Corporate network on a VPS: remote access to the office

When employees work from home, travel or sit in several offices, the company's internal systems have to be reachable for them but not for the whole internet. Exposing an ERP, a file server or a CRM directly is risky: bots start probing any open port within minutes. The standard answer is a private encrypted network: an employee first connects to the company gateway and only then reaches internal services. The gateway can live on the office router, but more and more companies put it on a rented VPS. Below is why, how the typical layouts work, which protocol and server to pick and what to do about security.

Why move the gateway to a VPS

An office internet line is rarely a good entry point. The provider may not offer a permanent public IP address, office links are often asymmetric (fast download, slow upload), and a power cut in the building cuts off every remote employee at once. A VPS in a data centre has different conditions:

• a permanent dedicated IPv4 address that does not change on reboot;
• a symmetric 100 Mbps to 1 Gbps port and backup power in the data centre;
• the office connects to the gateway as an ordinary client, so no inbound ports have to be opened at the office;
• several offices and hundreds of employees connect to one point, with no tunnels to set up between every pair of sites.

If internal systems already run in the cloud or on rented servers, a gateway VPS in the same location adds almost no latency to them, and the office simply becomes one more member of the network.

Typical corporate network layouts

Remote access for employees. A VPN server runs on the VPS and every employee has a personal connection profile. Once connected, the laptop gets an address in the internal network and sees only the resources the administrator allowed.

Office to gateway (site-to-site). The office router keeps a permanent tunnel to the VPS. A remote employee connects to the VPS and through it reaches the office subnet: the accounting server, file storage, printers. The office does not need a static IP for this.

Hub and spoke for several branches. Each branch builds a tunnel to the central gateway and exchanges data with the others through it. This is simpler than a full mesh, but the gateway becomes a single point of failure and needs a standby server.

All three layouts usually use split tunnelling: only internal subnets go into the tunnel, while the rest of the laptop's traffic goes out directly. The gateway is not loaded with system updates and video, and employees barely notice the connection in daily work.

Which services to put behind the private network

• ERP and accounting systems. Desktop clients, web clients and remote desktop sessions to the accounting server stay inside the network. They are sensitive to latency, so put the gateway close to the database server.
• File server. SMB or NFS shares should never face the internet; over the private network they work as they do in the office.
• CRM, wiki, ticket system, monitoring. Web interfaces of internal systems can stay without a public address, hidden from crawlers and scanners.
• Git and CI. Repositories, the Docker image registry and build servers are reachable for developers only from the network; administrators also reach production servers over SSH from inside rather than through an open port.

WireGuard, OpenVPN or IPsec

All three protocols encrypt traffic and suit a corporate network; they differ in speed, convenience and compatibility.

A common combination is IPsec or WireGuard between offices and the gateway, plus WireGuard for employees' laptops and phones. Server requirements for each protocol are on the VPS for WireGuard and VPS for OpenVPN pages.

What server to rent

A corporate gateway does not need powerful hardware, but a few parameters matter.

• CPU and memory per number of users. Up to 15 simultaneous connections run fine on 1 vCPU and 1 GB of RAM. For 15–50 employees take 2 vCPU and 2 GB, especially with OpenVPN, which encrypts in a single thread and is limited by per-core speed. More than 50 people or several branches: 2–4 vCPU and a second server on standby. If a user management panel and monitoring run on the same server, add another 1 GB of RAM.
• KVM virtualization. WireGuard and IPsec work at kernel level, and container platforms such as OpenVZ and LXC do not let you load a kernel module. Look for KVM plans.
• Port and traffic. The gateway carries report exports, file sync, backups and video calls. Ten employees easily use several hundred gigabytes a month, and nightly backups between offices use more. You need at least a 100 Mbps port, 1 Gbps for a whole office, and clear terms for traffic overage.
• Location. Put the gateway close to the office, most of the staff and the internal systems. For a team in Germany or the Netherlands, a data centre in the same country keeps latency in single-digit milliseconds. Before paying, ping the host's test IP from the office and from several employees' home connections.
• Static IP. A dedicated IPv4 is required: clients and the office router connect to it. Plans with NAT or a shared address do not work for a gateway.
• Disk. 10–20 GB is enough: the system, configs and connection logs take little space.

Plans that meet these requirements are collected on the VPS for corporate VPN page.

Basic gateway security

The gateway is the one point through which the internal network can be reached from outside, so it needs better protection than any other company server.

• Personal keys and certificates. Every employee gets a personal key, not a shared department password. A leaver is cut off with one command without touching anyone else; keys stay on the device instead of being sent around in messengers.
• Two-factor authentication. OpenVPN and IPsec connect to a user directory and one-time codes; for WireGuard the second factor is added through the portal that issues profiles. Administrators log in to the server itself with SSH keys only, password login disabled.
• Firewall. From outside only the VPN port is open, plus SSH restricted by source address if needed. Inside the tunnel access is split by role: finance gets the accounting system, developers get Git and test servers, everyone else gets the file server and CRM.
• Logs. Record who connected, when and from which address, and keep the logs away from the gateway. You need them for incident investigation and for internal audits.
• Updates and redundancy. Patch the OS and the VPN server regularly. A second gateway in another data centre and a spare profile on every device keep the company working if the main server goes down.

How to roll it out to employees

The technical part takes a day; most problems appear when access is handed out. Prepare a short guide for staff: which app to install, how to import the profile, whom to contact if the connection fails. Issue profiles through a portal or a device management system rather than by email attachments. Start with a small group, such as finance or the development team, check how the accounting system and the file server perform through the tunnel, and only then move everyone else. Give internal services readable names in an internal DNS zone so that people open crm.office instead of a string of digits.

The legal side

A private network for a company's own employees is ordinary information security practice: it protects business data and accounts, including when someone works from a hotel or an airport over public Wi-Fi. Put the rules in internal policies: who gets access, to which systems, how keys are issued and revoked. If personal data of customers or staff passes through the network, the GDPR applies in the EU: choose a host that signs a data processing agreement, keep servers with such data in a suitable jurisdiction and log access to them.

Checklist before launch

• The layout is chosen: remote access, office link or hub and spoke.
• The protocol and the way profiles are issued to staff are decided.
• The server runs on KVM with headroom for simultaneous connections.
• Dedicated IPv4; port and traffic sized for backups and video calls.
• Latency to the gateway checked from the office and from employees' homes.
• Personal keys, a second factor, a firewall and connection logs.
• A standby gateway and an update plan exist.

You can filter servers by virtualization, location, port and price in the VPS search.