I need to install a server at a customer's site (Site A) that needs to communicate securely to a network at another site (Site B). The communication between Site A and Site B is over the internet. There are a number of un-encrypted protocols that need to be secured. The plan, I think, is to send everything through a VPN tunnel between Site A and Site B.
I assume the VPN could be configured to only send packets to site B that came from the IP Address of our server at Site A rather than send all source IP Address from Site A?
A high-level design that I've have seen has a site to site VPN, but no further details than that.
I presume this means that data would flow in the clear until it hit the firewall at Site A and would then be directed through the VPN tunnel to Site B.
My concern is the data flowing in the clear at site A's network before it goes into the VPN tunnel from Site A to Site B. I am not concerned about the data when it pops out of the tunnel at Site B as this is a trusted Zone.
Wouldn't it be more secure to have the VPN running all the way from the server we install at Site A to Site B. Isn't this more secure than having a site to site VPN? What is the typical way this type of problem is resolved?
I am not very familiar with VPNs. Am I missing something? What would be the advantages/disadvantages of either approach?
The server will be running Windows 2012 R2. What is a good VPN client that could be used on that server to send traffic over a VPN to Site B? Is IPSec the protocol that most VPNs use for this type of scenario?