# S2S from Cloud Pritunl to on prem **URL:** \ **Category:** Pritunl VPN\ **Created:** [June 17, 2025, 3:38pm UTC](https://forum.pritunl.com/t/s2s-from-cloud-pritunl-to-on-prem/3379 "2025-06-17T15:38:57Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![ituser](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/i/ba8739/32.png) [@ituser](https://forum.pritunl.com/u/ituser)\ **Post date:** [June 17, 2025, 3:38pm UTC](https://forum.pritunl.com/t/s2s-from-cloud-pritunl-to-on-prem/3379/1 "2025-06-17T15:38:57Z")
Hi, We’re trying to setup IPSEC communication between a pritunl server in Azure and our local on prem servers (using a Watchguard box) What would be some recommended options ? It seems the pritunl server cannot act as a pritunl link host so shoud we install another VPN software (like strongswan) on the pritunl server to manage the S2S connexion ? Thanks PS : we tried using the Azure VPN Gateway but couldn’t get the routing to work so we thought using a direct IPSEC connection would be simpler and less expensive ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [June 17, 2025, 8:55pm UTC](https://forum.pritunl.com/t/s2s-from-cloud-pritunl-to-on-prem/3379/2 "2025-06-17T20:55:57Z")
The `pritunl-link` package provides the link client. It can use either IPsec from Strongswan or Wireguard if `wireguard-tools` is also installed. More information is available in the [**link documentation**](https://docs.pritunl.com/docs/link-configuration). ---
**Author:** ![ituser](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/i/ba8739/32.png) [@ituser](https://forum.pritunl.com/u/ituser)\ **Post date:** [June 18, 2025, 7:09am UTC](https://forum.pritunl.com/t/s2s-from-cloud-pritunl-to-on-prem/3379/3 "2025-06-18T07:09:54Z")
Sure, but the doc specifically states " **The pritunl-link client cannot run on a Pritunl server and the Pritunl server will not function as a link host. All hosts must be defined in the link configuration.**" Does that mean that we need another server only to run the pritunl client ? In this case, a high availabilty config would need 4 servers, 2 pritunl servers and 2 pritunl links ? Thanks ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [June 18, 2025, 8:18am UTC](https://forum.pritunl.com/t/s2s-from-cloud-pritunl-to-on-prem/3379/4 "2025-06-18T08:18:17Z")
To have a high availability site-to-site link both sides need to run the Pritunl link client. It can’t be static hosts using other IPsec clients. There would need to be a replica set of 3 MongoDB servers, 2 Pritunl servers and 2 Pritunl link clients at each site. ---
**Author:** ![ituser](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/i/ba8739/32.png) [@ituser](https://forum.pritunl.com/u/ituser)\ **Post date:** [June 18, 2025, 8:38am UTC](https://forum.pritunl.com/t/s2s-from-cloud-pritunl-to-on-prem/3379/5 "2025-06-18T08:38:05Z")
wouldn’t it be possible to have 2 separate couples of pritunl server/link, connected to a static host ? They would be configured with 2 different VPN ip ranges. The pritunl VPN client would choose one pritunl server at random, so it would be HA as well ? ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [June 18, 2025, 9:34am UTC](https://forum.pritunl.com/t/s2s-from-cloud-pritunl-to-on-prem/3379/6 "2025-06-18T09:34:49Z")
There can’t be two hosts creating a site-to-site link between 2 networks at the same time. Pritunl link requires the subnets get added to the routing table it isn’t just for providing VPN clients access. ---
**Author:** ![ituser](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/i/ba8739/32.png) [@ituser](https://forum.pritunl.com/u/ituser)\ **Post date:** [June 18, 2025, 11:43am UTC](https://forum.pritunl.com/t/s2s-from-cloud-pritunl-to-on-prem/3379/7 "2025-06-18T11:43:26Z")
ok got it. but you confirm the link client can’t be used on the server, we need a pritunl server host and a pritunl-link host. So 2 VMs ? ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [June 20, 2025, 10:24pm UTC](https://forum.pritunl.com/t/s2s-from-cloud-pritunl-to-on-prem/3379/8 "2025-06-20T22:24:42Z")
I think if it’s used in WireGuard mode it’s less likely to create a conflict. But there are configurations where issues will occur. I don’t know all of the configurations that will cause issues or test for it.