Skip to content

Commit 5db01c5

Browse files
RoRoJRoRoJ
authored
feat(s2svpn): add public beta doc (#5901)
* feat(s2svpn): public beta * feat(s2svpn): finished public beta doc * fix(s2svpn): fix * fix(s2svpn): corrected index * fix(vpn): add info * fix(s2svpn): fix missing info
1 parent 1baf343 commit 5db01c5

File tree

10 files changed

+210
-14
lines changed

10 files changed

+210
-14
lines changed

‎menu/navigation.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,7 @@ import { serverlessContainersMenu } from "../pages/serverless-containers/menu"
5858
import { serverlessFunctionsMenu } from "../pages/serverless-functions/menu"
5959
import { serverlessJobsMenu } from "../pages/serverless-jobs/menu"
6060
import { serverlessSqlDatabasesMenu } from "../pages/serverless-sql-databases/menu"
61+
import { siteToSiteVpnMenu } from "../pages/site-to-site-vpn/menu"
6162
import { terraformMenu } from "../pages/terraform/menu"
6263
import { topicsAndEventsMenu } from "../pages/topics-and-events/menu"
6364
import { transactionalEmailMenu } from "../pages/transactional-email/menu"
@@ -208,6 +209,7 @@ export default [
208209
ipamMenu,
209210
loadBalancerMenu,
210211
publicGatewaysMenu,
212+
siteToSiteVpnMenu,
211213
vpcMenu,
212214
],
213215
label: 'Network',

‎pages/site-to-site-vpn/concepts.mdx‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
---
2+
title: Site-to-Site VPN - Concepts
3+
description: Understand the core concepts behind Scaleway's Site-to-Site VPN, including VPN and customer gateways, security proposals, routing policies and more.
4+
tags: site-to-site-vpn, vpn-gateway, customer-gateway, security-proposal, routing-policy
5+
dates:
6+
creation: 2025-12-05
7+
validation: 2025-12-05
8+
---
9+
10+
## ASN
11+
12+
An **A**utonomous **S**ystem **N**umber (ASN) is a unique identifier assigned to a network or group of networks that operate under a single administrative domain, and use a common routing policy on the internet. When creating a customer gateway, you are asked to provide its ASN, to enable dynamic routing using [BGP](#bgp) across the VPN. Each BGP peer must have a unique ASN to identify its routing domain.
13+
14+
## Border Gateway Protocol (BGP)
15+
16+
**B**order **G**ateway **P**rotocol is a standardized gateway protocol that allows autonomous systems to exchange routing information. Site-to-Site VPN uses BGP to facilitate route propagation, so that the VPC gateway and the customer gateway can learn each other's routes.
17+
18+
## BGP session
19+
20+
A BGP session is a dynamic routing connection between a customer gateway and a VPN gateway. It uses the **B**order **G**ateway **P**rotocol to exchange routing information in real time. It enables automatic updates to network paths, ensuring resilient and adaptive communication across a site-to-site VPN tunnel.
21+
22+
## Connection
23+
24+
A connection represents the configuration of a secure link between a VPN gateway and a customer gateway. It defines all the characteristics of the Site-to-Site VPN tunnel between the two, including routing policy and encryption method.
25+
26+
## Customer gateway
27+
28+
A customer gateway is a logical resource representing the physical or virtual gateway device on the customer (remote) side of a Site-to-Site VPN tunnel.
29+
30+
## Customer gateway device
31+
32+
A customer gateway device is a real physical or software-based networking device, located on the remote network you want to connect to your Scaleway VPC. The customer gateway that you create in Scaleway is a logical representation of this device.
33+
34+
## IPsec
35+
36+
**I**nternet **P**rotocol **Sec**urity (IPsec) is a suite of protocols used to secure IP communications by authenticating and encrypting each IP packet in a data stream. In the context of Scaleway Site-to-Site VPN, IPsec provides end-to-end security for traffic flowing through the VPN tunnel between a VPN gateway and a customer gateway.
37+
38+
## Pre-shared key (PSK)
39+
40+
A pre-shared key (PSK) is a shared secret string, generated by Scaleway and known by both the VPN gateway and customer gateway. It is used to verify the identity of both gateways and establish secure, encrypted communication between them. Each PSK generated for Site-to-Site VPN is securely stored in [Scaleway Secret Manager](/secret-manager/).
41+
42+
## Routing policy
43+
44+
By default, all routes across a VPN connection are blocked. A routing policy allows you to set filters to define the IP prefixes to allow. You can whitelist multiple outgoing routes and multiple incoming routes per policy.
45+
46+
## Route propagation
47+
48+
Route propagation can be activated or deactivated on each VPN connection. When activated, route propagation launches BGP sessions, so the customer gateway and VPN gateway can dynamically exchange route information using the attached routing policies. This allows traffic to flow over the connection. When route propagation is deactivated, no traffic can flow.
49+
50+
## Security proposal
51+
52+
A security proposal (aka IPSec proposal) defines the encryption and authentication methods used to secure an IPSec VPN tunnel. You must define a security proposal when creating a VPN [connection](#connection).
53+
54+
## Site-to-Site VPN
55+
56+
Site-to-Site VPN lets you securely connect your Scaleway VPC to your remote infrastructure, enabling encrypted data exchange over a private VPN tunnel. Integrated with VPC routing, traffic destined for your remote infrastructure can reach it from your VPC via the secure VPN tunnel, and vice versa. Site-to-Site VPN connections are secured with Internet Protocol security (IPsec).
57+
58+
## Tunnel
59+
60+
A VPN connection creates a VPN tunnel between a customer gateway and a VPN gateway. This tunnel is established between the two gateways' public IPv4 or IPv6 addresses. The tunnel is secured with IPsec, and traffic can securely flow through it.
61+
62+
## VPN gateway
63+
64+
A VPN gateway is a managed resource that acts as a connection point on the Scaleway side of your Site-to-Site VPN tunnel. Each [connection](#connection) within the gateway represents an IPsec tunnel towards a [customer gateway](#customer-gateway), established over the public internet. A single VPN gateway can host multiple connections.

