VPN & Secure Remote Access

Reaching the things that stayed behind

Most of the working day has moved to the cloud. Then there is the rest of it. A file server in the cupboard. An accounts package that expects a mapped drive. A practice-management or design system tied to a licence server. A camera recorder or door controller with a web interface. People still need to reach those from home, from a client’s office, from a hotel on a Tuesday night — and how they get there is the whole question.

The most common answer is the worst one. Somebody forwards port 3389 on the router so a director can use Remote Desktop from home. It works. It also publishes a Windows login prompt on the open internet, where automated scanners find it and start guessing. Remote Desktop exposed this way is still one of the most reliable routes by which a small business ends up encrypted and negotiating with criminals. If your setup includes a forwarded RDP port, treat that as the most urgent item on your IT list this week.

Secure remote access is the alternative: a proper door into your systems, with a lock, a second factor, and a record of who used it.

What we build

• Client VPN — a real VPN on your firewall or router, so staff laptops connect back to the office network from anywhere
• Site-to-site VPN — two or more offices joined into one network, so a share or an application at one site is reachable from the other
• Zero-trust and mesh access — modern tools, usually WireGuard-based, that connect a device to one named application rather than to the entire network
• MFA in front of it — access tied to your Microsoft 365 or Entra identities with multi-factor authentication, rather than a shared password on a note
• Sensible split tunnelling — office traffic through the tunnel, calls and general browsing straight out, so video meetings stay usable
• Published properly, not exposed — where a service truly must be reachable, it goes behind a gateway or reverse proxy instead of a forwarded port
• Joiner and leaver process — profiles and certificates issued with the account and revoked with it, so nothing outlives the employment
• Logging — a record of who connected, from where, and when

Where this comes up

Firms with one thing left on site and everyone else scattered. Accountants running a desktop tax or practice package. Law and property firms with a matter archive on a server. Surveyors and architects with drawing libraries too large to shift overnight. Manufacturers with a stock or order system bolted to a local database. It also comes up in businesses across Croydon and Surrey that opened a second office and now need both to see the same files, and with home-workers and hybrid teams getting by on a remote-control tool nobody deliberately chose.

The honest version

A VPN is not a security product. It is a tunnel. It proves where a connection came from and encrypts what travels inside it, and that is all. Connect an unpatched laptop with no endpoint protection, or a shared family PC, and you have extended your network to include that machine and everything on it. Remote access is only as safe as the devices allowed to use it, which is why we pair it with device standards, patching and endpoint protection rather than selling a tunnel and calling the job done.

And sometimes the right answer is no VPN at all. If the tunnel exists only to reach one file share and one application, moving that last piece to the cloud is usually cheaper than maintaining remote access for it forever. We will say so when it’s true, even though it is less work for us.

How we approach it

1. See what’s already exposed — we check your public address for forwarded ports and open services, and show you what the internet can see today
2. Agree what needs reaching — which systems people genuinely need remotely, and which people
3. Choose the method — client VPN, site-to-site link, zero-trust access, or retiring the resource instead
4. Build and secure — configuration on the firewall or access platform, MFA enforced, split tunnelling set so calls survive
5. Close the old doors — forwarded ports removed, forgotten remote-control tools retired
6. Roll out and document — profiles issued, a short guide written for staff, and the joiner and leaver steps handed to whoever manages accounts

Faults and risks we’re called in for

• Remote Desktop published straight to the internet on port 3389
• A VPN that drops every few minutes, so people quietly stop using it
• Video calls that stutter because every packet is routed via the office
• Leavers whose VPN profile still connects months after they went
• A remote-access tool installed by a former supplier that nobody can account for
• Staff emailing files to themselves because the VPN is too painful to bother with
• Two offices with no link between them and a shared folder copied by hand

Remote access is only as good as the network under it, so if your router and switches are consumer kit added over the years, start with business network setup. The controls that make remote access genuinely safe — patching, endpoint protection, MFA — belong with cyber security. Where the honest fix is retiring the last server, that becomes a cloud migration conversation instead. For a plain-English primer to share with colleagues, read our guide to VPNs for small business, and if you’d like someone looking after the day-to-day once it’s built, see remote IT support.