How to create and manage a VPN connection

Reviewed on December 31, 2025

A connection is the central component of a Site-to-Site VPN. It links the VPN gateway to the customer gateway, sets the routing policy(ies), and defines the encryption, initiation and security parameters for the VPN tunnel.

Open Image over content

This document explains how to create and manage a Site-to-Site VPN connection with the Scaleway console.

Before you start

To complete the actions presented below, you must have:

• A Scaleway account logged into the console
• Owner status or IAM permissions allowing you to perform actions in the intended Organization
• Created a VPN gateway and a customer gateway in the same Scaleway region

How to create a VPN connection

1. Click Site-to-Site VPN in the Network section of the Scaleway console side menu. A listing of your existing VPN connections displays, if you have any.

2. Click Create connection. The creation wizard displays.

3. Choose a region in which to create your VPN connection. The resource will be created in this geographical location. You must create the connection in the same region as the VPN gateway and customer gateway that you want to connect.

4. Choose the gateways to connect. The connection will link the VPN gateway and customer gateways that you select here. Only gateways you have already created in the region you chose at step 3 will be displayed.

   Based on the selected gateways, the VPN tunnel details selection panel displays.

5. Select how the VPN tunnel for this connection should be established: via the gateways' public IPv4 addresses or their public IPv6 addresses.

   Tip

   • The two gateways must have at least one public IP type in common, in order to create a VPN connection between them.
   • The IP type you select here does not limit both IPv4 and IPv6 traffic from being able to flow through the tunnel. Read more about this.
   • If both gateways have both public IP types (IPv4 and IPv6) you can create a second VPN connection between them, this time selecting the other IP type, for increased redundancy.

6. Specify a routing policy for the connection (optional). The VPN connection needs a policy for each IP traffic type (IPv4, IPv6) you want it to route. These policies define the traffic that is allowed to flow through the tunnel. Without an attached routing policy, no traffic can flow, but you can choose to attach a routing policy after creating the connection, if you prefer.

7. Set the connection initiation policy by selecting which gateway should initiate the VPN tunnel.

   Tip

   By default, choose the customer gateway to initiate connections if it has a stable IP and no restrictive firewall.

8. Select a security proposal for this connection. The security proposal defines the encryption and authentication methods used to secure the IPSec VPN tunnel. For help choosing a security proposal, refer to our dedicated documentation.

   A pre-shared key (PSK) will be generated automatically when you create the VPN connection object. It will be securely stored in Scaleway Secret Manager, and can be retrieved for the purposes of configuring your customer gateway device. It is not currently possible to upload your own custom PSK.

9. Enter a name and (optionally) tags for the VPN connection.

10. Click Create connection to finish.

Your connection is created, and you are directed to its Overview page.

If the tunnel does not come up as expected, ensure you have completed all the essential configuration steps.

How to view a VPN connection's details

1. Click Site-to-Site VPN in the Network section of the Scaleway console side menu. A listing of your VPN connections displays.

2. Use the region selector at the top of the page to filter for the region of the connection you want to view, then click the connection in the listing. The connection's Overview page displays.

Here you can view the following information:

How to attach or detach a routing policy

Routing policies define traffic that is allowed to flow through the VPN tunnel. The connection needs one attached routing policy for each IP traffic type you want it to route (IPv4 and/or IPv6). You can attach a maximum of two routing policies to a single connection (one for IPv4 and one for IPv6).

Note that without an attached routing policy, no traffic can flow through the VPN tunnel. You can replace the attached routing policy/ies at any time.

1. Click Site-to-Site VPN in the Network section of the Scaleway console side menu. A listing of your VPN connections displays.

2. Use the region selector at the top of the page to filter for the region of the connection you want to view, then click the connection in the listing. The connection's Overview page displays.

3. In the route propagation panel:

   • If no routing policy is attached, click the + Attach policy button. You are prompted to select a routing policy to attach.
   • If a routing policy is already attached, click the three dot menu next to the policy, and select either:
     • Replace policy: You are prompted to select a new routing policy to replace the current one.
     • Edit policy: You are directed to the Edit page for the currently-attached policy, where you can modify the incoming and outgoing routes to whitelist.
     • Detach policy: You are prompted to confirm that you want to detach the policy from your connection.

If route propagation is active, all routes whitelisted by any new policy you have attached will be immediately propagated over the VPN connection.

How to activate or deactivate route propagation

You must activate route propagation for traffic to be able to flow through the VPN tunnel. Activating route propagation triggers the dynamic exchange of route information between the gateways.

1. Click Site-to-Site VPN in the Network section of the Scaleway console side menu. A listing of your VPN connections displays.

2. Use the region selector at the top of the page to filter for the region of the connection you want to view, then click the connection in the listing. The connection's Overview page displays.

3. In the Route propagation section, click Activate propagation.

   A pop-up displays, confirming that the action will launch the BGP session(s), allowing traffic to flow through the tunnel via the routes whitelisted in the attached routing policy(ies).

4. Click Activate route propagation.

   Route propagation is activated. You are returned to your connection's overview page.

   While route propagation remains active, the two gateways will dynamically exchange and update route information. Traffic can flow through the VPN tunnel along the routes whitelisted in the routing policy(ies). You can deactivate route propagation at any time: if you do so, all routes are blocked and no traffic can flow.

How to generate a new version of the PSK

PSKs do not expire. However, if you delete the secret containing the PSK, or you want to change your PSK for security reasons, you can generate a new one as follows:

1. Click Site-to-Site VPN in the Network section of the Scaleway console side menu. A listing of your VPN connections displays.

2. Use the region selector at the top of the page to filter for the region of the connection you want to configure, then click the connection in the listing. The connection's Overview page displays.

3. In the Connection information panel, under PSK, click Generate version.

A new version of the PSK secret is created in Scaleway Secret Manager. Ensure that you update your customer gateway device to use the new PSK.

How to edit a VPN connection's name and tags

1. Click Site-to-Site VPN in the Network section of the Scaleway console side menu. A listing of your VPN connections displays.

2. Use the region selector at the top of the page to filter for the region of the connection you want to configure, then click the connection in the listing. The connection's Overview page displays.

3. Click the Settings tab.

4. Make your edits as required:

   • Click directly on the connection's name at the top of the page to edit it.
   • Type new tags directly in the Tags box, or use the x icon to remove an existing tag.

How to delete a VPN connection

You must deactivate route propagation before you can delete the connection.

1. Click Site-to-Site VPN in the Network section of the Scaleway console side menu. A listing of your VPN connections displays.

2. Use the region selector at the top of the page to filter for the region of the VPN connection you want to configure, then click the connection in the listing. The connection's Overview page displays.

3. Click the Settings tab.

4. Click Delete connection.

   A pop-up displays, informing you that this action will permanently delete the connection.

   The VPN gateway and customer gateways used in this connection will not be automatically deleted. Remember to delete them yourself if no longer needed.

5. Type DELETE to confirm you want to proceed, then click the *Delete button.

The connection is deleted, and you are returned to the list of your VPN connections.