Category: Networking and VPN
Managed VPN with WireGuard or OpenVPN: remote working and connected offices
A VPN server in your name so the team can work from home and your offices and servers talk through an encrypted tunnel, with joiners and leavers that do not depend on anyone's memory.
- Where it runs
- In your account, in your name
- Backups
- With tested restores
- Updates
- Planned and documented
- Licence
- Open source: WireGuard GPLv2, OpenVPN Community GPLv2 (Access Server is commercial)
In short
WireGuard and OpenVPN are two open source VPN programs: they create an encrypted tunnel between your people's computers, your offices and your servers. We set up the server in your account or in your office, give each person their own key, use firewall rules to separate what each group can access, back up the configuration and keys, monitor the tunnels and keep everything up to date.
What do we take care of?
Setting up a VPN that works in an afternoon is easy. The hard part comes later: the key that was shared by email, the laptop of someone who left months ago and still connects, or the server nobody knows how to rebuild. This is what we keep under control:
VPN server
WireGuard or OpenVPN in your account or your office, with a fixed domain name as the entry point.
Per-person keys
One key or certificate per device, with a record of who has what and since when.
Joiners and leavers
New access the same day and removals that cut the connection instantly.
Firewall
Per-group rules: administration, technical staff or partners, each only to what is theirs.
Offices and clouds
Permanent tunnels between offices and to your provider’s private network.
Monitoring
Tunnels down, devices that stop connecting and certificates that are about to expire.
What kind of VPN do we set up?
There are two different uses, and many companies need both at once:
| Use | What we set up | What it achieves |
|---|---|---|
| Remote working | A VPN server and a client on each laptop or phone | Each person gets into the office servers, folders and software from home |
| Between offices | A permanent tunnel between the routers or servers at each office | The offices share a network without anyone having to connect anything |
| To the cloud | A tunnel between the office or the laptops and the provider’s private network | Databases and internal dashboards with no port open to the internet |
By default we split the traffic: only what needs to reach the internal network goes through the VPN, and normal browsing goes out over each home connection. If you need all traffic to go out through the office, for example so that a service recognises you by IP, that can be done too.
What problems do we come across most often?
- A single key for the whole team: if it leaks or someone leaves, it has to be changed on every computer at once.
- Access for people who are no longer there: nobody removed their key and their laptop still gets in.
- Everything open once inside: whoever connects can reach any server, printer or folder on the network.
- Remote desktop or the NAS open to the internet because the VPN was causing trouble.
- A server with no backup or documentation: if it breaks, every laptop has to be reconfigured by hand.
- Outdated software on the router or server that acts as the gateway to the whole network.
How do we handle backups, upgrades and restores?
The server configuration, the firewall rules and the list of devices live in a repository, and the server is built from it with Ansible. The server’s private keys and, with OpenVPN, the certificate authority are stored encrypted off the machine, in a secrets manager or a separate backup. Since the laptops point at a domain name and not an IP, we can rebuild the server on another machine with the same keys and the clients reconnect without reinstalling anything. We rehearse it every so often and note how long it takes.
The system and the VPN software are updated with security patches scheduled in an announced window. Before big changes, such as moving from OpenVPN to WireGuard, we run both side by side for a few days so that each person can switch without rushing.
Who is it for?
- An accountancy or law firm with remote working that needs its people to open the accounting software, the file server or the office remote desktop from home without leaving them exposed to the internet.
- A software company with servers in the cloud that wants to reach databases, dashboards and internal servers without opening administration ports and with one key per person.
- A company with two or more offices, or with an office and servers in the cloud, that wants everything to work as a single network.
If your team is growing, works from many places and you want single sign-on and per-person rules without managing keys by hand, a private network with NetBird or Tailscale may suit you better.
How do we protect the VPN?
