Site-to-site VPN

A site-to-site VPN connects entire networks to each other, such as a head office, a branch office, and a data center. A VPN gateway at each site, often a router or firewall running IPsec, keeps a tunnel open to the gateway at the other site. Devices at one site reach devices at the other through the two gateways without running any VPN software themselves.

That convenience comes at a cost. All traffic between sites funnels through the gateways, which caps bandwidth and makes them a single point of failure. Access is usually network-wide, so anything at one site can reach anything at the other unless separate firewall rules say otherwise. The sites’ address ranges can’t overlap, and every new site means configuring tunnels on the existing gateways.

Connecting sites with Managed Nebula

Managed Nebula connects hosts rather than whole networks. You run DNClient on the hosts at each site, and each one connects directly to the hosts it’s allowed to reach, wherever they are. There are no gateways to pair up, and adding a site, a cloud region, or a laptop is just enrolling more hosts.

Each host’s firewall rules decide who can reach it and on which ports, so linking two sites doesn’t open everything at one to everything at the other. Hosts talk using their overlay addresses, so it doesn’t matter if two offices both use 192.168.1.0/24 locally.

Devices that can’t run DNClient

Printers, industrial controllers, and managed cloud databases usually can’t run DNClient. For those, a Linux host at the same site can act as a router. You create a route naming the router host and the subnet behind it, and only hosts with the tag you choose can use it. The route has its own firewall rules, which can narrow access to specific addresses and ports in that subnet. See Extend network access beyond overlay hosts.