Understanding VPNs
Understanding VPNs
Photo by Dan Nelson on Pexels
A Virtual Private Network (VPN) is the cornerstone of secure remote work. It creates an encrypted tunnel between a remote worker's device and your company network, ensuring that all data passing through is invisible to anyone else on the same network. This lesson explains how VPNs work and which free options are best for small businesses.
How VPNs Work
When a worker connects to a VPN, their device creates an encrypted tunnel to a VPN server. All internet traffic flows through this tunnel. Anyone intercepting the traffic — whether on the same coffee shop Wi-Fi or at the ISP level — sees only encrypted data that cannot be read.
Think of it like a sealed envelope being sent through the mail. The postal workers can see the envelope exists, but they can't read the letter inside without breaking the seal. The encryption is the seal, and it's strong enough that breaking it would take millions of years with current technology.
Types of VPNs for Small Business
1. Traditional VPN (Site-to-Site or Client-to-Site)
A VPN server runs on your office network. Remote workers install a VPN client on their device and connect to the server. Once connected, they can access office resources as if they were physically in the building.
Free option: OpenVPN Access Server — free for 2 simultaneous connections. OpenVPN Community Edition is fully free but requires more setup.
2. Mesh VPN (WireGuard-based)
Instead of a central server, each device connects directly to other devices in the network. It's like a web of encrypted connections rather than a hub-and-spoke model. Setup is simpler and performance is often better.
Free option: Tailscale — free for up to 100 devices. Uses WireGuard under the hood. The easiest VPN to set up that exists today. Takes about 5 minutes for a small team.
3. Cloud-Hosted VPN
A VPN server runs in the cloud rather than on your office hardware. Workers connect to the cloud VPN, which then provides access to your office network through a secure tunnel.
Free option: Set up WireGuard on a free cloud VM (Oracle Cloud free tier, Google Cloud free tier) and configure routing to your office network.
VPN Protocols Compared
- WireGuard: Newest, fastest, smallest codebase (easier to audit), built into Linux kernel. Best choice for new deployments.
- OpenVPN: Battle-tested, widely supported, slightly slower than WireGuard. Best for maximum compatibility.
- IKEv2: Fast, built into most devices, good for mobile (handles network switching well).
- Avoid PPTP: Obsolete and insecure — never use it.
Step-by-Step: Setting Up Tailscale (Easiest Option)
- Create an account: Go to tailscale.com and sign up using your Google, Microsoft, or GitHub account (free for up to 100 devices)
- Install on the office server: On the computer that needs to be accessed, download and install Tailscale from the official site
- Install on worker devices: Each worker installs Tailscale on their laptop, phone, or tablet — available for Windows, Mac, Linux, iOS, and Android
- Authenticate each device: Each device logs in with the same organizational account — Tailscale automatically configures encryption keys
- Verify connectivity: Workers can now access office resources using the Tailscale IP address (e.g., 100.x.x.x) of the office server
- Enable ACLs: In the Tailscale admin console, set up Access Control Lists to restrict which devices can talk to which — don't let everyone access everything
Step-by-Step: Setting Up OpenVPN Access Server
- Download: Get OpenVPN Access Server from openvpn.net (free for 2 simultaneous connections)
- Install on a server: Run the installer on a Linux server or Windows machine on your office network
- Access admin panel: Navigate to https://your-server-ip:943/admin and log in with admin/openvpn (change password immediately)
- Configure user accounts: Create a username and password for each remote worker
- Download client profiles: Each worker downloads their client profile from the user portal
- Install OpenVPN Connect: Workers install the free OpenVPN Connect client and import their profile
- Test the connection: Workers connect and verify they can access office resources
Common VPN Problems and Solutions
- Slow speeds: Use WireGuard or Tailscale instead of OpenVPN for better performance. Check server bandwidth.
- Connection drops: Enable "keepalive" settings. For mobile workers, use IKEv2 which handles network switching better.
- Can't access local printer while on VPN: Enable "split tunneling" so only work traffic goes through VPN — local traffic stays local.
- DNS resolution fails: Configure the VPN to push your company DNS server settings to clients.
Key Takeaways
- VPNs encrypt all traffic between remote workers and your network
- Tailscale is the easiest free option — set up in minutes with no server configuration
- WireGuard is the fastest modern protocol — prefer it over older protocols
- Use split tunneling so workers can print locally while connected to VPN
- Free tiers cover most small business needs — Tailscale free for 100 devices, OpenVPN for 2 connections
Understanding VPNs
Photo by Dan Nelson on Pexels
A Virtual Private Network (VPN) is the cornerstone of secure remote work. It creates an encrypted tunnel between a remote worker's device and your company network, ensuring that all data passing through is invisible to anyone else on the same network. This lesson explains how VPNs work and which free options are best for small businesses.