‎pages/site-to-site-vpn/faq.mdx‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
title: Site-to-Site VPN - FAQ
3+
description: Find answers to frequently asked questions about Scaleway Site-to-Site VPN, including setup, troubleshooting, compatibility, and best practices for secure, reliable connectivity.
4+
tags: site-to-site-vpn, vpn-gateway, customer-gateway, security-proposal, routing-policy
5+
dates:
6+
creation: 2025-12-05
7+
validation: 2025-12-05
8+
---
9+
10+
## Overview
11+
12+
### What is Site-to-Site VPN?
13+
14+
Site-to-Site VPN lets you securely connect your Scaleway VPC to your remote infrastructure, enabling encrypted data exchange over a private VPN tunnel. Integrated with VPC routing, traffic destined for your remote infrastructure can reach it from your VPC via the secure VPN tunnel, and vice versa.
15+
16+
## Specifications
17+
18+
### How are Site-to-Site VPN tunnels encrypted?
19+
20+
Site-to-Site VPN connections are secured with Internet Protocol security (IPsec). When creating a VPN [connection](/site-to-site-vpn/reference-content/understanding-s2svpn/#connection), you are prompted to define a **security proposal** (aka IPSec proposal) which defines the precise encryption and authentication methods to secure the tunnel. Read more about security proposals and encryption in our [dedicated documentation](/site-to-site-vpn/reference-content/security-proposals/).
21+
22+
## Compatibility and integration
23+
24+
### Can I use Site-to-Site VPN to connect two Scaleway VPCs?
25+
26+
No, you cannot use Site-to-Site VPN to connect two Scaleway VPCs. Watch out for our upcoming VPC peering solution for this functionality.
27+
28+
### Can I use Site-to-Site VPN to connect my Scaleway VPN to another cloud provider?
29+
30+
Yes, this use case is entirely possible.
31+
32+
## Pricing and billing
33+
34+
### How much does Site-to-Site VPN cost?
35+
36+
Site-to-Site VPN pricing is primarily based on the type of VPN gateway you create. Each gateway type provides a specific bandwidth capacity and supports a different maximum number of connections. See our dedicated [pricing page](https://www.scaleway.com/en/pricing/network/) for full details.

