How to Connect Branch Office Networks as If They Were in the Same Building

Modern businesses rarely operate from a single location. Employees may work from a headquarters, regional branches, warehouses, retail stores, production facilities, or temporary project sites. Although these offices may be separated by hundreds or thousands of miles, the applications and devices inside them often need to communicate as though they were part of one private corporate network.

A computer at a branch office may need to reach a file server at headquarters. A point-of-sale system may need to communicate with a database in a data center. IP phones, security systems, printers, and line-of-business applications may all depend on reliable connectivity between private local-area networks.

Mushroom Networks’ Virtual Leased Line, or VLL, provides a practical way to connect these geographically separate LANs through a secure overlay tunnel carried across the public Internet.

The result is a multi-office network in which users and applications can reach resources at remote locations using their private IP addresses—much like they would if all the resources were located in the same building.

The Challenge of Connecting Separate Office Subnets

Consider a company with two locations:

• Headquarters uses the local subnet 192.168.10.0/24.
• A branch office uses the local subnet 192.168.20.0/24.

Without a connection between the two networks, a workstation in the branch office cannot directly reach a server at headquarters. Internet access at each site provides connectivity to public destinations, but it does not automatically create a route between the two private networks.

Traditional solutions might include a carrier-managed private circuit, MPLS service, or a conventional site-to-site VPN. Each option can work, but it may introduce limitations related to cost, available bandwidth, installation time, complexity, or dependence on a single network connection.

A Mushroom Networks VLL tunnel creates a private communication path between Mushroom appliances at the two locations. Traffic addressed to the remote LAN is recognized by the local appliance, transported through the VLL tunnel, and delivered to the destination network at the other end.

From the perspective of users and applications, the remote private network becomes directly reachable.

One Private Network Experience—Without Using the Same Subnet

It is useful to clarify what “as if the offices were in the same building” means.

The two locations should generally use separate, non-overlapping IP subnets. For example:

• Headquarters: 192.168.10.0/24
• Branch office: 192.168.20.0/24
• Warehouse: 192.168.30.0/24

The VLL tunnel makes these remote subnets reachable across locations, but it does not combine them into one Layer 2 broadcast domain. In other words, the offices operate as a unified, routed private network rather than literally sharing the same IP subnet.

This design is normally preferable for a multi-site business. It limits unnecessary broadcast traffic, avoids duplicate IP addresses, and makes the network easier to manage as new locations are added.

A user at the branch office can connect to a headquarters server at 192.168.10.25, while a headquarters user can reach a branch resource at 192.168.20.50. The physical distance and public Internet paths between them are largely transparent to the applications.

How a Mushroom Networks VLL Tunnel Works

A VLL connection is established between two Mushroom Networks Broadband Bonding appliances. For each bidirectional tunnel, one appliance is configured as the VLL server and the other as the VLL client.

The server and client designations define how the connection is established; they do not prevent normal two-way communication after the tunnel is active.

Each side is configured with information including:

• The local and remote LAN address ranges
• A matching connection name
• A matching password
• The server or client role
• Other tunnel-specific settings required by the deployment

When a packet arrives at a Mushroom appliance, the device examines its destination. If the destination belongs to the LAN configured at the remote site, the appliance forwards the packet through the VLL tunnel. The appliance at the other end then delivers it to the appropriate local network.

Mushroom devices can also participate in multiple VLL connections. This supports designs in which headquarters connects to several branches or in which multiple offices require direct tunnels between selected locations.

More Than a Conventional Single-Link Tunnel

A major advantage of combining VLL with Mushroom Networks Broadband Bonding is that the tunnel can use multiple WAN connections instead of depending on only one circuit.

A location might have any combination of:

• Fiber
• Cable broadband
• DSL
• Dedicated Internet access
• Fixed wireless
• 4G or 5G
• Satellite
• MPLS
• Other IP connections

The VLL overlay can use the aggregated connectivity available to the Mushroom appliance without requiring the underlying Internet service providers to coordinate with one another. For more background on improving throughput and resiliency across several links, see this guide to network performance optimization.

This can provide two important advantages.

For a broader industry framework, MEF 70.2 defines the service attributes and concepts used to describe SD-WAN services.

Increased Available Capacity

By using multiple WAN resources, the VLL tunnel can create a larger communication pipe between offices. Depending on the traffic, link characteristics, and configuration, the available tunnel capacity can approach the combined capacity of the individual connections.