How VPNs Work
When a worker connects to a VPN, their device creates an encrypted tunnel to a VPN server. All internet traffic flows through this tunnel. Anyone intercepting the traffic — whether on the same coffee shop Wi-Fi or at the ISP level — sees only encrypted data that cannot be read.
Think of it like a sealed envelope being sent through the mail. The postal workers can see the envelope exists, but they can't read the letter inside without breaking the seal. The encryption is the seal, and it's strong enough that breaking it would take millions of years with current technology.
Types of VPNs for Small Business
1. Traditional VPN (Site-to-Site or Client-to-Site)
A VPN server runs on your office network. Remote workers install a VPN client on their device and connect to the server. Once connected, they can access office resources as if they were physically in the building.
Free option: OpenVPN Access Server — free for 2 simultaneous connections. OpenVPN Community Edition is fully free but requires more setup.
2. Mesh VPN (WireGuard-based)
Instead of a central server, each device connects directly to other devices in the network. It's like a web of encrypted connections rather than a hub-and-spoke model. Setup is simpler and performance is often better.
Free option: Tailscale — free for up to 100 devices. Uses WireGuard under the hood. The easiest VPN to set up that exists today. Takes about 5 minutes for a small team.
3. Cloud-Hosted VPN
A VPN server runs in the cloud rather than on your office hardware. Workers connect to the cloud VPN, which then provides access to your office network through a secure tunnel.
Free option: Set up WireGuard on a free cloud VM (Oracle Cloud free tier, Google Cloud free tier) and configure routing to your office network.
VPN Protocols Compared
- WireGuard: Newest, fastest, smallest codebase (easier to audit), built into Linux kernel. Best choice for new deployments.
- OpenVPN: Battle-tested, widely supported, slightly slower than WireGuard. Best for maximum compatibility.
- IKEv2: Fast, built into most devices, good for mobile (handles network switching well).
- Avoid PPTP: Obsolete and insecure — never use it.
Step-by-Step: Setting Up Tailscale (Easiest Option)
- Create an account: Go to tailscale.com and sign up using your Google, Microsoft, or GitHub account (free for up to 100 devices)
- Install on the office server: On the computer that needs to be accessed, download and install Tailscale from the official site
- Install on worker devices: Each worker installs Tailscale on their laptop, phone, or tablet — available for Windows, Mac, Linux, iOS, and Android
- Authenticate each device: Each device logs in with the same organizational account — Tailscale automatically configures encryption keys
- Verify connectivity: Workers can now access office resources using the Tailscale IP address (e.g., 100.x.x.x) of the office server
- Enable ACLs: In the Tailscale admin console, set up Access Control Lists to restrict which devices can talk to which — don't let everyone access everything
Step-by-Step: Setting Up OpenVPN Access Server
- Download: Get OpenVPN Access Server from openvpn.net (free for 2 simultaneous connections)
- Install on a server: Run the installer on a Linux server or Windows machine on your office network
- Access admin panel: Navigate to https://your-server-ip:943/admin and log in with admin/openvpn (change password immediately)
- Configure user accounts: Create a username and password for each remote worker
- Download client profiles: Each worker downloads their client profile from the user portal
- Install OpenVPN Connect: Workers install the free OpenVPN Connect client and import their profile
- Test the connection: Workers connect and verify they can access office resources
Common VPN Problems and Solutions
- Slow speeds: Use WireGuard or Tailscale instead of OpenVPN for better performance. Check server bandwidth.
- Connection drops: Enable "keepalive" settings. For mobile workers, use IKEv2 which handles network switching better.
- Can't access local printer while on VPN: Enable "split tunneling" so only work traffic goes through VPN — local traffic stays local.
- DNS resolution fails: Configure the VPN to push your company DNS server settings to clients.
Key Takeaways
- VPNs encrypt all traffic between remote workers and your network
- Tailscale is the easiest free option — set up in minutes with no server configuration
- WireGuard is the fastest modern protocol — prefer it over older protocols
- Use split tunneling so workers can print locally while connected to VPN
- Free tiers cover most small business needs — Tailscale free for 100 devices, OpenVPN for 2 connections
There are no comments for now.
to be the first to leave a comment.