I am trying to set up a small network for my startup. We have 2 small servers at separate locations and would like to set up a vpn thorugh which the 2 servers can talk to each other and through which we can connect to them both. My understanding is that I have 2 options:

A) The first option is using a router which has site to site vpn support and have the following setup:

server1 - router1 - internet - router2 - server2

B) The second option is using a firewall which supports site to site vpn:

server1 - firewall1 - router1 - internet - router2 - firewall2 - server2

These servers are streaming data from internet (ca.50Mb/s, though this could increase in future) and need to send data mostly just to each other.

Did I understand this situation correctly or are there other solutions?
What are the benefits of option A and B?

  • Removed the opinion-based question.
    – Ron Maupin
    May 14, 2021 at 17:21
  • Personally, I always do tunneling on firewalls, not routers (with the exception of DMVPN since firewalls don’t support it). I find tunnels are generally easier to manage and troubleshoot on firewalls than they are on routers.
    – Jesse P.
    May 14, 2021 at 20:18
  • @JesseP. what in particular do you find easier about setting up the vpn over a firewall vs on router?
    – sev
    May 16, 2021 at 12:01
  • @JesseP. do you think DMVPN would be a good solution for my situation?
    – sev
    May 16, 2021 at 12:06
  • @sev Firewalls generally support more options for granularity than a router. I usually find that routers generally have very basic tunneling capabilities but few of the extra things people may want.
    – Jesse P.
    May 16, 2021 at 12:16

1 Answer 1


Either one will work, since the line between router and firewall is sometimes blurry. You would probably choose one or the other based on the capabilities of the devices.

If you went with option A, presumably the router also has some "firewall functionality" to protect your servers. If not, you will still need a firewall.

If your data is not particularly sensitive, you could have public addresses for your servers and just let them directly talk to each other -- no VPN needed. Of course, you would have filtering in place to only allow your specific addresses to talk to each other, and block out the rest of the Internet.

  • I'm assuming that the firewall solution is likely to be more expensive though, is that correct? I am leaning to rather set up a vpn even though our data is not super sensitive since I feel like I am less likely to make some mistake as I do not have much experience.
    – sev
    May 16, 2021 at 12:06
  • Not necessarily. Prices vary quite a bit.
    – Ron Trunk
    May 16, 2021 at 12:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.