A private tunnel through a public road system
Imagine a permanent private tunnel connecting two office buildings across an otherwise public city, versus a single traveler getting a temporary secure escort in from wherever they happen to be. Both get you the same guarantee, a protected path across territory you don't control, but they're built for completely different situations.
Site-to-site VPN
A permanent tunnel between two networks, usually built with IPsec in tunnel mode, connecting an entire office to another entire office (or to a cloud network). It's set up once by network administrators, and every device behind either gateway uses it automatically without any configuration of its own. A user at a branch office reaching a file server at headquarters has no idea a tunnel is even involved.
Remote-access VPN
An individual device connects in from wherever it happens to be, gets treated as if it were on the private network, and this is the kind most people actually interact with directly. It comes in a few common flavors: IPsec-based (often IKEv2/IPsec), an SSL/TLS VPN that can run through little more than a browser, and newer options like WireGuard, built from the ground up to be simpler to configure and faster than older options.
| Type | Connects | Typical protocol | Use case |
|---|---|---|---|
| Site-to-site | Network to network | IPsec, tunnel mode | Branch office to headquarters, always on |
| Remote-access (IPsec) | Device to network | IKEv2/IPsec | Managed corporate laptop VPN client |
| Remote-access (SSL/TLS) | Device to network | TLS | Lightweight or clientless remote access |
| WireGuard | Either | Its own modern protocol | Simpler configuration, strong performance |
With a remote-access VPN, an administrator can choose to route only traffic actually destined for the private network through the tunnel, letting everything else, general web browsing, go straight out the user's own internet connection. That's split tunneling: better performance and less load on the VPN gateway, at the cost of losing visibility and protection over that other traffic. The alternative, a full tunnel, routes everything through the VPN, slower but fully visible and protected.