Setting up a multi-site VPN between home and office

Working from a home office in Brisbane while still needing systems access at my consultancy in Fortitude Valley was getting messy. Half-broken consumer routing and flaky port-forwards were not cutting it, especially with a partner streaming on the same connection. I built a proper multi-site virtual private network that bridges both locations, giving me always-on connectivity like I had at corporate workplaces years ago.

Australia's National Broadband Network shapes every decision in a project like this. Upload speeds on most NBN plans hover between 5 and 40 Mbps, while latency between capital cities is generally good, meaning uploads remain the real bottleneck for site-to-site tunnels carrying backups, remote desktop and voice. The same is true in Sydney, Melbourne, Adelaide or Perth, particularly because consumer-grade modems in NBN installs often ship in bridge-modem-only mode these days.

This write-up shares what worked, with Australian-specific notes about hardware choices, routing and firewall tweaks, upload-speed workarounds, and keeping monitoring clean across both ends of the tunnel. If you are weighing whether to roll your own or hand the work to a managed provider, the details below should help.

Why a multi-site VPN made sense for my situation

My old setup relied on a single OpenVPN instance in a Docker container on a spare NUC, with port 1194 forwarded through a Netgear modem. That worked for a laptop or two but failed the moment a Teams call started or when I needed the CCTV NVR remotely. The single point of failure was also a single point of attack, and after reading the Australian Cyber Security Centre's Essential Eight guidance, I realised my approach was leaving too much on the table.

The bigger motivation was workflow continuity. I wanted to shut the lid on my MacBook at home, drive to the Fortitude Valley office, and pick up where I left off, with file shares, internal wikis and monitoring dashboards behaving like local resources. A site-to-site approach also lets family members use the office connection when they visit on weekends without needing to know anything about VPNs or routing tables.

Planning the topology and address space

Before touching any hardware, I drew a network diagram. Both sites needed stable, non-overlapping subnets so any future guest VLAN or IoT segment could slot in cleanly without a full renumbering.

I settled on the following plan:

• Home site (Brisbane): 10.10.0.0/24 LAN, 10.10.10.0/24 servers, 10.10.20.0/24 guests
• Office site (Fortitude Valley): 10.20.0.0/24 LAN, 10.20.10.0/24 servers, 10.20.20.0/24 guests
• Tunnel overlay: 10.99.0.0/30 for the site-to-site interface pair
• DNS: Pi-hole and Unbound running on each side, syncing zones over the tunnel
• Out-of-band: 10.99.10.0/30 with serial console access only

Choosing 10.99.0.0/30 for the tunnel links was deliberate: a /30 gives me exactly two usable addresses and prevents any LAN device from accidentally ending up on the same subnet as the tunnel. I also documented the public IP situation: home runs on a typical Aussie Broadband HFC service with a dynamic address, while the office is on a Telstra Business plan with a static IP. That asymmetry decided a chunk of the configuration further down the line, particularly the choice of protocols.

Picking hardware that survives an Australian summer

The NBN connection at home terminates in a Netcomm modem that runs hot, and the cupboard where it lives regularly goes above 35 degrees during a Brisbane summer. I picked fanless mini-PCs with industrial-grade components rather than off-the-shelf consumer gear. After comparing a few Australian suppliers and their warranty terms, I ordered two identical units from a local distributor. I keep a list of vendors I trust for ongoing replacement parts, and my preferred hardware vendors live on the main site.

The components that mattered most were:

• Intel Celeron or i3 class CPU with AES-NI support
• At least 4GB of high-grade RAM
• Dual Intel NICs so one port handles the WAN and the other the LAN bridge
• NVMe storage of 64GB or larger
• Solid aluminium chassis with no moving parts
• Quiet 12V fan for cupboard airflow, drawing under 0.5W

I bolted on that quiet fan after the first heatwave tripped the modem. It draws negligible power, is silent, and has extended the life of the existing modem by several years.

Configuring the tunnel and the firewall rules

With the hardware in place, I configured WireGuard on both sites. I had used IPsec in the past but the chacha20-poly1305 cipher and minimal key ceremony suit a home-lab scenario better. Each peer got its own key pair, and tunnel interfaces come up within seconds of booting, which is helpful when NBN drops out briefly during a storm.

The trickiest part was dealing with NBN upload speeds. On my home plan I get around 20 Mbps up and 250 Mbps down, so the tunnel MTU needs care. After several sessions of trial and error I settled on a tunnel MTU of 1380 and an MSS clamp of 1340, values well documented in Australian community wikis such as the Whirlpool forums.

On the firewall side I applied a default-deny posture to anything entering from the public internet. I only permit UDP on port 51820 from the office public IP, plus ICMP for traceroute and ping diagnostics. Internal traffic between subnets is unrestricted, but each LAN-to-LAN flow goes through a separate firewall rule so I can switch things off at 2am.

Monitoring, backups and documentation

A working tunnel is only half the job. Monitoring matters, so I run Prometheus on a small box at the office, with node_exporter instances scraping CPU, memory, disk and WireGuard-specific metrics. Grafana dashboards refresh every 30 seconds, fast enough to spot a peering issue and slow enough not to flood the limited NBN upstream.

Backups happen twice a day across the tunnel. The source repository for my personal projects is around 14GB, and even at modest upload speeds it completes well before lunchtime in Brisbane. Critical files are pushed to an offsite Sydney bucket replicated to Singapore, satisfying data-residency expectations my Australian clients ask for. Privacy Act 1988 obligations cover anything with personal information, so I treat every backup through a privacy lens, alongside guidance from the Office of the Australian Information Commissioner.

A printed configuration sheet next to each device rounds things off, with IP addresses, WireGuard public keys and emergency contacts written out by hand, and that paper saves the day more often than I would like to admit. Mental sequencing matters as much as the configuration itself, and I picked up that habit from an unexpected source: a roulette bet guide on a friend's blog got me thinking about how each step in a sequence opens up the next, much like configuring policies in a specific order during tunnel bring-up.

Staying sane during downtime

Setting up the network was not the only thing on my mind recently. After a long week of chasing BGP timers, I have been known to log off, kick back, and enjoy live blackjack play for real money at a quiet table while the dog sleeps under the desk. It is a small reward after a long stretch of monitoring dashboards.

I have also revisited my reading list and started tracking Australian privacy law reform proposals more closely, given how often my consulting clients ask about the Notifiable Data Breaches scheme. The legislation has tightened over recent years and any site-to-site setup that handles staff records or customer data needs to be reviewed against those obligations. I would rather know exactly which packets cross which boundary than be surprised by an audit.

If you are planning a similar build, my one piece of advice is to start small and measure before optimising. Get the tunnel up with sensible defaults, watch the metrics for a couple of weeks, then tighten the MTU and MSS values based on what the graphs show rather than what an old forum thread claims. Pick the routing change that delivers the biggest win first, and let the smaller tweaks follow once the metrics stabilise.

Get in touch if you would like help scoping out a similar setup for your home and office, or if you simply want a second pair of eyes on a topology you are wrestling with. I take on a limited number of Australian clients each quarter and can usually fit in a discovery call within the week.