‎pages/site-to-site-vpn/index.mdx‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,19 @@
11
---
22
title: Site-to-Site VPN Documentation
33
description: Explore Scaleway Site-to-Site VPN. Connect your Scaleway VPC to your remote infrastructure, via an encrypted, private VPN tunnel.
4-
noindex: true
54
---
65

76
<Message
87
type="note"
9-
title="Site-to-Site VPN is in Private Beta"
8+
title="Site-to-Site VPN is in Public Beta"
109
>
11-
Site-to-Site VPN is currently in Private Beta, and available to selected testers only via the Scaleway API. [Request an invitation](https://www.scaleway.com/en/betas/#site-to-site-vpn).
10+
Site-to-Site VPN is currently in Public Beta, and available only via the [Scaleway API](https://www.scaleway.com/en/developers/api/site-to-site-vpn/).
1211
</Message>
1312

1413

1514
<ProductHeader
1615
productName="Site-to-Site VPN"
17-
productLogo="sns"
16+
productLogo="vpn"
1817
description="Securely connect your Scaleway VPC to your remote infrastructure, enabling encrypted data exchange over a private tunnel."
1918
url="/site-to-site-vpn/reference-content/understanding-s2svpn/"
2019
label="Understanding Site-to-Site VPN"
@@ -29,6 +28,14 @@ noindex: true
2928
description="Learn how to start using Site-to-Site VPN"
3029
label="View Doc"
3130
url="/site-to-site-vpn/reference-content/understanding-s2svpn/"
31+
/>
32+
/>
33+
<SummaryCard
34+
title="Quickstart"
35+
icon="rocket"
36+
description="Learn how to get started with Site-to-Site VPN"
37+
label="View Doc"
38+
url="/site-to-site-vpn/quickstart/"
3239
/>
3340
<SummaryCard
3441
title="Site-to-Site VPN statuses"

‎pages/site-to-site-vpn/menu.ts‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
export const siteToSiteVpnMenu = {
2+
items: [
3+
{
4+
label: 'Overview',
5+
slug: '../site-to-site-vpn',
6+
},
7+
{
8+
label: 'Concepts',
9+
slug: 'concepts',
10+
},
11+
{
12+
label: 'Quickstart',
13+
slug: 'quickstart',
14+
},
15+
{
16+
label: 'FAQ',
17+
slug: 'faq',
18+
},
19+
{
20+
items: [
21+
{
22+
label: 'Site-to-Site VPN API Reference',
23+
slug: 'https://www.scaleway.com/en/developers/api/site-to-site-vpn/',
24+
}
25+
],
26+
label: 'API/CLI',
27+
slug: 'api-cli',
28+
},
29+
{
30+
items: [
31+
{
32+
label: 'Understanding Site-to-Site VPN',
33+
slug: 'understanding-s2svpn',
34+
},
35+
{
36+
label: 'Site-to-Site VPN Security proposals',
37+
slug: 'security-proposals',
38+
},
39+
{
40+
label: 'Site-to-Site VPN Statuses',
41+
slug: 'statuses',
42+
},
43+
],
44+
label: 'Additional Content',
45+
slug: 'reference-content',
46+
}
47+
],
48+
label: 'Site-to-Site VPN',
49+
slug: 'site-to-site-vpn',
50+
}

‎pages/site-to-site-vpn/quickstart.mdx‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
title: Site-to-Site VPN - Quickstart
3+
description: Get started quickly with Scaleway Site-to-Site VPN. Follow our step-by-step guide to configure and deploy a secure connection between your network and Scaleway VPC in minutes.
4+
tags: site-to-site-vpn, vpn-gateway, customer-gateway, security-proposal, routing-policy
5+
dates:
6+
creation: 2025-12-05
7+
validation: 2025-12-05
8+
---
9+
10+
<Message type="note">
11+
Site-to-Site VPN is currently in Public Beta, and available only via the Scaleway API. Read our API-based quickstart in the [Site-to-Site VPN API documentation](https://www.scaleway.com/en/developers/api/site-to-site-vpn/#quickstart)
12+
</Message>

