How to Set Up a VPN Between Two Offices

A site-to-site VPN creates an encrypted connection between two office networks, allowing staff in Sydney to access files, applications and printers in Melbourne as if both locations were part of one private network. Traffic travels across the public internet, but encryption prevents outsiders from easily reading or altering it.

This arrangement suits small Australian businesses that use cloud services alongside a local NAS, accounting system or shared server. It can also connect a head office with a warehouse, retail shop or regional branch without paying for a private leased circuit.

A reliable design depends on compatible routers, stable internet connections and carefully planned IP addresses. Before changing equipment, document the existing network, identify which services need remote access and decide how users will be authenticated.

Check the internet and network requirements

Each office needs a business-grade router or firewall that supports an IPsec site-to-site VPN, with WireGuard available as an alternative where supported. Many modern security appliances offer setup wizards, but both devices must use compatible encryption, authentication and key-exchange settings.

NBN connections are often sufficient for ordinary file access and office applications, although upload speed can limit backups between locations. A branch in regional Queensland or Western Australia may also experience higher latency than an office in Sydney or Melbourne, so test performance during busy business hours rather than relying only on advertised speeds.

Give each office a different private subnet. For example, the Sydney office could use 192.168.10.0/24, while the Melbourne office uses 192.168.20.0/24. Overlapping ranges prevent routers from knowing whether a request belongs locally or must cross the tunnel.

Choose a secure VPN design

IPsec is widely supported by business routers and is a practical choice when different brands are used at each site. WireGuard is generally simpler and efficient, but it is not available on every firewall. Avoid using a consumer remote-access VPN profile when the requirement is a permanent connection between complete networks.

Use a strong pre-shared key or certificates, AES-256 or an equivalent modern cipher, SHA-2 authentication and secure Diffie–Hellman settings. Disable obsolete protocols and weak algorithms. Keep router firmware current, because the VPN gateway protects both offices and is an attractive target for attackers.

Australian organisations handling customer or employee information should also consider the Privacy Act 1988 and the Australian Privacy Principles. Encryption does not remove the need for access controls, logging and sensible retention policies, particularly when the tunnel carries payroll, health or identity data.

Configure routing and firewall rules

Create a tunnel policy that permits traffic from the Sydney subnet to the Melbourne subnet and in the reverse direction where required. Add routes for the remote network, then ensure the firewall allows only necessary services such as HTTPS, SMB, DNS or a specific database port.

Do not expose internal services directly to the internet simply because a VPN is available. Restrict access by source subnet and, where possible, by device or user identity. File shares should remain unavailable to guests and personal devices unless there is a clearly documented business reason.

Network address translation can interfere with site-to-site traffic, so configure a no-NAT or VPN exemption rule for traffic moving between the two office ranges. If either location uses carrier-grade NAT, common with some residential and mobile services, a traditional inbound tunnel may fail; use a firewall with a public address or a managed rendezvous option.

Handle changing addresses and office equipment

A fixed public IP makes the connection easier to maintain, but it may cost extra on an Australian business plan. Dynamic DNS can provide a stable hostname when an ISP changes the address. Confirm that the DNS record updates securely and that both firewalls can reconnect automatically after a modem restart.

Place the VPN firewall behind a UPS if a short power outage could interrupt operations. Label the WAN and LAN interfaces, record the administrator credentials in a password manager and keep a backup of the configuration offline. A Synology NAS or similar storage device should use the tunnel for controlled replication rather than unrestricted administrative access.

Separate visitors and smart devices from business systems with VLANs. This is especially useful in mixed-use premises where staff connect laptops, point-of-sale equipment, cameras and guest Wi-Fi to the same internet service. Practical networking and security updates can also be tracked through networking news before selecting replacement hardware.

Test performance, failover and access

Test the tunnel from both offices using ping, DNS lookup and the actual applications employees depend on. Verify that a Melbourne user can reach an approved Sydney file share, while an unauthorised device cannot access the server management interface. Measure latency, throughput and packet loss at different times of day.

Check whether large backups consume all available upload capacity. Schedule replication overnight, apply bandwidth limits and use file versioning so a corrupted or encrypted source does not immediately overwrite every copy. A VPN protects data in transit; it does not replace endpoint protection or independent backups.

Record the tunnel settings, permitted networks, public hostnames and recovery contacts. Review firewall logs for repeated authentication failures and confirm that alerts reach someone responsible. Test reconnection after an ISP outage, router reboot and changed public IP before relying on the link for daily operations.

A sensible rollout starts with one low-risk service, such as access to a test share, followed by a short pilot with staff at both locations. Once the route and security rules behave correctly, move production services across during a scheduled maintenance window.

Begin by writing down the two offices’ current private IP ranges, internet providers and required applications, then check that the ranges do not overlap before purchasing or configuring any VPN-capable firewall.