• What is a Site to Site VPN?
• How do I set up a Site to Site VPN connection? 
  • Planning
  • Step 1: Set up VPN Server
  • Step 2: Set up VPN Client
  • Step 3: Connect to the VPN
• Limiting Access on Site to Site VPN Tunnels
• Connecting Multiple Sites
• Common Issues and Fixes

What is a Site to Site VPN?

Firewalla's Site to Site VPN allows you to connect two networks over encrypted links such that devices in one network can reach devices in the other network under the protection of Firewalla. Unlike client->server VPNs, the reachability of a site to site VPN is bidirectional.

Suppose you have offices or homes at two different sites, and both sites have separate networks with computers and servers connected. By setting up a Site to Site VPN connection, you'll be able to access shared devices such as file servers, printers, and video cameras bi-directionally between the two sites. Additionally, when using Site to Site VPN, Firewalla's IDS/IPS protection will still be active to ensure the privacy and protection of your data.

Note:

• Site to Site VPN connections can only be established on Firewalla boxes. Site to Site VPN connections must be recreated when network settings are changed on either the server or client side. 
• Firewalla MSP supports 3rd-party VPN connections using IPsec, a widely used protocol for secure site-to-site connections. Learn how to set up IPsec with Firewalla MSP VPN Client.

How do I set up a Site to Site VPN connection? 

Planning:

1. A site to site VPN setup requires 2 Firewalla boxes – one to be the VPN server and the other to be the VPN client.
2. To have networks reach each other, you will need to make sure they have different subnets. For example, if for one site you have a 192.168.20.x network, the other site CANNOT have a network with the same IP range. However, you may set up a 192.168.30.x subnet.
3. To connect multiple sites, you must set up a VPN server on one box and a VPN client on the others. Learn more about connecting multiple sites.

Step 1: Set up VPN Server 

You can choose the Firewalla box on any of your sites to establish a VPN server (Firewalla Red cannot serve as the server in a site to site VPN setup). 

To turn on VPN Server, tap VPN Server on your box's main page and turn on either the OpenVPN or WireGuard server. 

Then, tap Setup and follow the UI to set up port forwarding if required. 

For more details about Firewalla VPN Server setup, see our articles on OpenVPN Server Configuration and WireGuard VPN Server Configuration.

Step 2: Set up VPN Client

After setting up VPN Server on one site, you'll need to create a VPN connection using the VPN client feature on the other site. 

On the other Firewalla box:

• Go to the main screen, tap VPN Client, and tap + Create VPN Connection to create a new profile/connection.
• Choose Site to Site VPN as the type of new VPN connection
  A warning message will pop up. Tap continue to acknowledge.
• On the Select Peer Site page, select the Firewalla box with the VPN server enabled.
• You'll be asked to choose a protocol, OpenVPN or WireGuard. Pick the one you've enabled on the Server site in the last step. 
• Tap on Done to finish setting up the new VPN connection.

Note: In a Site to Site VPN connection, to allow traffic from the server site box, allow rules will be created automatically on the client site box. 

More details about setting up the VPN client can be found here: VPN client. 

VPN Profile Configurations:

After the VPN connection is set up, there are some options you can set:

• Outbound Policy:
  • Peer site subnets: The app will list all the subnets on the peer site in this section. The outbound policy of all the subnets will be set to VPN, which means when VPN-enabled devices access those subnets from your local network, Firewalla will send the traffic via VPN.
  • Internet: Direct or VPN
    Direct means VPN-enabled devices on the client side will use their default gateway for Internet access (devices on the server side will always use their default gateway).
    VPN means VPN-enabled devices will use the gateway on the VPN server site for Internet access.
    If you are using many cloud apps, you should set Internet to direct. If you want full traffic control, you should set Internet to VPN and filter on the server side.
     
• Force DNS over VPN: on or off
  When Force DNS over VPN is on, Ad Block, Family Mode, Safe Search, and DoH will not work on VPN-enabled devices. Other functions will still work, e.g., Blocking Rules, Ad Block, Safe Search, and Custom DNS Rules.
   
• Internet Kill Switch: on or off
  This option is ONLY available when the Internet option is set to VPN
  When it is on, Firewalla will be able to:
  • Detect and generate an alarm if VPN Connection encounters any error.
  • Auto disconnect the device's internet access if VPN is down
  • Detect and generate an alarm if the VPN Connection is restored.
• Policy-Based Routes: Firewalla policy-based routing can be used to route traffic to VPN or locally. See this article: Using Firewalla Policy Based Routing with VPN and Multi-WAN. 

Step 3: Connect to the VPN

To connect devices to VPN, switch on the "VPN" button on the VPN Client Box, and you'll see the status become "Connected." At this point, devices from the VPN server site can access the network on the VPN client site. 

