Business VPN: Secure Resource Access from Anywhere

A VPN (Virtual Private Network) in a business environment allows employees secure access to internal resources (shared folders, ERP, applications) regardless of their location. In addition to individual access, companies increasingly require a site-to-site VPN between branches or between an on-premises location and the cloud.

TL;DR — Key Points

• For remote users, we recommend WireGuard — fast, simple, modern cryptography
• IPsec remains the standard for site-to-site between firewalls
• OpenVPN is the most compatible, but slower
• MFA is mandatory — a VPN without MFA is a security hole

Protocol Comparison

Site-to-Site Between Branches

A classic scenario: the headquarters has a pfSense firewall, and the branch does too. We establish an IPsec tunnel between them with a strong algorithm (AES-256-GCM, SHA-256, DH group 14 or higher) and route traffic using NAT exceptions. For HA, we recommend redundant WAN connections and availability monitoring.

If one side is in Azure, we use Azure VPN Gateway or Azure Virtual WAN. The latter greatly simplifies management for multiple locations and offers transitive routing.

Remote Users: WireGuard in Practice

1. Install the WireGuard package in pfSense.
2. Create a tunnel, assign a subnet (e.g., `10.100.0.0/24`).
3. Generate a key pair and a configuration file with a QR code for each user (for mobile apps).
4. Restrict access from the VPN subnet in the firewall only to the necessary internal resources.
5. For MFA, use a combination: WireGuard for the tunnel + Conditional Access for applications, or an additional login page.

Zero Trust instead of Classic VPN

The modern approach is moving away from the "log in to the VPN once and access the entire network" model. Instead, every access to every application is verified separately — Zero Trust Network Access (ZTNA). In a Microsoft environment, we implement this with Entra Private Access, which allows the user to access internal applications without a VPN client, while every access is verified via Conditional Access.

VPN Security Hygiene

• MFA is mandatory for all VPN logins (TOTP, passkey, or FIDO2 key)
• Do not expose VPN ports unnecessarily — if possible, use port knocking or VPN via WireGuard with key rotation
• Log all VPN logins and analyze anomalies
• Segment access — a VPN user should not see the entire LAN, only the required resources
• Regularly remove inactive accounts (ex-employees, test accounts)

Performance and Bandwidth

In practice, WireGuard achieves between 80% and 95% of the net connection speed, while IPsec with hardware acceleration (AES-NI, QAT) is comparable. If you work in Azure and transfer large files, consider ExpressRoute — a dedicated connection that bypasses the public internet.

Backup Access and Monitoring

What happens if the main WAN connection fails? Prepare a backup path — an LTE modem, a secondary connection from another provider, or a VPN via mobile phone for emergencies. For VPN monitoring, use pings and active tests (e.g., an HTTP request to an internal portal), not just the tunnel status.

Do we need a VPN if everything is in the cloud?

If everything is accessible via a browser and protected by MFA + Conditional Access, maybe not. A VPN remains useful for accessing dedicated resources (SQL, RDP, printers, license servers).

What is the speed difference between WireGuard and OpenVPN?

In our tests on a 1 Gbps connection, WireGuard reaches 900+ Mbps, while OpenVPN typically reaches 250–400 Mbps. The difference stems from WireGuard's simpler cryptographic stack and the fact that it runs in the kernel.

Do we need our own VPN server or a service?

To access internal resources, you need your own VPN (pfSense, Azure VPN Gateway, etc.). Public VPN services (NordVPN, ExpressVPN) do not provide access to your infrastructure.

What about split tunneling?

We recommend split tunneling for traffic that does not require a VPN (Teams, web) to reduce the load on the VPN gateway. Use a full tunnel for traffic to internal applications and regulated systems.