A remote team needs a VPN path that is boring and repeatable: named users, one dedicated address and a short onboarding routine. The setup below uses a private OpenVPN Access Server so laptops reach internal tools, git, panels and SSH without exposing them to the internet.
Decide before you invite anyone
- List which services become VPN-only: admin panels, SSH, RDP, staging and internal wikis.
- List who needs access by role, not “everyone forever”.
- Choose split tunnel (only company traffic uses the VPN) or full tunnel (all traffic exits through the dedicated IP).
- Write down a break-glass path through the provider console in case the VPN host is down.
Setup sequence
- Provision Private VPN and note the dedicated IP and the admin address of the Access Server.
- Create one user per person, or per device. Avoid a shared profile.
- Distribute profiles over a secure channel and test the client on every operating system your team uses.
- Lock the servers. Set the firewall on your cloud or dedicated servers so SSH and panels accept the VPN address only.
- Test from a home network. Connect and open an internal URL, then disconnect and confirm access is blocked.
- Offboard by revoking the user on the day someone leaves.
Habits that keep it working
| Habit | Why |
|---|---|
| VPN required before deploys and database access | Keeps production off the open internet |
| Re-issue profiles after a lost laptop | Stops a stolen device from connecting |
| Patch the VPN server | You hold root, so updates are yours |
| Keep a one-page runbook | Remote setups fail more from undocumented exceptions than from cryptography |
For the hardening behind the tunnel, read VPN and SSH security. To check whether private or shared fits you, see private vs shared VPN.
Frequently asked questions
How many users fit?
It depends on the VPS size and how many connect at once. Start small, watch CPU and bandwidth, then scale the VPS.
Split or full tunnel?
Split for lighter load. Full when policy requires all traffic to leave through the dedicated IP.
What if a user forgets the profile passphrase?
Revoke the profile and issue a new one. Never share passphrases in public chat.
Where does the endpoint run?
In Sofia, next to the EuroVDC cloud and dedicated servers.
