VPN(VPN)
Angleški izraz: Virtual Private Network
An encrypted connection between a user and the business network that allows employees to work securely with internal resources from anywhere.
Kaj pomeni VPN?
A VPN (Virtual Private Network) establishes an encrypted "tunnel" between the user's device and the business network. Traffic flowing through this tunnel is unreadable to an external observer, and the device behaves within the internal network as if it were physically in the office.
In the business world, two types are most commonly used: site-to-site VPN (a permanent connection between two locations, e.g., headquarters and a branch) and client-to-site VPN (an employee connects to the business network from a personal or work device).
The most common protocols are OpenVPN, IKEv2/IPsec, and WireGuard. WireGuard is newer, faster, and easier to maintain; OpenVPN is still the most widespread in existing environments.
Zakaj je to pomembno za podjetja?
A VPN is a prerequisite for remote work that isn't reckless. Without a VPN, employees access internal servers and applications either via publicly exposed services (which is a risk) or not at all, which limits work flexibility.
A VPN simultaneously reduces the attack surface: instead of having RDP, a file server, or an ERP open to the internet, only the VPN server with MFA is publicly accessible. All other services are reachable exclusively via the VPN.
Kje se to pojavi v praksi?
A typical example: an employee in the field opens the VPN client on a laptop, enters a password, and confirms the login with an MFA application. After a few seconds, they have access to the file server, ERP, and the office printer, exactly as if they were sitting at their desk.
Another common setup: a site-to-site VPN between headquarters and a production location, which allows control systems, cameras, and office services to function as a single network, even though the locations are connected via the internet.
Najpogostejše težave ali napake
The most common mistake is a VPN with only a username and password, without MFA. A stolen password (via phishing) is enough for an attacker to position themselves inside the internal network, from where the damage is disproportionately greater than with an external attack.
Another common issue: a VPN that allows everyone access to the entire internal network. The correct approach is for each group of users to get access only to the services they actually need.
A third mistake: forgotten VPN access for former employees or external contractors. Without an overview of the account list, a group of active accesses that should have been revoked long ago accumulates over time.
Kako pri tem pomaga VitalIT
At VitalIT, we help companies set up remote access so that it is both secure and practical for employees. For existing environments, we first check which VPN is being used, whether it has MFA, and how permissions are managed.
In practice, we set up the VPN on pfSense or another firewall, enable MFA (for example via TOTP or Microsoft Authenticator), organize access by roles, and prepare documentation for users. We adapt the solution to the actual environment and the agreement with the client.
Sorodni izrazi
Povezane storitve
Pogosta vprašanja
- Is a VPN overkill for a small company?
- No. As soon as a company has at least one employee who occasionally works from home or in the field, a VPN is a significantly more secure solution than opening internal services directly to the internet.
- VPN or Zero Trust: which is better?
- It is not an "either-or" situation. A VPN is an excellent baseline solution that is fully sufficient for most small and medium-sized businesses. A Zero Trust approach makes sense in larger environments with many external contractors and diverse devices.
- Is a commercial VPN (NordVPN, ExpressVPN) suitable for a business?
- No. A commercial VPN protects an individual's privacy from the ISP, but it does not provide access to internal company resources. Business use requires your own VPN server.
- Does the VPN have to operate 24/7?
- The VPN server must be reachable whenever users need it. In a high-availability setup, two firewalls are paired so that failover occurs automatically in the event of a failure.