VPN for businesses: Secure remote access to company data

Working from home, business trips, home office, remote access to company data is now a common requirement. But how to do it securely? The answer is a corporate VPN. In this article we explain what a VPN is, why your company needs one and what options are available.

What is a VPN and how does it work

A VPN (Virtual Private Network) creates an encrypted tunnel between an employee's computer and the company network. Think of it as a private line that no one can eavesdrop on.

When an employee connects via VPN from home, their computer behaves as if it were physically in the office. They have access to company shared folders, printers and internal systems, exactly as at the workplace. And no one along the way can see what data they are transferring.

Warning: a corporate VPN is not the same as commercial VPN services (NordVPN, ExpressVPN etc.), which are used to anonymise web browsing. A corporate VPN is a tool for securely connecting to your own network.

When a company needs a VPN

• Employees work from home whether regularly or occasionally, they require secure access to company data
• Do you have a company server or NAS? Access to data on servers outside the office requires a VPN.
• You are using internal applications: accounting software, ERP, CRM or other systems available only on a local network
• Employees travel: connecting to a hotel or café via public Wi-Fi without a VPN is a security risk
• You have multiple branches: A VPN connects branches into a single virtual network

WireGuard vs. OpenVPN

The two most widely used protocols for corporate VPNs. What is the difference between them?

Our recommendation: For most small and medium-sized enterprises we recommend WireGuard. It is faster, easier to manage and more modern. OpenVPN makes sense in specific situations, for example when integrating with older systems or where F-gas certification is required.

Split ducting: A smarter approach

Split tunnelling is a feature that determines which traffic goes through the VPN and which goes directly to the internet. Without split tunnelling, all traffic (including YouTube, personal email, and messages) passes through the corporate network. This slows down both the VPN and the corporate connection.

With a split ducted system:

• Access to the company server, shared folders and internal applications is via VPN (encrypted).
• Ordinary browsing, YouTube and personal communication go directly to the internet (faster).

The advantage is higher speed and reduced load on the corporate network. The disadvantage is that corporate security policies (content filtering, antimalware) do not apply to internet traffic. For most companies, split tunneling is a reasonable compromise.

How to implement a VPN

Deploying a corporate VPN requires:

1. VPN server, software running on your company router, server or dedicated device. Many business routers (MikroTik, UniFi, FortiGate) have a built-in VPN server.
2. Public IP address or DDNS: so that employees can connect via the internet
3. Client configuration: installing and configuring the VPN application on employees' computers and mobiles
4. Safety rules: who has access to what, logging, multi-factor authentication

The entire process typically takes an experienced technician 2-4 hours for a small business.

Safety recommendations for corporate VPNs

• Multi-factor verification: combine VPN login with a second factor (see article on IT security)
• Strong credentials and certifications: no simple passwords, ideally asymmetric keys
• Logging: record who connected and when, in case of a security incident
• Regular updates The VPN server must be up to date to avoid known vulnerabilities.
• Deactivation when an employee leaves: immediately revoke VPN access when an employee leaves the company

What it costs

A corporate VPN need not be an expensive affair:

• WireGuard/OpenVPN on an existing router: the software is free; you only pay for configuration (3 000-8 000 Kč)
• Dedicated VPN router: if the existing router does not support VPN, a new one costs 5 000-15 000 Kč
• Monthly costs: practically zero, VPN runs on your own hardware

Compare this with the risk: a leak of company data via an unsecured connection can cost hundreds of thousands. A VPN is an investment in security that pays off from the first moment.

Alternatives to VPN

VPN is not the only way to access remotely. Other options:

• Cloud services Microsoft 365, Google Workspace and other cloud applications are accessible from anywhere without a VPN. If everything is in the cloud, you may not need a VPN.
• Zero Trust / Cloudflare Tunnel: a modern approach where access to each application is verified individually instead of connecting to the entire network. Suitable for more advanced companies.
• Remote desktop (RDP over VPN): the employee connects to their office computer and works on it remotely. Important: Never expose RDP directly to the internet; always only via VPN.

As IT Administrator for Companies in Prague 1 We will assess your situation and recommend the optimal remote access solution, whether that is a VPN, a cloud-based solution, or a combination of both.