Your office and your cloud on one private network
Site-to-Site VPN joins your office network to your private network on Gewape Cloud through an encrypted IPsec tunnel. Give us your public IP address and your office subnet. We build a dedicated VPN gateway for you, generate the encryption settings and the key, and route your cloud servers through it.
From US$15 per tunnel/monthSee pricing
Service overview
Encrypted link from your office to your cloud
Overview
What Site-to-Site VPN delivers
Connect your office or another cloud to your private Gewape Cloud network over an encrypted IPsec tunnel.
Site-to-Site VPN creates an encrypted tunnel between your Gewape Cloud private network and another network, such as your head office, a branch, or a server room. Traffic crosses the internet but stays encrypted, so your office and your cloud servers reach each other on private addresses as if they were on the same network.
You order a tunnel from VPN in the Gewape Cloud Platform. Choose the region, enter the public IP address of your office firewall and the subnet behind it, and order. We create a dedicated gateway inside your own project, give it its own public IP address, and generate a strong pre-shared key. You then set up the matching tunnel on your firewall.
Your cloud servers on that private network use the tunnel straight away. We add the route for your office subnet to your network, so a server with no public IP address can reach your office without any change on the server.
A gateway of your own
Every tunnel gets a dedicated VPN gateway inside your own project, with its own public IP address. It is not shared with other customers.
Only your network is exposed
The tunnel joins your office to your own private network and nothing else. The gateway accepts tunnel traffic only from the public IP address you gave us.
No encryption settings to design
We set the encryption and generate a strong pre-shared key for you. You enter the same settings on your firewall instead of designing a policy.
Ordered from the console
Order, list and delete tunnels yourself in the Gewape Cloud Platform. No ticket and no change request.
Features
Key capabilities
What you get with Site-to-Site VPN, all managed from the Gewape Cloud Platform.
IPsec with IKEv2
Standard IPsec with IKEv2, AES-256 encryption, SHA-256 integrity and Diffie-Hellman group 14 (2048-bit). Works with common business firewalls and routers.
Strong pre-shared key
A long random pre-shared key is generated when the tunnel is created. It is shown once, with a button to copy all the tunnel details.
Routing done for you
We add the route to your office subnet on your private network, so your other cloud servers reach the office through the tunnel without extra setup.
Checks before it builds
The console checks that your peer address is a public IPv4 address and that your office subnet does not overlap your cloud network before anything is created.
Reconnects on its own
The gateway watches the link and keeps trying to bring the tunnel back if your side drops, so a router restart at the office does not need a call to us.
Works behind NAT
Tunnel traffic is always wrapped in UDP, so it passes through firewalls that translate addresses on your side.
Every live region
Choose the region where the tunnel ends. The gateway sits in that region, next to the servers it connects.
All tunnels on one page
VPN in the console lists your tunnels across every region with their status, and lets you delete one when you no longer need it.
How it works
How Site-to-Site VPN works
The steps you take in the Gewape Cloud Platform, from account to running service.
- 1
Order the tunnel
In the Gewape Cloud Platform, open VPN and click Order VPN Tunnel. Choose the city, then enter your office firewall's public IP address and the subnet behind it.
- 2
We build your gateway
We create a dedicated VPN gateway in your project with its own public IP address, generate the encryption settings and a pre-shared key, and add the route to your office subnet.
- 3
Save the details
The console shows the gateway's public IP address, your cloud subnet and the pre-shared key. The key is shown only once, so copy it straight away.
- 4
Set up your side
On your office firewall, create an IKEv2 tunnel with AES-256, SHA-256 and DH group 14, pointing at the gateway's public IP address with the pre-shared key. Once it is up, your cloud servers can reach the office.
Use cases
Where Site-to-Site VPN fits
How organizations use Site-to-Site VPN today.
Office to cloud servers
Small and mid-sized businesses
Let staff reach business applications on your cloud servers on private addresses, without opening those servers to the internet.
Core systems kept private
Banks, microfinance and insurers
Connect branch or head-office systems to applications and databases on Gewape Cloud that should never have a public address.
