End-to-end routing
Routes connect site subnets. Office devices and the remote workstation can reach each other by IP through the VPN.
IP connectivity · no single shared L2 segmentCASE STUDY / NETWORKS AND IT SYSTEMS
Different locations.
One network.
Head office, two branches
and a remote chief accountant.
We connected company sites using WireGuard VPN tunnels, with end-to-end routing, node reachability checks and automatic branch failover to a backup VPN.
ONE COMPANY NETWORKSolution diagram
Head officeCentral node · MikroTik
01Branch 01Local networkWireGuardL2TP/IPsec · backup
02Branch 02Local networkWireGuardL2TP/IPsec · backup
03Chief accountantRemote workstationWireGuardAccess to company resources
End-to-end IP routing
Offices and a remote employee share one network
Primary VPNBranch backup
3offices in one network
1remote workstation
2VPN protocols for offices
Autobackup failover
THE CHALLENGE
Connect your offices.
Keep work accessible.
The company's sites are in different locations but need shared IT infrastructure. Devices at the head office and two branches need mutual IP connectivity, while the chief accountant needs remote access to the company network.
Office connectivity also needed a backup: if the primary VPN is unavailable, routers must automatically choose another tunnel.
SOLUTION ARCHITECTURE
Sites work together
Connectivity between subnets,
rather than separate connections to every device.
The accountant is part of the company network
The chief accountant has a remote workstation with VPN access to the company network, without needing to be physically present in the office.
Company resources through an encrypted tunnelPrimary VPN
WireGuard carries IP traffic through encrypted tunnels and authenticates peers with cryptographic keys.
Routing and checks
Routers check remote nodes and automatically switch office traffic to a backup path.
L2TP/IPsec
Backup VPN
Additional L2TP tunnels protected by IPsec provide backup connectivity between offices.
RESILIENCE
Primary tunnel unavailable?
The route changes automatically.
WireGuard · primary→Remote node check→L2TP/IPsec · backup
Primary route
WireGuard tunnels carry traffic between corporate subnets at the offices.
Reachability monitoring
Routers check remote nodes to monitor whether the path to another site is working.
Failover to backup
If the primary path is unavailable, routing automatically switches to the backup L2TP/IPsec tunnel.
The backup protocol helps when the primary VPN is unavailable. If both tunnels share one internet connection, a complete connection failure requires separate backup connectivity. Existing sessions may need to reconnect after a path change.
CONNECTION SECURITY
Encryption at the core.
Access governed by rules.
Protocol capabilities
and network operation recommendations.
Traffic encryption
WireGuard encrypts and authenticates packets. IPsec protects the backup connection: L2TP alone does not provide encryption.
Key-based authentication
WireGuard peers identify each other by public keys. Private keys stay on their respective devices and must not be shared with other peers.
Access control
Shared routing does not mean exposing every service to everyone. We recommend allowing only required destinations and ports in the firewall, with a separate policy for the remote employee.
Connection management
We recommend revoking keys of retired devices, updating RouterOS and restricting router management to trusted addresses.
Protocol documentation: WireGuard · WireGuard in RouterOS · L2TP/IPsec in RouterOS
OUTCOME
One infrastructure.
More freedom to work.
- The head office and two branches are connected by VPN tunnels.
- The chief accountant connects remotely.
- Devices at different sites can reach each other by IP.
- If the primary path is unavailable, office connectivity switches to the backup tunnel.
LET'S DISCUSS YOUR NETWORK