To selectively send your devices' traffic through the VPN on the VPN client site, tap Apply To under the VPN connection, select the devices/networks/groups you'd like to connect to the peer (server) site, and tap Save. You can also tap the VPN button and select which VPN to connect to on any device/ network/group's detail page.

Note:

• Devices must be part of the Firewalla overlay network or in router mode to use VPN.
• Only 1 VPN can be connected between the same Server and Client simultaneously. 
• Up to 5 VPNs can be connected from a VPN client simultaneously.

Learn more in our article about Firewalla's VPN Client.

Additionally, you can use custom DNS entry rules to access devices across sites. Custom DNS rules are basically local rules that no DNS provider could answer because they refer to devices on your own network or, in some cases, different ways of calling devices external to your network. They can be used for many things, such as having multiple names for the same NAS server or a way to point to virtual IP addresses. You can think of custom DNS rules as a local address book. 

Limiting Access on Site to Site VPN Tunnels

If you have several networks on each site, Firewalla helps you manage communication between each network. While the VPN Client is active:

• Devices on the server network have access to client-side networks.
• Devices on the client network have access to server networks as long as the VPN Client is applied to those devices.

If you want to limit specific traffic, a combination of rules can help you easily manage access.

For the next scenarios, we'll assume the following setup: 

In the Server site, there are three networks:

• Database network: 192.168.100.1/24
• Private network: 192.168.11.1/24
• Guest network: 192.168.12.1/24

In the Client site, there are two networks:

• IoT network: 192.168.20.1/24
• Work network: 10.10.10.1/24

Scenario 1: Block a network in the Server site from accessing a specific Client site network

First, note down the IP range of the Client network that you're blocking access to. In this case, we want to block the Work network IP range of 10.10.10.1/24.

Then, add a rule to block the traffic on the Server network. You can also block access at the individual device or group level.

Scenario 2: Block a device/group/LAN on the Server network from accessing all Client networks

On your Server site box, create a target list with all Client networks included. In this case, we include the IoT subnet (192.168.20.1/24) and the Work subnet (10.10.10.1/24). Learn more about Target Lists here.

After creating the list, create rules to block any device, group, or network in the Server site from sending traffic to the specified Client networks.

If you are using the WireGuard protocol, Firewalla supports per-device management for WireGuard VPN clients. A target list is NOT required to block it at the network level.

A simpler solution is to block local traffic from the Server site network and apply it directly to the WireGuard client. 

Scenario 3: Only allow one Client network to access one Server network

When the Client network is connected to the VPN, it will have access to all networks in the Server site by default. If you want only ONE Client network to have access to a specific Server network, you may need to disable the VPN Client for your Client network and add a policy-based routing rule.

In this case, we created a new route rule to send the Database (IP range 192.168.100.1/24) traffic through the VPN Server on the Client's "Work" network.

Learn more in our article about Policy-Based Routing.

If you want to allow the devices on the Client network to access ONE device on the Server network (for example, a NAS with shared files), create a new route, similar to the example above, but matching the Server device's specific IP address instead of the IP range for the Server network.

Connecting Multiple Sites

In addition to connecting two sites, you can use multiple Site to Site VPN connections to connect additional boxes, so that devices on client sites can reach each other.

In this example, we assume the following subnets:

• Headquarters subnet: 192.168.100.0/24
• Subsidiary A subnet: 192.168.20.0/24
• Subsidiary B subnet: 192.168.30.0/24

On each client site, set up the Site to Site VPN. Then, create a "route" rule and send the traffic matching the subnet of the other client site to the VPN.

For example, for devices on subsidiary A (IP 192.168.20.X) to access the device on subsidiary B (IP 192.168.30.X) and vice versa, you can create a "route" rule and send only the traffic matching the subnets of the other client site to the VPN.

VPN Mesh

With VPN Mesh supported by Firewalla MSP, it is much simpler to connect multiple Firewalla units. When connecting multiple boxes with Site to Site VPN, all boxes must manually set up the VPN, and connections and rules must be manually configured for each pair. 

With VPN Mesh, Firewalla MSP handles the membership VPN mesh nodes, making it easier for users to configure everything. Learn more about VPN Mesh here.

Common Issues and Fixes

• Protocols supported: OpenVPN, WireGuard, and AmneziaWG. 
• Currently (as of September 2026), only OpenVPN supports IPv6 traffic.
  • For WireGuard and AmneziaWG, IPv6 traffic will NOT be routed to VPN. Make sure IPv6 is turned off (Go to Network > LAN network > turn off IPv6).
• Devices (i.e., laptops, phones, tablets, etc.) should not use local DNS servers.
• Devices must be part of the Firewalla overlay network or Firewalla in "Router mode" to use VPN.
• DO NOT use the same subnets between two sites. Doing so may cause connection issues.