Since 2020, working from home has become normal in professional offices too: the accountant finishing a tax return in the evening, the lawyer reviewing a case file while travelling, the part-time assistant. The problem is how people connect to the office. Often the solution was improvised in a hurry and never reviewed. Let’s look at how to set up a VPN for remote work and why it is the safest choice.
What is a VPN?
A VPN (Virtual Private Network) is an encrypted connection that lets a distant device “enter” the office network as if it were physically in the office, over the internet but without anyone else being able to read or intercept the traffic. Think of it as a private tunnel dug beneath a public road.
To connect, you need a program (the VPN client) on the computer of the person working from home and a device in the office that accepts only authorised connections, usually the firewall (→ why the router is not enough).
Business VPNs and commercial VPNs are not the same thing
The VPNs advertised online for “browsing anonymously” or watching content from other countries are designed to hide your location from the websites you visit. They do not give access to the office network and they do not protect it. In this article we are talking only about business VPNs, which securely connect authorised people to the office.
Why “improvised” solutions are dangerous
| Method | How it works | Risk |
|---|---|---|
| Open port on the router for remote desktop | The office computer can be reached directly from the internet | Anyone in the world can try to guess the password; it is one of the most common ways in for ransomware |
| Remote control software that is always on | An external service acts as a bridge to the PC | If the credentials are stolen, access is immediate; often nobody knows who uses it and when |
| VPN with two-factor authentication | You get onto the network only after strong authentication | Much lower risk, provided the VPN is kept up to date and monitored |
Services exposed on the internet are constantly scanned by automated programs that look for open ports and try common passwords. You do not need to be an “interesting” target: being reachable is enough. To find out more, read how ransomware gets into offices.
What a good office VPN should look like
- Mandatory two-factor authentication: a password on its own is not enough (→ guide to MFA and passkeys).
- One account per person, never shared credentials: that way you know who connected and when, and you can revoke access for anyone who leaves the office.
- A modern, up-to-date protocol, such as WireGuard, valued for its simplicity and performance, or equivalent well-maintained solutions.
- Access only to what is needed: someone who needs the management software does not need to reach cameras and the NAS (→ network segmentation).
- Prompt updates to the VPN device: in recent years, vulnerabilities in VPN devices and other devices at the network edge have been among those most exploited by criminals.
- Monitoring of access attempts: repeated failed attempts, connections from unusual countries or at odd hours should trigger an alert.
- A retained access log, which is also useful for GDPR purposes.
Rules for people working from home
- Use the office computer, not the family one shared with the children.
- Update the operating system and programs, including on the laptop that lives at home.
- Encrypt the laptop’s disk: if it is stolen, the data stays unreadable.
- Protect your home Wi-Fi with a strong password and change the router’s default one.
- Lock the screen when you step away, even at home.
- Do not save client documents in personal folders or private cloud services.
- Disconnect from the VPN when you have finished.
- Avoid public Wi-Fi networks for work; if you really have to use one, always connect through the VPN.
A real-world scenario
On a Friday evening, someone in a foreign country tries a hundred passwords on the office VPN. With a properly configured VPN, the attempts fail anyway thanks to two-factor authentication. But it is important information: someone is knocking at the door. In Strega Defence, this event triggers an automatic block on connections from that country, and the owner gets an alert on the app, in plain language, explaining what happened and that they do not need to do anything. Everything is recorded in the log.
A technical detail that makes a difference: the Strega Defence Box communicates with the platform through an encrypted connection that it initiates itself, so managing it and receiving alerts does not require opening any inbound port in the office. Discover Strega Defence.
To check the other aspects of your security too, try the 10-question checklist.
Frequently asked questions
What is a business VPN?
It is an encrypted connection that lets people working away from the office access the office network as if they were there in person. Only authorised people, with their credentials and a second authentication factor, can connect.
Is it safe to use remote control software to work from home?
It can be used in a controlled way, for example for occasional technical support, but leaving it always on as your everyday way of working is risky. If the credentials are stolen, access to the office computer is immediate. For everyday use, a VPN with two-factor authentication is preferable.
Why shouldn’t you open ports on the router?
Because it makes an office service reachable by anyone on the internet. Automated programs constantly scan the network looking for open ports and try common passwords or exploit known flaws: it is one of the most common ways in for ransomware attacks.
Does a VPN slow down your work?
With an adequate connection and a modern protocol such as WireGuard, the slowdown is usually negligible when using management software and documents. It may be more noticeable with very large files or slow home connections.
Does a commercial VPN protect my office?
No. Commercial VPNs are designed to hide your location while you browse and do not give access to the office network. To work remotely you need a business VPN configured on the office’s own network device.
Sources and further reading
- Consigli utili per i dipendenti delle PMI (PDF) (in Italian) — ACN, the Italian National Cybersecurity Agency (Agenzia per la Cybersicurezza Nazionale).
- Consigli utili per i professionisti IT delle PMI (PDF) (in Italian) — ACN.
- #StopRansomware Guide — CISA, MS-ISAC, NSA, FBI.
- Data Breach Investigations Report — Verizon, 2025 edition.
- About OPNsense — OPNsense.
Written by Ing. Sergio Florio, founder of Strega Byte, an engineer with over twenty years of experience across research, development and business. Article updated on 11 October 2026.