‎pages/site-to-site-vpn/reference-content/index.mdx‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
---
22
title: Site-to-Site VPN - Additional content
33
description: Site-to-Site VPN additional content
4-
noindex: true
54
---

‎pages/site-to-site-vpn/reference-content/security-proposals.mdx‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,14 @@
11
---
22
title: Site-to-Site VPN security proposals
33
description: Find out what the different encryption and authentication ciphers available with Scaleway Site-to-Site VPN, and how to to choose the best algorithm for your use case.
4-
noindex: true
54
tags: vpn connection encryption authentication security cipher security-proposal
65
dates:
76
validation: 2025-06-03
87
posted: 2025-06-03
98
---
109

1110
<Message type="note">
12-
Site-to-Site VPN is currently in Private Beta, and available to selected testers only via the Scaleway API. [Request an invitation](https://www.scaleway.com/en/betas/#site-to-site-vpn).
11+
Site-to-Site VPN is currently in Public Beta, and available only via the [Scaleway API](https://www.scaleway.com/en/developers/api/site-to-site-vpn/).
1312
</Message>
1413

1514
When creating a VPN [connection](/site-to-site-vpn/reference-content/understanding-s2svpn/#connection), you must define a **security proposal** (aka IPSec proposal). The security proposal defines the encryption and authentication methods used to secure the IPSec VPN tunnel.

‎pages/site-to-site-vpn/reference-content/statuses.mdx‎

Lines changed: 30 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,14 @@
11
---
22
title: Understanding Site-to-Site VPN statuses
33
description: Find out what the different possible statuses of your Site-to-Site VPN gateways and connections mean, and how to take action based on these statuses when necessary.
4-
noindex: true
54
tags: vpn gateway customer remote connection status
65
dates:
76
validation: 2025-06-03
87
posted: 2025-06-03
98
---
109

1110
<Message type="note">
12-
Site-to-Site VPN is currently in Private Beta, and available to selected testers only via the Scaleway API. [Request an invitation](https://www.scaleway.com/en/betas/#site-to-site-vpn).
11+
Site-to-Site VPN is currently in Public Beta, and available only via the [Scaleway API](https://www.scaleway.com/en/developers/api/site-to-site-vpn/).
1312
</Message>
1413

1514
## VPN gateway statuses
@@ -29,7 +28,7 @@ This section explains the different statuses possible for a VPN gateway, and how
2928

3029
## Connection statuses
3130

32-
A Site-to-Site VPN connection also always has a **status**, separate to that of the VPN gateway which can be retrieved via the API using the **Get a connection** call.
31+
A Site-to-Site VPN connection also always has a **status**, separate to that of the VPN gateway which can be retrieved via the API using the **Get a connection** call. The connnection status is based on the [tunnel status](#tunnel-statuses), [BGP session status](#bgp-session-statuses), and attachment of a [routing policy](/site-to-site-vpn/concepts/#routing-policy).
3332

