VPS for a corporate VPN

A corporate VPN on a rented server joins staff, the office and internal systems into one private network. Remote employees use it to reach the accounting system, file storage and CRM, branches exchange data over an encrypted link, and administrators reach servers from inside the network instead of through SSH exposed to the whole internet. It also encrypts laptop connections on hotel, airport and café Wi-Fi. None of this needs a powerful server: what matters is bandwidth, traffic, the virtualization type and how access is issued.

Protocol: WireGuard, OpenVPN or IPsec

WireGuard is the fastest and simplest: a short config, keys instead of passwords, clients for Windows, macOS, Linux, iOS and Android. It suits remote access for employees and linking two or three offices. Requirements and plans are on the VPS for WireGuard page.

OpenVPN is slower, but it also runs over TCP, checks certificates from your own certificate authority and plugs into LDAP or Active Directory, which helps when employee accounts are already managed centrally. It encrypts in a single thread, so core frequency matters more than core count: see VPS for OpenVPN.

IPsec (strongSwan, IKEv2) is the usual choice for site-to-site links: office routers and firewalls support it out of the box, and so do the built-in clients of Windows and macOS, so employees do not need to install anything.

Sizing by number of employees

• Up to 10–15 people: 1 core and 1 GB of memory is plenty for WireGuard or OpenVPN plus a simple user management panel.
• 15–50 people: 2 cores and 2 GB, especially for OpenVPN; when a whole department works at once, a single core becomes the bottleneck.
• More than 50 people or several branches: 2–4 cores, a port of 1 Gbit/s or more and a second server on standby. If the only gateway goes down, the whole company loses its internal systems.
• Disk hardly matters: 10–20 GB holds the system, configs and several months of logs.

Virtualization should be KVM only. OpenVZ and LXC do not let you load a kernel module or fully configure the network stack, so WireGuard and IPsec either will not start there or will run slowly. The table above already lists KVM only.

Bandwidth and traffic

A corporate VPN carries more than requests to internal systems: report exports, backups, file sync and video meetings go through it too. Ten employees working with shared files and calls easily use several hundred gigabytes a month, and replication between branches adds terabytes. That is why this selection has plans without a traffic cap; all of them are on the unlimited traffic VPS page. Look at the port speed too: 100 Mbit/s is shared by everyone connected at the same time, so a team or an office needs 1 Gbit/s. With some hosts «unlimited» means fair use, and speed can be cut under constant load, so read the terms before paying.

Where to put the server

Place the gateway close to the people who use it: the office, most of the staff, or the internal systems they need to reach. Every extra ten milliseconds shows in remote desktop, accounting software and voice calls. If the team is spread across cities or countries, test the ping from several of them to the host's test IP or looking glass, since the route to the same data centre differs between providers. A company needs a dedicated IPv4 address: plans with NAT and a shared address are awkward for accepting incoming connections from employees.

Logs, access control and GDPR

Give every employee their own key or certificate instead of a shared password, so a person who leaves can be cut off in a minute without touching anyone else. Keep a connection log (who, when, from which address), allow logins to the server itself with SSH keys only and close unused ports with a firewall. Inside the tunnel, open only the subnets each group needs: finance gets the accounting system, developers get the test servers.

If personal data of customers or staff passes through the VPN, GDPR applies. The host becomes a data processor, so you need a data processing agreement (DPA) with it, and a server inside the EU or EEA keeps the setup simple. Connection logs with IP addresses are personal data as well: set a retention period in your internal policy and do not keep them longer.