The VPN server is the gateway to the whole network, so it only exposes the VPN port: administrative access goes through the VPN itself or from specific IPs, with SSH by key only. With OpenVPN we add a username and password with two-factor authentication on top of the certificate when needed. Connections and failed attempts are logged, and if you already have a SIEM we send them to Wazuh so that an odd connection at an odd hour does not go unnoticed. We monitor the tunnels and the server from monitoring with Grafana and Prometheus.
- Staff devicesVPN client with its own key
- WireGuardVPN server in your name
- FirewallPer-group rules
- Internal networkServers, offices and cloud
Where do we set it up?
In your account, with the provider you already use or the one that fits best. If the data has to stay in the EU, Hetzner and OVHcloud are the European options.
Providers we set it up on
- Hetzner
- AWS
- Google Cloud
- Azure
- DigitalOcean
- OVH
- Own server
| Provider | How we set it up | Things to bear in mind |
|---|---|---|
| Hetzner | A small cloud server with a fixed IP, the Hetzner firewall open only on the VPN port and a private network to the other servers. | Usually the simplest and cheapest option for a stable entry point. |
| AWS | An EC2 instance in your VPC, with a security group limited to the VPN port and the source/destination check disabled so that it can route. | AWS Client VPN is the AWS managed service, based on OpenVPN; we first compare its cost and limits with setting it up ourselves. |
| Google Cloud | A Compute Engine machine with IP forwarding enabled and VPC firewall rules. | |
| Azure | A virtual machine with IP forwarding enabled on its interface and a route table into the virtual network. | |
| DigitalOcean | A Droplet with a reserved IP inside your VPC and Cloud Firewall in front. | |
| OVH | A Public Cloud instance or a dedicated server with a private network (vRack) to your servers. | |
| Own server | The VPN server in the office, on a small machine or on the router itself if it runs OPNsense or pfSense. | It depends on the office connection and IP: if the router goes down, nobody gets in from home. |
What is included
- VPN server with WireGuard or OpenVPN in your cloud account or in your office, with the configuration described as code.
- One key or certificate per person and per device, never shared, with a record of who holds each one.
- Joiners and leavers handled the same day: removing a person cuts their access instantly without affecting anyone else.
- Per-group firewall rules, so that each person only reaches the servers and folders they need.
- Tunnels between offices and to your cloud, with routes and internal DNS sorted out.
- Encrypted backups of the configuration, the server keys and, with OpenVPN, the certificate authority.
- Monitoring of tunnels that are down, devices that do not connect and certificates about to expire.
- System and VPN software updates, and a rehearsed restore of the server on another machine.
Frequently asked questions
WireGuard or OpenVPN?
For a new installation we usually propose WireGuard: it is simpler to configure, faster and has been built into the Linux kernel since version 5.6. OpenVPN is still the best option when you need a username and password with two-factor authentication on the server itself, or when people have to connect from networks that only allow outbound traffic on port 443 over TCP. If you already have OpenVPN working, there is no need to change it for the sake of it.
What happens when someone leaves the company or loses their laptop?
We delete their key in WireGuard, or revoke their certificate in OpenVPN, and from that moment that device no longer connects. Since each person and each device has its own key, nobody else has to change anything. The removal is noted in the access record.
Do we have to pay for licences?
WireGuard and OpenVPN Community are open source and have no per-user licence. OpenVPN Access Server, the commercial version with a web dashboard, is free for up to two simultaneous connections and needs a subscription beyond that. What you do pay for is the server the VPN runs on.
Can the office be connected to the cloud or to another office?
Yes. We set up a permanent tunnel between the router or a server at each site and your cloud's private network, with routes so that each side sees only what it should. That way two offices, or your office and your servers at Hetzner, work as if they were on the same network.
Is a VPN enough to comply with data protection?
It helps with part of it, because it encrypts traffic and controls who gets into the network, but it is not enough on its own. Passwords, two-factor authentication, backups, permissions on each folder and keeping computers up to date also count. If you want to know where you stand, we review it in an audit.
Tell us about your case
In a free 20-minute call we look at where you are and where to start. No commitment.
Official documentation consulted
The technical details on this page are based on:
Reviewed on