3433
This section explains the different statuses possible for a connection, and how to understand them.
3534

@@ -39,4 +38,31 @@ This section explains the different statuses possible for a connection, and how
3938
| **Active** | The connection has been created, and all expected BGP session(s) between the two gateways are up. Traffic can flow through the connection's tunnel. |
4039
| **Limited connectivity** | The connection has been created, but IP connectivity is limited. This may be the case if the connection has both an IPv4 and an IPv6 routing policy attached, but only one of the two associated BGP sessions is up.|
4140
| **Down** | The connection has been created, but no BGP sessions (neither IPv4 not IPv6) are up, and without route announcements no traffic can flow through the tunnel.|
42-
| **Locked** | The connection has been locked by the Trust and Safety team. You cannot carry out any actions on the connection. Open a support ticket. |
41+
| **Locked** | The connection has been locked by the Trust and Safety team. You cannot carry out any actions on the connection. Open a support ticket. |
42+
43+
### Tunnel statuses
44+
45+
Within a Site-to-Site VPN connection, the connection's tunnel also has its own status.
46+
47+
This section explains the different statuses possible for a connection's tunnel, and how to understand them.
48+
49+
| **Status** | **Description** |
50+
|------------------------|-----------------------------------------|
51+
| **Up** | The VPN tunnel is active and ready to route traffic. |
52+
| **Down** | The VPN tunnel is not able to route traffic. The customer gateway is probably not configured correctly. |
53+
54+
### BGP session statuses
55+
56+
A Site-to-Site VPN connection has at least one associated **BGP session**.
57+
58+
A BGP session is a protocol-based connection between the customer gateway and a VPN gateway, where the two gateways automatically exchange routing information to facilitate communication across the VPN tunnel.
59+
60+
A connection has one BGP session for each attached routing policy, up to a maximum of two - one for IPv4 and one for IPv6.
61+
62+
This section explains the different statuses possible for a BGP session, and how to understand them.
63+
64+
| **Status** | **Description** |
65+
|------------------------|-----------------------------------------|
66+
| **Up** | The BGP session between the VPN gateway and the customer gateway is running as normal. |
67+
| **Down** | The BGP session between the VPN gateway and the customer gateway is not successfuly running. The customer gateway is probably not configured correctly. |
68+
| **Disabled** | No routing policy for the corresponding IP type is attached to the VPN connection, so no BGP session can be launched. |

‎pages/site-to-site-vpn/reference-content/understanding-s2svpn.mdx‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
---
22
title: Understanding Site-to-Site VPN
33
description: Dive deeper into understanding Scaleway's Site-to-Site VPN offer, with technical diagrams, explanations and more.
4-
noindex: true
54
tags: vpn gateway customer infrastructure connection encryption
65
dates:
76
validation: 2025-06-03
@@ -15,7 +14,7 @@ import image5 from './assets/scaleway-vpn-tunnel-detail.webp'
1514

1615

1716
<Message type="note">
18-
Site-to-Site VPN is currently in Private Beta, and available to selected testers only via the Scaleway API. [Request an invitation](https://www.scaleway.com/en/betas/#site-to-site-vpn).
17+
Site-to-Site VPN is currently in Public Beta, and available only via the [Scaleway API](https://www.scaleway.com/en/developers/api/site-to-site-vpn/).
1918
</Message>
2019

2120
## Site-to-Site VPN overview
@@ -62,6 +61,8 @@ The rest of the properties **must** correspond to the real properties of the cor
6261

6362
<Message type="note">
6463
The ASN must be different to Scaleway's ASN (12876). This means you cannot use Site-to-Site VPN to create a VPN tunnel between two Scaleway VPCs (peering). Watch this space for our official VPC peering solution, planned for the future.
64+
65+
ASNs can be public (globally unique) or private (unique within an organization). If you are unsure of your customer gateway device's ASN, we recommend entering a private ASN, in range `64512` to `65534`.
6566
</Message>
6667

6768
### Routing policy
@@ -161,7 +162,7 @@ Use [Network ACLs](/vpc/reference-content/understanding-nacls/) if you want to l
161162

162163
## Site-to-Site VPN limitations
163164

164-
- Site-to-Site VPN is currently in Private Beta, and available to selected testers only via the [Scaleway API](https://www.scaleway.com/en/betas/#site-to-site-vpn)
165+
- Site-to-Site VPN is currently in Public Beta, and available only via the [Scaleway API](https://www.scaleway.com/en/developers/api/site-to-site-vpn/).
165166
- You cannot use Site-to-Site VPN to connect two Scaleway VPCs
166167
- You cannot modify the Private Network that a VPN is connected to after creation
167168
- You must use the auto-generated pre-shared key (PSK) for a VPN connection: you cannot currently define your own PSK

0 commit comments

Comments
 (0)