Tutorials · DevSecOps & Cloud
How to Connect Your Office to AWS or Azure With a Site-to-Site VPN
Reach cloud servers privately from the office without exposing them to the Internet. Build an IPsec site-to-site VPN between your gateway and an AWS or Azure VPN gateway, with redundant tunnels.
Before you start
- A gateway or firewall with IPsec (IKEv2) and a static public IP
- A cloud network (AWS VPC or Azure VNet) whose address range does not overlap your office
- Cloud admin rights
Step by step
Plan addresses
Office and cloud ranges must not overlap. Example: office 10.1.0.0/16, cloud 10.50.0.0/16.
AWS: create the gateways
Create a Customer Gateway with your office public IP, a Virtual Private Gateway (or Transit Gateway) attached to the VPC, and a Site-to-Site VPN connection. AWS gives you two tunnels and a downloadable configuration for common devices.
Azure: create the gateways
Create a GatewaySubnet and a Virtual Network Gateway (route-based VPN), a Local Network Gateway with your office public IP and ranges, and a Connection with a strong pre-shared key.
Configure your gateway
Enter the cloud peer IPs, pre-shared keys and IKEv2 / AES-256 / SHA-256 parameters from the cloud configuration. Configure both tunnels for redundancy.
Route the traffic
Use BGP if both sides support it, or static routes: office routes 10.50.0.0/16 into the tunnel, cloud route tables send 10.1.0.0/16 to the VPN gateway.
Open only what is needed
Cloud security groups / NSGs should allow only the office ranges and ports the applications need.
Test and monitor
Ping and connect to a cloud VM from the office, then disable one tunnel to test failover. Monitor tunnel status in the cloud console and on your gateway.
Pro tips
- Clamp TCP MSS on the tunnel (often 1379–1387 bytes for cloud VPNs) to avoid MTU problems.
- Cloud VPN gateways are billed per hour plus data: include them in your budget.
- For high throughput or strict SLAs, consider dedicated links (AWS Direct Connect, Azure ExpressRoute).
FAQ
Frequently asked questions
One tunnel or two?
Always two. Cloud providers do maintenance on one tunnel at a time; with only one, you will lose the connection.
Keep learning
Related guides
Site-to-site IPsec VPN basics
Read more →Fix MTU problems on VPN links
Read more →Design a hybrid cloud network
Read more →How to Scan Container Images, Code and IaC for Vulnerabilities With Trivy
Trivy is a free scanner for container images, file systems, Git repositories and infrastructure-as-code. Find vulnerable packages and misconfigurations before they reach production.
Read more →How to Generate an SBOM for Your Software and Scan It With Grype
A Software Bill of Materials lists every component in your software. Customers and regulations (such as the EU Cyber Resilience Act) increasingly ask for it. Generate SBOMs with Syft and check them for vulnerabilities with Grype.
Read more →How to Add Security Checks to a CI/CD Pipeline (Secrets, SAST, Dependencies, Images)
Shift security left: catch leaked secrets, insecure code, vulnerable dependencies and risky infrastructure settings automatically on every commit, before anything is deployed.
Read more →Stuck on a step?
Ask Navijin technical support or an authorised partner for help with your configuration.