Enterprise VPN: connect two sites securely

This article was machine-translated from French and is being reviewed. Prices are in Algerian dinars excl. VAT.

A VPN (Virtual Private Network) creates an encrypted and authenticated tunnel over the Internet. If your company has two sites, a site‑to‑site VPN connects them: devices at each site access the other’s servers and printers as if they were on the same network, without traffic being readable on the Internet. For remote workers, we talk about a remote access VPN. This guide focuses mainly on site‑to‑site and notes differences for remote access.

How does an enterprise VPN work?

Basic principle

Take two sites:

• Site A: network 10.10.1.0/24, router or firewall at 10.10.1.1.
• Site B: network 10.10.2.0/24, router or firewall at 10.10.2.1.

Each site accesses the Internet through its operator, with its own public IP address. Without a VPN, sharing a server between A and B forces it to be exposed on the Internet. With a VPN, firewall A encrypts packets destined for 10.10.2.0/24 and sends them to firewall B, which decrypts them and forwards them to the target device. For computers, it is transparent: they reach an address on the other site, e.g., 10.10.2.20, as a local address.

Two conditions. First, the two networks must use different address ranges. Second, each firewall must know the route to the other network (in IPsec these are traffic selectors; in WireGuard, the “AllowedIPs”) and rules must allow the desired flows.

Authentication and encryption

Before any exchange, each end must prove its identity, otherwise a fake firewall B could impersonate the real one. Three methods exist:

• Pre‑shared key (PSK), in IPsec: a secret entered beforehand on both firewalls. Choose it long and random.
• Certificates, in IPsec and OpenVPN: each end presents a certificate signed by an authority (CA) that the other recognizes.
• Key pairs, in WireGuard: each end has a private key and a public key; on each firewall, the other’s public key is declared. There is no certificate or authority to manage.

The data are then encrypted. IPsec negotiates its algorithms (typically AES). WireGuard does not negotiate: it uses a fixed suite, with ChaCha20 and Poly1305 for encryption and Curve25519 for key exchange.

VPN technologies: IPsec, WireGuard, OpenVPN

Some manufacturers also offer an “SSL VPN” with their own client. It is brand‑specific: it serves remote access, not linking two devices of different brands.

IPsec

IPsec is an open IETF standard, introduced in the 1990s and present on almost all enterprise firewalls. Use IKEv2 (RFC 7296) rather than the older IKEv1.

Advantages

• Interoperability: a MikroTik, a FortiGate, a Cisco or a pfSense can create a tunnel between them.
• Maturity: decades of deployment and audits.
• Integrated IKEv2 clients in several systems for remote access.

Limitations

• Many parameters must match on both sides: IKE version, algorithms, lifetimes, traffic selectors. A single difference prevents the tunnel from coming up.
• Diagnosis requires reading logs from both ends.
• Behind a NAT, traffic is encapsulated in UDP 4500, which must be allowed on the firewalls.

WireGuard

WireGuard is newer. It is integrated into the Linux kernel since version 5.6 (March 2020), available in MikroTik RouterOS 7 and OPNsense, and as a module in pfSense.

Advantages

• Short configuration: a few lines per side.
• Reduced source code, so easier to audit.
• Session keys are renewed automatically, about every two minutes as long as the tunnel carries traffic.

Limitations

• Not all equipment supports it, especially older enterprise firewalls: check the datasheet before choosing.
• No algorithm choice: it is a design quality, but this may not suit if other algorithms are required.
• For remote access, there is no user directory: a key pair per device, managed manually.
• Less deployment history than IPsec in large organizations.

Setting up an enterprise VPN at AsloTech

AsloTech supplies and installs MikroTik and Fortinet firewalls, which carry the tunnel. The method proceeds in four steps:

1. Diagnosis: visit both sites. We record the type of Internet connection (fiber, ADSL, 4G or 5G), the presence of a reachable public IP address, available upstream bandwidth, existing equipment and its addressing plan.
2. Protocol choice: WireGuard if both devices support it; otherwise IPsec with IKEv2, or if the brands differ and one does not support WireGuard. Between a MikroTik and a FortiGate, IPsec with IKEv2 is the common choice, since both support it; for WireGuard on a FortiGate, check the manufacturer’s documentation to confirm that the FortiOS version supports it.
3. Installation: non‑overlapping addressing plan, configuration of both firewalls, key exchange, routes, and rules limited to necessary flows.
4. Tests : recipe tests and commissioning. Tunnel climb, ping in both directions, access to real services (file sharing, printer, business application), cut‑over and restart test, configuration backup.

