1. A non-transitory machine-readable medium having executable instructions to cause one or more processing units to perform a method to dynamically establish a first virtual private network (VPN) tunnel, the method comprising:detecting, with a first branch network element, data destined for a first private subnet;
in response to the detecting, determining that a next hop for the data does not have an established VPN tunnel that allows access to the first private subnet;
establishing the VPN tunnel from the first branch network element to a second branch network element providing access to the first private subnet, the VPN tunnel bypassing a hub network element; and
sending the data using the VPN tunnel.