Site-to-site vs point-to-site
Site-to-site and point-to-site are two VPN connection models that differ in what they connect. A site-to-site VPN links entire networks, for example two offices, so any device behind one location can reach devices behind the other transparently. A point-to-site VPN (also called a remote-access or client VPN) connects a single device, such as a laptop, to a remote network.
Site-to-site VPN links whole networks (e.g. two offices) so everything behind each can talk; point-to-site connects an individual device to a network.
The key distinction
- 01
Site-to-site connects networks: a tunnel joins two LANs so all their hosts can communicate without any per-device software.
- 02
Point-to-site connects an endpoint: an individual device runs a VPN client and gets access into the remote network, one device at a time.
- 03
Site-to-site is typically always-on infrastructure between fixed locations; point-to-site is usually on-demand, driven by a user connecting.
- 04
They're complementary: many organizations link offices with site-to-site tunnels and give travelling staff point-to-site access.
When to use site-to-site
Site-to-site is the right model when you need locations to behave as one network: branch offices reaching a data center, two offices sharing systems, or on-prem connecting to a cloud environment. The tunnel runs between the networks' gateways, so every host behind each site gets connectivity automatically and nothing has to be installed on individual machines. In a mesh, site-to-site is the natural shape: each site runs a gateway, and the gateways link the sites into one fabric.
When to use point-to-site
Point-to-site suits individual users who need access from wherever they are: remote workers, contractors, administrators connecting to systems. Each device runs a client and authenticates to gain access to the remote network. It is flexible and user-driven, but it scales per device and per user rather than per location. Modern zero-trust approaches refine point-to-site by granting access to specific systems by role instead of putting the device on the whole network.
How this relates to Vexaro Mesh (in development)
Vexaro Mesh, now in development, is designed around the site-to-site model: gateways at offices, data centers and clouds join one full mesh, so whole networks connect and everything behind each site can reach the rest without a client on each device. Pricing is planned per connected site, not per user or device, and the same fabric is designed to support zero-trust, role-based access to specific internal systems.
See the planned features