Quote reference points. Rough figures observed on our confirmed quotes. Each amount comes from a single quote: they are not averages.

• Implementation of a WireGuard VPN solution: 65,000 DA HT.
• Configuration of an additional VPN user: 6,000 DA HT.

Example calculation, not a quote: a WireGuard implementation with 5 additional users would cost 65,000 + 5 × 6,000 = 65,000 + 30,000 = 95,000 DA HT, if users are billed as on this quote. The real price depends on the number of sites, existing hardware and complexity. The firewall itself (MikroTik or Fortinet), its possible licenses and installation are quoted on a proposal.

Use cases and pitfalls

Common use cases

• Two or three offices or stores permanently connected: access to the file server, management application, camera recorder.
• Remote work: a remote access VPN avoids opening Remote Desktop (RDP, port 3389) to the Internet.
• Remote cameras : the VPN replaces port forwarding (see remote access to cameras). Regulation forbids connecting public‑sector surveillance systems or those filming open public space to the internet (executive decree no. 09‑410 amended by decree no. 16‑61, art. 20 bis); check your situation before enabling remote access.
• Off‑site backup: copying backups to the other site (see rule 3‑2‑1).
• Telephony: an IP switchboard can serve a remote site via the tunnel, if upstream bandwidth and latency allow (see IP telephony and service continuity and IP or analog switchboard).
• Redundancy: two Internet connections (e.g., fibre and 4G) with two tunnels and automatic failover.

If the two buildings are close, a wired link may be simpler and more stable than a VPN: see optical fibre or copper for two buildings.

Common pitfalls

• Address overlap: many routers use 192.168.1.0/24 or 192.168.0.0/24 by default. If both sites share the same range, the VPN cannot distinguish them. Re‑address one of the sites before building the tunnel.
• Unreachable public address: on a 4G or 5G connection, the operator may share one public address among several subscribers (CGNAT), making the site unreachable from the Internet. The VPN can work if the other site is reachable: the hidden endpoint initiates the connection. If neither is reachable, request a public address from the operator or use a relay server. If the public address changes, use dynamic DNS. Verify this before promising a VPN.
• Upstream bandwidth: the tunnel speed is limited by the upstream bandwidth of the sending site, often much lower than downstream. Measure it.
• MTU: encapsulation adds bytes to each packet. Typical symptom: small exchanges pass, large transfers block. Set the tunnel MTU (1420 by default for WireGuard) or use MSS clamping.
• Power outages: power router and modem on UPS, and test that the tunnel reconnects automatically when power returns.
• Too broad rules: connecting two networks does not mean allowing everything. Limit traffic by network, by machine and by port, using a VLAN segmentation.

VPN security

A well‑configured VPN protects traffic between its two endpoints, but it does not protect everything:

• Inside the tunnel, traffic is encrypted. It is unreadable to anyone intercepting it on the Internet.
• Inside each local network, the VPN does not encrypt anything. The tunnel ends at both firewalls. A compromised host sees traffic on its network and can reach the other site if rules allow.
• A site‑to‑site VPN authenticates two devices, not people. For remote access, create a user account per person, enable multi‑factor authentication if the device supports it, and disable an employee’s account when they leave.
• The VPN service itself is exposed to the Internet. Keep the firewall updated and open only the VPN port.

Combine the VPN with a properly configured firewall. To choose the equipment that will carry the tunnel, see MikroTik, Fortinet or Cisco.

Next steps

See our page on network security and firewalls to assess your needs, or our page on computer networks for cabling and active equipment. Also read how to segment your network with VLANs to limit what flows between sites, and why a firewall is essential to protect your VPN entry point.

Frequently asked questions

Also read