# Remote access and VPN. Secure access to the company network from home and other sites.

Source: https://vetosec.at/en/solutions/fernzugriff-vpn/

A classic VPN often opens the whole company network, outside vendors included. We set up access per person and device, with a second factor at sign-in.

- **Remote work** and sites
- **Sign-in** with a second factor
- **Vendors** time-limited

## What changes for you

- **Access only to approved systems**: Accounting sees accounting, the maintenance contractor only their machine. A stolen laptop does not open the whole network.
- **Vendors with an expiry date**: Outsiders get access for one appointment and one system. Afterwards it closes automatically.
- **Sites like one network**: Branches, warehouse and data centre are connected and still separated from each other.
- **Simple for staff**: Sign in once and the connection is up. No profiles or certificates to install.

## What runs behind it

- **Modern encryption**: A lean, audited VPN protocol with fixed modern ciphers. Less code means less attack surface.
- **No exposed admin ports**: Servers and admin consoles are unreachable from the internet, only via remote access.
- [**Sign-in with MFA**](https://vetosec.at/en/solutions/single-sign-on/): Via your single sign-on. Account disabled means access disabled.
- **Self-hosted**: The control plane runs in your infrastructure; your connection data sits with no third party.

[How we build in general](https://vetosec.at/en/how-we-build/)

## What we set up

Thought through in detail so your team never notices it.

- **Access by role**: Policies per group: staff, servers, vendors. Every connection is explicitly allowed, everything else stays closed.
- **Device checks before access**: Only devices with a current operating system and client get in. Outdated or unknown devices stay out.
- **Internal names at home**: Servers are reachable by their internal names, even from home. All other internet traffic goes direct and stays fast (split DNS).
- **Existing networks included**: Printers, phone systems or machines in the office network are reachable without a client on every device. Redundant over two paths if you want.
- **Direct connections**: Devices connect directly and encrypted. A detour via a relay server is only used when there is no other way.
- **Log of every connection**: Who was connected to which system and when. That helps in audits and in an incident.

## What it looks like

- Access overview: At a glance: which device reaches which servers and networks through which policy.
- Policies: Every connection has a policy with source, destination, direction and ports. Servers only talk over the ports they need.
- Internal DNS zone: Your own internal zone: your team uses meaningful names instead of IP addresses wherever it works.
- Devices: Every device with group, operating system, version and last contact. Outdated clients stand out immediately.

## Proof of Concept

**Try remote access before you switch.**

We connect a few devices to a test system. You see how sign-in works and how precisely access can be controlled.

Request a PoC

## Service or project

**We run it for you, or your team takes over.**

As a managed service for a fixed monthly price, with updates, backup and monitoring. Or as a project with handover of network plan, runbook and all credentials.

## For IT leads

Technical details: NetBird · WireGuard · Authentik

- **Zero trust network access**: NetBird, self-hosted. The control plane runs in your infrastructure.
- **Data plane**: WireGuard, direct encrypted connections between devices, relay only as fallback.
- **Authentication**: Authentik via OpenID Connect with MFA.
- **Policies**: Per group with source, destination, direction and port. Default deny.
- **Posture checks**: Minimum OS and client versions before access.
- **Networks without a client**: Routing into existing subnets for printers, telephony and machines, optionally redundant.
- **DNS**: Internal zone with split DNS, all other traffic goes straight to the internet.
- **Sites**: Fixed site-to-site links with WireGuard.
- **Audit**: Connection events per person and system.

## Further reading

More on the topic

- [**VPN**](https://vetosec.at/en/it-security/vpn/): A VPN (virtual private network) is an encrypted connection that lets staff working away from the office dial into the company network.
- [**Zero trust**](https://vetosec.at/en/it-security/zero-trust/): Zero trust is a security model in which every request for access is verified on its own, including requests that come from inside the company network.
- [**Netzwerksegmentierung für KMU: Klein anfangen, Wirkung erzielen**](https://vetosec.at/en/articles/it-wissen/netzwerksegmentierung-kmu-praxis/): A practical approach to network segmentation for SMEs.

## Frequently asked questions

### How is this different from a classic VPN?

A classic VPN puts the device inside the company network. With per-person and per-device access each connection reaches only approved systems. That is called zero trust.

### Which technology do you use?

NetBird for per-person and per-device access with sign-in via Authentik, WireGuard for fixed links between sites. Both self-hosted.

### Does this work with our existing firewall?

In most cases yes. We check upfront and adjust the rules.

### Who do you offer this to?

For regulated companies, professions bound by confidentiality and anyone processing sensitive data, and for companies of about 30+ staff with critical systems.

## Related

- [Solutions](https://vetosec.at/en/solutions/): Nextcloud, SSO, backup, clusters
- [Managed services](https://vetosec.at/en/services/managed-services/): fixed price per service
- [How we build](https://vetosec.at/en/how-we-build/): security and backup standards

## VPN and zero trust network access for businesses in Austria

vetosec sets up secure remote access in Austria with NetBird, WireGuard, SSO and MFA.

Updated: October 19, 2026

Provider: vetosec, Dipl.-Ing. Samuel Ziegler, BSc, Berndorf, Lower Austria, Austria. Contact: https://vetosec.at/en/contact/