Tutorials · Security
How to Set Up Remote-Access VPN for Staff
Give employees secure access to office systems from anywhere with an IPsec or SSL client VPN, per-user accounts, 2FA and least-privilege rules.
Before you start
- A gateway or firewall with client-VPN support
- A dedicated VPN address pool
- A user directory or local user list
Step by step
Choose the VPN type
SSL VPN works through most hotel and mobile networks. IPsec/IKEv2 is efficient and built into many operating systems. Use what your gateway supports best.
Create an address pool
Reserve a subnet such as 10.200.0.0/24 for VPN clients that does not overlap any office or home range.
Create individual accounts
One account per person, never shared. Link to Active Directory or LDAP where possible.
Require two-factor authentication
Add an authenticator app or certificate. Stolen VPN passwords are a leading cause of breaches.
Choose split or full tunnel
Split tunnel sends only office traffic through the VPN (lighter). Full tunnel sends everything (more control and inspection). Decide by policy.
Apply least-privilege rules
Allow VPN users only to the servers and ports they need, not the whole network. Use groups for departments.
Push DNS
Give VPN clients the internal DNS server so internal names resolve.
Distribute and test
Provide a short guide to users, test from a mobile hotspot and check logs.
Monitor and offboard
Review logins for unusual times or countries and disable accounts the day someone leaves.
Pro tips
- Patch the VPN gateway quickly; VPN appliances are a favourite attack target.
- Limit failed login attempts and alert on brute-force patterns.
FAQ
Frequently asked questions
Split tunnel or full tunnel?
Split tunnel is faster for users. Full tunnel gives more security inspection. Many organisations use split tunnel plus endpoint protection.
Keep learning
Related guides
Two-factor authentication
Read more →Site-to-site VPN
Read more →How to Enable 802.1X Port Authentication on Switches
Stop unknown devices from using your network ports: configure 802.1X with RADIUS and MAC-authentication bypass for printers and cameras.
Read more →How to Secure the Management of Switches, Routers and Access Points
A hardening checklist for every network device: strong credentials, SSH only, a management VLAN, access lists and logging.
Read more →How to Segment IoT and CCTV Devices From Your Main Network
Put cameras, smart TVs, sensors and building systems in their own VLANs so one compromised device cannot reach your business systems.
Read more →Stuck on a step?
Ask Navijin technical support or an authorised partner for help with your configuration.