What Is a VPN Gateway? Site-to-Site and Remote Access VPN

A VPN gateway is the device or software that terminates encrypted VPN tunnels between two networks, or between remote users and a network. A company office connecting to its cloud network, or employees securely accessing the company network from home, all happens through a VPN gateway.

In this article we explain how a VPN gateway works, the difference between site-to-site and remote access VPN, the protocols used and the setup options.

How Does a VPN Gateway Work?

A VPN gateway sits at the edge of the network and has two jobs:

1. Authentication: it verifies the identity of the party that wants to connect (another gateway or a user) with a certificate, a pre-shared key (PSK) or user credentials.
2. Encryption and routing: it encrypts traffic entering the tunnel, decrypts traffic coming from the other side and routes packets to the right destination on the internal network.

For the user or remote office, the process is invisible. Servers on the internal network are reached with private IP addresses as if they were on the same network.

Site-to-Site VPN vs Remote Access VPN

Feature	Site-to-site VPN	Remote access VPN
What connects	Two networks (e.g. head office ↔ branch, office ↔ cloud)	A single user device ↔ company network
Where the tunnel is built	Between two VPN gateways, always on	Between the user’s VPN client and the gateway, on demand
User software	Not needed; everyone on the network uses it automatically	A VPN client is required
Typical protocol	IPsec (IKEv2)	IKEv2, OpenVPN, WireGuard, SSL VPN
Example use	Branches accessing a shared ERP server	Staff working from home accessing a file server

Protocols Used by VPN Gateways

IPsec / IKEv2

The industry standard for site-to-site connections. It works across firewalls and routers from different vendors. Cloud providers’ virtual network gateways also usually use IPsec.

OpenVPN

TLS-based and flexible, it can run over TCP/UDP port 1194 or 443. It is common for remote access. See our OpenVPN setup guide.

WireGuard

A modern, lightweight and fast protocol; both site-to-site and remote access can be set up with just a few lines of configuration. See our WireGuard VPN setup article.

SSL VPN

A browser-based or client-based remote access solution commonly found on enterprise firewalls.

Types of VPN Gateways

• Hardware-based: the built-in VPN features of enterprise firewalls and routers.
• Software-based: strongSwan (IPsec), OpenVPN or WireGuard installed on a Linux server. An economical gateway can be set up on a VDS.
• Cloud gateways: managed VPN gateway services from cloud providers, used to connect a company network to a cloud virtual network.

Turning a Linux Server into a VPN Gateway: General Steps

1. Assign a static public IP to the server and update the system.
2. Choose the protocol (WireGuard/OpenVPN for remote access, IPsec for branch connections).
3. Install the software and create the keys/certificates.
4. Enable IP forwarding: net.ipv4.ip_forward=1.
5. Allow the VPN port in the firewall and add a NAT/masquerade rule if needed.
6. Define the networks that will pass through the tunnel (AllowedIPs, leftsubnet/rightsubnet).
7. Test the connection and watch the logs.

Security and Performance Tips

• Where possible, use certificate-based authentication instead of a pre-shared key.
• Add multi-factor authentication (MFA) for remote access.
• Give users access only to the internal networks they need (principle of least privilege).
• Split tunnelling sends only company traffic through the tunnel and saves bandwidth; a full tunnel lets you inspect all traffic. Choose according to your needs.
• Keep the gateway software and firmware up to date; VPN devices are frequently targeted.

Frequently Asked Questions

What is the difference between a VPN gateway and a regular VPN app?

A VPN app connects a single device to a server. A VPN gateway is the side where tunnels terminate, connecting an entire network to other networks or users.

Is a default gateway the same as a VPN gateway?

No. A default gateway is the router your device sends traffic to when it leaves the local network. A VPN gateway is a special gateway that manages encrypted tunnels.

Does a small business need a VPN gateway?

Yes, if remote staff access an internal file server, accounting software or admin panels. Keeping these systems behind a VPN is much safer than exposing them directly to the internet.