Setting Up Secure Site-to-Site VPNs with OpenVPN for Remote IT Teams

As companies transition to distributed workforces, remote IT teams face a unique challenge: managing and accessing infrastructure securely across different physical locations. While individual employees can use standard client-to-site VPNs, IT departments managing cross-office servers, cloud environments, and branch networks require a more robust solution. A Site-to-Site VPN bridges two or more entire local networks over the public internet, making them function as one secure, unified network.

OpenVPN stands out as the industry standard for this task. It is open-source, highly configurable, and utilizes top-tier cryptography (OpenSSL) to ensure that sensitive company data remains strictly confidential during transit.

Site-to-Site VPN Architecture. Sumber: takayib / Getty Images

Site-to-Site vs. Client-to-Site: What is the Difference?

Understanding the architectural differences helps in choosing the right deployment for your team's needs.

Feature	Client-to-Site (Remote Access)	Site-to-Site (Network-to-Network)
Primary Use Case	Individual remote workers connecting from coffee shops or homes.	Connecting two fixed office locations or a local office to a cloud VPC.
Software Requirement	Every individual user must install and run a VPN client on their device.	Only the main routers/gateways run the VPN software.
Network Visibility	Connects a single device to the corporate network.	Connects entire subnets together (e.g., Office A can see servers in Office B).
Maintenance	High overhead (managing hundreds of individual client certificates).	Low overhead (set up once on the gateway, serving all devices behind it).

Step-by-Step Implementation Guide

Setting up a Site-to-Site VPN requires configuring one machine as the central OpenVPN Server (Headquarters) and another as the OpenVPN Client (Branch Office). The following technical sequence outlines the core steps for a secure deployment on Linux-based systems.

1.Generate the Static Key or PKI Infrastructure:Establishing the cryptographic foundation.

For a secure Site-to-Site connection, you can use a Public Key Infrastructure (PKI) with certificates, but for a direct, two-point connection, a pre-shared static key offers excellent security with less complexity. On your main server, generate the static secret key using OpenVPN's built-in command:

Bash
openvpn --genkey secret static.key

Once generated, securely transfer this static.key file to the branch office router using a secure method like SCP or SFTP. Never send this key over unencrypted email.

2.Set Up the OpenVPN Server Configuration:Configuring the Headquarters network.

On the central server, create a configuration file named server.conf. You must define the local and remote endpoints, the IP tunnel addresses, and the routing instructions so the server knows how to reach the branch's local network.

Plaintext
dev tun
ifconfig 10.8.0.1 10.8.0.2
secret /etc/openvpn/static.key
route 192.168.2.0 255.255.255.0
cipher AES-256-CBC
keepalive 10 60
ping-timer-rem
persist-tun
persist-key

(In this example, 192.168.2.0 is the local subnet of the branch office).

3.Set Up the OpenVPN Client Configuration:Configuring the Branch Office network.

On the branch office gateway, create a corresponding client.conf file. It mirrors the server's configuration but points to the server's public IP address.

Plaintext
remote [YOUR_SERVER_PUBLIC_IP]
dev tun
ifconfig 10.8.0.2 10.8.0.1
secret /etc/openvpn/static.key
route 192.168.1.0 255.255.255.0
cipher AES-256-CBC
keepalive 10 60
ping-timer-rem
persist-tun
persist-key

(Here, 192.168.1.0 represents the local subnet of the headquarters).

4.Enable IP Forwarding and Firewall Rules:Ensuring traffic can flow between the subnets.

By default, Linux systems drop traffic that is not explicitly destined for them. You must enable IP forwarding on both the server and the client to allow traffic to pass through the VPN tunnel into the local networks.

Bash
echo 1 > /proc/sys/net/ipv4/ip_forward

Next, configure your iptables or UFW firewall to allow incoming UDP traffic on port 1194 (the default OpenVPN port) and allow forwarding across the tun interface.

Conclusion

Implementing a Site-to-Site VPN using OpenVPN transforms fragmented physical locations and cloud environments into a singular, cohesive, and highly secure network. By shifting the encryption burden to the network gateways rather than individual user devices, IT departments can ensure that all cross-site data synchronization, internal API calls, and administrative access occur within a protected tunnel. This architecture not only fortifies enterprise security against external interception but also drastically simplifies network management, allowing remote IT teams to maintain absolute control over their infrastructure regardless of geographical boundaries.