep notes and a simple status check
Weak shared keys or reused passwords	The tunnel itself becomes the weak point	Use long random keys and keep them private
Opening extra ports "to test"	A larger attack surface	Open only the tunnel port and close test rules

When something else is better

A site-to-site link is powerful but not always the right size.

• One person, one laptop. A remote-access connection or a mesh tool is simpler.
• Travelling devices. A link between two buildings does nothing for a phone at an airport. Use an app on the device. XPASS customers can use the free VPNclient app, listed on the download page, with the login details on their My Pass page.
• Sensitive business data. A business with legal or contractual duties should use professionally supported equipment and advice rather than a hobby build.
• Occasional file transfer. A properly protected cloud sharing service may be simpler than a permanent tunnel.

Also remember what a tunnel cannot do. It does not stop phishing, malware or stolen passwords. It does not replace backups. A file deleted at one site can disappear at the other if the share is writable.

Summary

A site-to-site VPN joins two private networks through an encrypted tunnel between two gateways, so devices at each end can reach selected devices at the other. Success depends mostly on planning: different address ranges, at least one reachable gateway, correct routes and tight firewall rules that allow only what you listed. It is a different tool from the VPN app on a phone, and a consumer VPN subscription is not a way to build it. If the need is smaller, choose a smaller tool.

If a simple personal VPN pass for your own devices is what you need alongside it, the pricing page is there at your own pace.