Hybrid IT
Enterprise IT teams
Keep some systems in your own server room and run others on Gewape Cloud, with one private network between them.
Moving to the cloud in stages
Teams migrating from on-premises
Move servers one at a time while the rest stay on site, and keep them talking privately during the move.
Private database access
Developers and data teams
Reach a database on a cloud server from your office over the tunnel, with no public port open on the database.
Clinics and back offices
Hospitals, clinics and laboratories
Link a site that holds sensitive records to its cloud systems over an encrypted, private path.
Governance
Operated by Gewape Cloud Infrastructure
Your regulator will ask where the data lives and who runs the infrastructure. For every Gewape Cloud product the answer is specific: the region you chose, operated by us.
What you can rely on
Registered as a data controller and data processor with the data protection authorities in Kenya and Rwanda.
Pricing
Published rates
What you pay for Site-to-Site VPN. Prices exclude VAT and local taxes; you are billed hourly in your account currency.
| Item | Price |
|---|---|
| Site-to-site VPN tunnel (its gateway server and public IPv4) | US$15 per tunnel/month |
Regions
Where Site-to-Site VPN is available
One product, the same everywhere it runs. You choose the region for every resource, and your data stays in it.
Also delivered by our team as part of a private cloud in Nigeria, South Africa, Singapore and Brazil. See all regions
FAQs
Frequently asked questions
Answers to the questions organizations ask before they commit.
What do I need on my side?
A firewall or router that supports IPsec with IKEv2 and a pre-shared key, a public IPv4 address, and the subnet of the office network you want to connect, written as a CIDR such as 192.168.10.0/24.
Which encryption settings does the tunnel use?
IKEv2 with AES-256 encryption, SHA-256 integrity and Diffie-Hellman group 14 (2048-bit) for the key exchange, and AES-256 with SHA-256 for the traffic itself. Your firewall must use the same settings.
Is the VPN gateway shared with other customers?
No. Each tunnel has its own gateway inside your project, with its own public IP address. The tunnel only joins your office to your own private network.
Do I have to change my cloud servers?
No. We add the route to your office subnet on your private network, so servers on that network reach the office through the tunnel. A server does not need a public IP address to use it.
Can my office subnet be the same as my cloud network?
No. The two sides must use different address ranges. The console checks this and tells you before it creates anything.
I lost the pre-shared key. What now?
The key is shown only once, when the tunnel is created. Delete the tunnel and order a new one to get a new key.
Where can the tunnel end?
In any live region; the Regions section on this page lists them. Choose the region where the servers you want to reach are running.
How is it billed?
Each tunnel is a published monthly rate that covers its dedicated gateway server and public IPv4 address, metered by the hour while the tunnel exists and billed with your other Gewape Cloud services. Accounts on a managed contract are invoiced at their agreed rate.
Get started
Start with Site-to-Site VPN
Your first steps in the Gewape Cloud Platform.
- 1
Sign in to the Gewape Cloud Platform and make sure you have a private network with your servers in the city you want to connect.
- 2
Find the public IPv4 address of your office firewall and the subnet of the office network.
- 3
Open VPN, click Order VPN Tunnel, choose the city, enter both values and an optional name, and order.
- 4
Copy the gateway IP address, your cloud subnet and the pre-shared key from the result. The key is shown only once.
- 5
Create the matching IPsec tunnel on your firewall, then test by reaching a cloud server on its private address.
Related services
Build the full workload
Gewape Cloud services are designed to compose together: compute, storage, networking, identity, data, and delivery controls in one sovereign platform.
Virtual Networking
Private networks, routers, public IP addresses and firewall rules for every workload.
Cloud Servers
Linux cloud servers on NVMe storage, billed by the hour, with free unlimited data transfer.
Managed Databases
PostgreSQL, MySQL and MariaDB instances we run for you, with backups you take on demand.
Load Balancer
Spread TCP and UDP traffic across healthy servers so one failure does not take you down.
Load Balancer
Spread TCP and UDP traffic across healthy servers so one failure does not take you down.
DNS
Host your domains on three nameservers and change records in seconds.