Site-to-Site VPN Without MPLS: Mesh VPN for Multi-Location Businesses

MPLS was the gold standard for site connectivity for years. But for mid-sized businesses in 2026, it's often the wrong choice: €300–4,000 per site per month, long provisioning times, carrier dependency, and zero flexibility for new locations or cloud connections. NetBird offers a modern alternative: encrypted WireGuard tunnels between offices, branches, and cloud environments – as a mesh VPN without central gateway, without carrier contracts, from €99.90/month for all sites.

Also worth reading: Fortinet VPN Alternative 2026 · OpenVPN Alternative 2026 · Setting Up a Business Network for Remote Employees

Quick Comparison: MPLS vs. Mesh VPN (NetBird)

Table of Contents

• Why MPLS No Longer Fits Mid-Sized Businesses
  • The Cost Problem
  • The Flexibility Problem
  • The Security Problem
• The Alternative: Connecting Sites via Mesh VPN
  • How It Works
  • What This Means Concretely
  • High Availability
• Why Mesh VPN Instead of Classic Site-to-Site VPN?
• MPLS vs. SD-WAN vs. Mesh VPN: Where Does NetBird Fit?
• Setup: Site Connectivity with NetBird in 30 Minutes
  • Step 1: Deploy birdhost Instance
  • Step 2: Install Routing Peer per Site
  • Step 3: Configure Network Routes
  • Step 4: Define Access Rules
• Cost: MPLS vs. NetBird for 3 Sites, 3 Years
• When MPLS Is Still the Right Choice
• Conclusion
• Sources

Why MPLS No Longer Fits Mid-Sized Businesses

The Cost Problem

MPLS connections cost €300–4,000 per site per month – depending on bandwidth, location, and carrier. In rural areas without fiber infrastructure, prices trend toward the upper end. For a company with 3 sites, that quickly means €1,000–6,000/month – just for site connectivity.

Add to that:

• Setup fees: €500–5,000 per site
• Contract terms: 12–36 months, difficult to cancel
• Bandwidth upgrades: New contract negotiations, new costs
• Redundancy: Second MPLS line = double the cost

The Flexibility Problem

A new site needs a new MPLS line. Provisioning takes weeks to months – carrier availability checks, line installation, configuration. For companies that grow quickly, open branches, or need temporary sites (construction sites, trade shows, pop-up offices), that's too slow.

Cloud connections are particularly cumbersome with MPLS: AWS Direct Connect or Azure ExpressRoute cost extra and require separate carrier contracts.

The Security Problem

What many don't realize: MPLS is not encrypted. MPLS is a label-switching protocol that routes traffic across the carrier network – but doesn't encrypt the content. Security relies on the assumption that the carrier network is closed and trusted. Anyone wanting end-to-end encryption must additionally layer IPsec or a VPN on top.

The Alternative: Connecting Sites via Mesh VPN

How It Works

NetBird builds a mesh VPN between your sites. At each site, a routing peer is installed – a small Linux server, VM, or Docker container running the NetBird client. This routing peer makes the entire local network (LAN) accessible via NetBird.

Office Berlin (10.1.0.0/24)        Office Munich (10.2.0.0/24)
       │                                    │
  Routing Peer ◄──── WireGuard Tunnel ────► Routing Peer
       │            (direct, encrypted)           │
  LAN Devices                              LAN Devices
  (Servers, NAS,                           (Servers, NAS,
   Printers)                                Printers)
                         │
                    Cloud VPC (10.3.0.0/24)
                         │
                    Routing Peer
                         │
                    Cloud Servers

Devices on the LAN don't need a NetBird client. The routing peer forwards traffic – with NAT masquerading, so the source IP is hidden behind the routing peer's IP. For endpoint devices, traffic appears to come from the local network.

What This Means Concretely

• Office Berlin can access servers in Office Munich – without a VPN client on every device
• Cloud VPCs (AWS, Azure, Hetzner) are seamlessly connected – one routing peer in the cloud is enough
• Remote employees access all sites via the NetBird client – identity-based, not network-based
• New sites are connected in minutes – install routing peer, configure network route, done

High Availability

NetBird supports multiple routing peers per site. If you configure two routing peers at the same location, the second takes over automatically if the first fails – no manual intervention, no downtime. With MPLS, redundancy costs a second line.

Why Mesh VPN Instead of Classic Site-to-Site VPN?

Classic site-to-site VPNs (IPsec, OpenVPN) connect sites through a central gateway – typically a firewall appliance at headquarters. This creates three problems:

1. Hub-and-spoke bottleneck: All traffic between branches flows through headquarters. Branch A talks to Branch B? Traffic goes to HQ first, then back. Double latency, double bandwidth.

2. Single point of failure: If headquarters goes down, all branches are cut off from each other.

3. VPN on the firewall: The VPN gateway is simultaneously the firewall. Every VPN vulnerability is a firewall vulnerability – as the Fortinet CVE series impressively demonstrated.

