The Secure Tunnel
Imagine you need to send a confidential letter through a public postal system. You can't trust the postal workers not to read it. So you put the letter inside a locked box, send the locked box through the mail, and the recipient uses their copy of the key to open it. The postal system carries the box without being able to read the contents.
A Virtual Private Network (VPN) works the same way. It creates a secure, encrypted "tunnel" over the public, untrusted internet. Your data is encrypted before it leaves your network, travels across the internet as unreadable ciphertext, and is decrypted only when it arrives at the other end.
Site-to-Site VPN is the specific type used to connect entire networks — like your on-premises office to your cloud VPC — as opposed to a client VPN that connects a single laptop.
A site-to-site VPN requires two components:
- A Customer Gateway (CGW): Your physical or software router/firewall on the on-premises side.
- A Virtual Private Gateway (VGW) or Transit Gateway: The cloud-side endpoint that terminates the tunnel.
The two sides perform a handshake to authenticate each other and negotiate encryption keys. Once established, all traffic between the two networks flows through the encrypted tunnel automatically.
VPN limitations to understand: Because VPN traffic travels over the public internet, performance is subject to internet conditions — variable latency, occasional packet loss, and bandwidth contention. For most workloads this is acceptable. For latency-sensitive or high-throughput workloads (databases, large file transfers, real-time analytics), you need a dedicated physical connection, which we cover in the Direct Connect section.
Key Point: VPNs provide encryption and authentication over untrusted networks at a fraction of the cost of dedicated physical links. They are the right default choice for connecting on-premises networks to the cloud when cost matters more than guaranteed performance.