This is valuable when branch users regularly access centralized file servers, enterprise applications, databases, backup systems, or other bandwidth-intensive resources.

Improved Reliability

A tunnel that depends on one Internet circuit becomes unavailable when that circuit fails.

A broadband-bonded VLL tunnel can remain operational while at least one usable communication path remains between the two Mushroom appliances. If a cable connection fails, for example, traffic may continue across fiber, wireless, or another available WAN link.

This resilience is particularly valuable for locations where access to centralized applications is operationally critical.

Common Multi-Office Topologies

VLL can support several network designs.

Point-to-Point

A point-to-point design connects two locations, such as a headquarters and one branch office.

This is the simplest deployment and is useful when the two sites need direct access to each other’s private resources.

Hub and Spoke

In a hub-and-spoke design, headquarters or a data center acts as the hub, while multiple branch offices connect as spokes.

For example:

• Branch A establishes a VLL tunnel to headquarters.
• Branch B establishes a separate VLL tunnel to headquarters.
• Branch C establishes another tunnel to headquarters.

This design works well when most applications and shared resources reside at a central location. Mushroom’s VLL implementation permits one server-side appliance to establish connections with multiple client-side appliances, making it suitable for this type of topology.

Selected Site-to-Site Connections

Some businesses may require direct communication between certain branches in addition to their connections with headquarters. Multiple VLL instances can be used to construct the required topology, subject to the appliance configuration and network design.

Applications That Benefit from VLL Connectivity

Once the private subnets are connected, many applications can operate across the VLL tunnel without being redesigned for the public Internet.

Typical examples include:

• Access to centralized file servers
• Enterprise resource planning and inventory systems
• Database connectivity
• Private web applications
• VoIP and unified communications
• Remote desktop services
• Network monitoring and management
• Video surveillance systems
• Backup and replication traffic
• Authentication and directory services
• Connections between an office and a private cloud environment

Existing IPsec VPN firewalls can also be used in conjunction with a VLL deployment. In this type of design, VPN bonding using VLL can provide a bonded and resilient transport path underneath the existing VPN, allowing the VPN to benefit from multiple WAN connections while preserving the organization’s established firewall and security policies.

Planning the IP Addressing

Careful IP planning is one of the most important parts of a multi-office deployment.

Every connected location should use a unique, non-overlapping RFC 1918 private subnet. If two offices both use 192.168.1.0/24, the network cannot reliably determine which site should receive traffic for an address such as 192.168.1.25.

A scalable plan might assign a different subnet to each site:

• Headquarters: 10.10.0.0/16
• Branch 1: 10.20.0.0/16
• Branch 2: 10.30.0.0/16
• Warehouse: 10.40.0.0/16

The exact subnet sizes should reflect the number of devices, expected growth, routing design, and security requirements at each location.

Administrators should also review DHCP scopes, firewall rules, DNS behavior, default gateways, and any existing static routes before activating interoffice connectivity.

Security and Network Policy Still Matter

Making a remote subnet reachable does not mean every device should automatically have unrestricted access to every other device.

Organizations should apply appropriate security policies based on operational requirements. For example, branch workstations might need access to a headquarters application server but not to management interfaces or infrastructure networks.

The VLL tunnel provides the interoffice transport. Firewalls, access-control policies, endpoint security, authentication systems, and network segmentation remain important parts of the overall architecture.

VLL traffic can also be encrypted when required by the deployment’s security policy.

Creating a More Resilient Multi-Office Network

A business should not have to choose between private interoffice connectivity, higher bandwidth, and WAN reliability.

Mushroom Networks VLL combines these capabilities by creating an overlay tunnel between private LANs and carrying that tunnel across the available WAN resources at each site. Separate offices retain their own local subnets, while users and applications gain direct access to permitted resources at remote locations.

For businesses operating headquarters, branches, warehouses, retail sites, clinics, production facilities, or other distributed locations, this creates a network experience similar to having every site connected within one corporate campus—while continuing to use readily available Internet services.

With the right IP addressing plan and Mushroom Networks appliances at the participating locations, organizations can build a flexible multi-site network that delivers more bandwidth, greater resilience, and simpler access to resources across the enterprise.

At Mushroom Networks Inc., we specialize in creating robust networking solutions that guarantee uptime and optimize performance. Our multi-WAN load balancing devices and SD-WAN capabilities ensure your business remains connected and efficient, seamlessly combining various internet links to create a resilient and high-speed network. Explore our advanced solutions at https://www.mushroomnetworks.com.