NetBird as a mesh VPN solves all three:

• Direct peer-to-peer connections: Branch A talks directly to Branch B – no detour through headquarters.
• No central gateway: If one site goes down, the others continue communicating.
• VPN decoupled from the firewall: The firewall stays responsible for perimeter security. VPN is a separate service.

MPLS vs. SD-WAN vs. Mesh VPN: Where Does NetBird Fit?

SD-WAN is often positioned as the MPLS successor. For mid-sized businesses, it's frequently overkill:

SD-WAN is the right choice when you need complex traffic engineering: application-aware routing, QoS prioritization, hybrid WAN with MPLS backup. Typical use cases: VoIP-intensive environments, real-time trading platforms, sites with unreliable internet connections.

SASE platforms such as Cloudflare One bundle site connectivity, secure web gateway and access control into a single vendor network. That takes work off your plate, but it moves site traffic into a US-operated inspection layer. Which of those categories you actually need, and which can be solved sovereignly, is separated out in Cloudflare Zero Trust alternative: sovereign ZTNA.

NetBird (mesh VPN) is the right choice when you want to connect sites securely – without carrier contracts, without SD-WAN hardware, without per-site licenses. For most SMBs with 2–20 sites running office applications, file servers, ERP systems, and cloud services, a mesh VPN over the public internet is performant enough.

Setup: Site Connectivity with NetBird in 30 Minutes

Step 1: Deploy birdhost Instance

1. Create account on portal.merkaio.com
2. Deploy instance – choose plan, select region
3. Open NetBird dashboard

Step 2: Install Routing Peer per Site

Set up a routing peer at each site – a Linux server, VM, or Docker container:

# Install NetBird client
curl -fsSL https://pkgs.netbird.io/install.sh | sh

# Connect to your birdhost instance
netbird up --management-url https://your-instance.birdhost.de

Step 3: Configure Network Routes

In the NetBird dashboard under Network Routes, add local subnets as routes:

• Office Berlin: 10.1.0.0/24 → Routing Peer Berlin
• Office Munich: 10.2.0.0/24 → Routing Peer Munich
• Cloud VPC: 10.3.0.0/24 → Routing Peer Cloud

Step 4: Define Access Rules

Use the graphical web UI to define who can access which sites – identity-based, not IP-based.

Result: All sites are connected via encrypted WireGuard tunnels. LAN devices communicate across sites without a VPN client. Remote employees access all sites via the NetBird client.

Cost: MPLS vs. NetBird for 3 Sites, 3 Years

MPLS prices: estimate based on German market prices (€300–4,000/site/month). Actual prices vary by carrier, bandwidth, and location.

The cost savings aren't a rounding error. A single month of MPLS for three sites (€900–12,000) often costs more than an entire year of the birdhost flat rate for all sites combined (around €1,199).

When MPLS Is Still the Right Choice

MPLS has strengths that an internet-based VPN cannot replicate:

• Guaranteed bandwidth: MPLS delivers assured bandwidth regardless of internet congestion. For latency-sensitive applications (real-time VoIP, video conferencing with SLA, trading platforms), this is essential.
• Quality of service: MPLS prioritizes traffic classes at the network level – VoIP gets priority over email. An internet VPN cannot guarantee this.
• Regulatory requirements: In some industries (financial sector, government), regulations mandate dedicated lines.

For most SMBs with standard office workloads – ERP, file servers, email, cloud applications – internet performance in 2026 is more than sufficient. The question isn't "Is internet fast enough?" but "Do I really need an MPLS line for €1,000/month to access the file server at the branch?"

Conclusion

MPLS was the right technology for the right time. But in 2026, with symmetric gigabit internet lines available for under €100/month and WireGuard encryption protecting every packet in real-time, there's no reason for most mid-sized businesses to pay €300–4,000 per site per month to a carrier.

NetBird connects sites directly over encrypted WireGuard tunnels – as a mesh, not hub-and-spoke. New sites are connected in minutes, cloud VPCs as easily as offices, and all access control is identity-based instead of IP-based. With managed NetBird hosting, operations become a managed service – without your own VPN infrastructure, without carrier contracts, at a predictable flat rate.

Try it now: Start your own NetBird instance via the merkaio self-service portal – 7 days free.

Recommended reading: Fortinet VPN Alternative 2026 · OpenVPN Alternative 2026 · Setting Up a Business Network for Remote Employees

Sources

• Savecall: MPLS Costs – Price & Availability Check
• Zscaler: SD-WAN vs MPLS – Cost, Performance & Security
• Lightyear: MPLS vs Site-to-Site VPN – Network Solutions Comparison
• Cloudflare: SD-WAN vs. MPLS
• NordLayer: VPN vs MPLS – Which One to Choose?
• NetBird Documentation: Site-to-Site Connectivity
• NetBird Documentation: Network Routes
• NetBird Documentation: Site-to-Site Office Networks
• NetBird Knowledge Hub: Network Routes and Exit Nodes
• NetBird GitHub Repository
• WireGuard Protocol Specification
• birdhost.de – Managed NetBird Hosting