The three main approaches are VPN (encrypted tunnel to your network), Remote Desktop Gateway (controlled access to specific desktops), and zero-trust solutions (per-application access without network-level connectivity).
Step 1: VPN Server Setup
Provide encrypted network access for remote workers.
1
Choose VPN Solution
Built-in router VPN: Many business firewalls include VPN server, easiest to deploy
OpenVPN: Free, open source, battle-tested, large community, runs on pfSense, OPNsense
WireGuard: Newer protocol, faster and simpler than OpenVPN, excellent performance
Windows Server RRAS: Built-in for Microsoft environments, integrates with Active Directory
For most small businesses, pfSense/OPNsense with OpenVPN or WireGuard is the best value
2
Configure VPN Server
Use AES-256 encryption with SHA-256 or SHA-384 for maximum security
Enable multi-factor authentication for all VPN logins (not optional)
Create individual VPN certificates or credentials per user (never share)
Limit VPN access to only the network segments each user needs
Assign VPN users to a dedicated subnet separate from on-site users
Set session timeouts: Disconnect idle sessions after 30 minutes
Block split tunnelling, force all traffic through VPN for security
Configure concurrent session limits per user account
3
VPN Client Deployment
Distribute VPN client software and configuration files to authorised users
Use MDM to auto-deploy VPN profiles to managed devices
Test VPN connectivity from various ISPs and locations
Provide clear setup instructions for each operating system
Set up always-on VPN for company-owned devices
Create a self-service portal for VPN certificate renewal
Warning:
Never expose Remote Desktop Protocol (RDP port 3389) directly to the internet. RDP brute-forcing is one of the top ransomware delivery methods. Always require VPN first.
Step 2: Remote Desktop Access
Allow employees to access their office desktops remotely.
1
Remote Desktop Gateway
Windows Server: Install Remote Desktop Gateway (RD Gateway) role
RD Gateway acts as a secure proxy, users connect to Gateway, Gateway connects to desktops
Configure connection authorisation policies (who can connect)
Configure resource authorisation policies (what they can access)
Use SSL certificates from a trusted CA for the Gateway
Enable Network Level Authentication (NLA) for pre-authentication
2
Security Hardening
Change RDP from default port 3389 to a custom port on internal systems
Enable account lockout after 5 failed login attempts
Restrict RDP access to specific Active Directory security groups
Configure Windows Firewall to limit RDP source IP ranges
Keep all systems fully patched: RDP vulnerabilities are regularly discovered
Enable RDP session recording for sensitive systems if compliance requires it
Disable clipboard and drive redirection for high-security environments
3
Third-Party Alternatives
AnyDesk Business: Easy deployment, good performance, from 10 pounds/month per user