IPsec site-to-site VPN setup guide

Set up an IPsec site-to-site VPN to securely connect your network to BrowserStack Local Testing infrastructure.

For organizations testing applications on private or corporate networks, BrowserStack offers IPsec site-to-site (S2S) VPN integration. A dedicated, encrypted channel connects your infrastructure directly to BrowserStack’s testing cloud so test nodes can reach internal services without exposing them to the public internet.

What is IPsec site-to-site VPN?

Unlike remote-access VPNs that authenticate individual users on demand, a site-to-site VPN operates at the network level. Two VPN gateways exchange keys and hold an open tunnel between them so that traffic bound for the remote subnet routes through automatically — no user action required.

Key characteristics:

• Always-on tunnel that re-establishes automatically after any link interruption.
• Uses IKEv2 for key exchange and ESP in Tunnel Mode for encryption.
• Supports NAT Traversal (NAT-T) for environments where gateways sit behind NAT devices.
• Gives BrowserStack test nodes direct access to private hostnames and internal subnets not reachable over the internet.
• No software installation required on individual machines within your network.

Network architecture

The architecture below shows how traffic moves between your private network and BrowserStack’s testing cloud over an encrypted IPsec channel.

Traffic flow steps

Each request from a BrowserStack test node to an internal resource follows this path:

1. A BrowserStack test node sends a request to an internal hostname or IP (for example, https://staging.internal.corp).
2. BrowserStack’s routing layer directs the request to the BrowserStack-side VPN gateway.
3. The VPN gateway wraps the packet in an IPsec ESP envelope, encrypting it for transit.
4. The encrypted payload travels across the internet to your organisation’s public IP.
5. Your VPN gateway receives, authenticates, and decrypts the packet.
6. The original request is delivered to the target host on your internal network.
7. The response returns via the same VPN tunnel back to the BrowserStack test node.

S2S VPN requirement gathering

General information

The following table covers your server location and initial architecture review.

Public IP address information

The following table covers your VPN gateway’s public-facing IP details.

Internal network details

The following table covers the subnets, DNS, and dynamic IP behavior within your internal network.

VPN equipment details

The following table covers the make, model, and configuration preferences for your VPN device.

IPsec parameters

The following table covers the IKE version supported by your gateway.

Phase 1 (IKE) settings

The following table covers Phase 1 negotiation parameters.

Phase 2 (IPsec) settings

The following table covers Phase 2 data-plane encryption and lifetime parameters.

Firewall rules

The following table covers traffic permitted through the tunnel, firewall rules, and routing requirements. UDP 500, UDP 4500, and ESP protocol 50 must be open for the IPsec tunnel to establish.

High availability requirements

The following table covers redundancy and failover configuration. If a secondary gateway is required, provide its public IP address (all other parameters are assumed to be the same as the primary).

Send the above details to support@browserstack.com to submit your VPN setup request. Our team reviews your request and follows up with next steps.