Managed WireGuard VPN in Romania

Three kinds of VPN, one private network

The first level is access for people: every colleague gets their own key and profile, with a tunnel limited to company resources. The second is a permanent link between offices and servers, for branches or warehouses. The third, which almost nobody configures, is the internal VPN between your servers: a private network where the application talks to the database and the queues through an encrypted tunnel instead of the open internet.

• A separate profile and key for each device, revocable on its own
• Permanent links between offices, warehouses and servers
• A private network between servers, with stable addressing and controlled routing
• A bastion host for administration, with an access log

Best practices we apply to VPN access

A badly configured VPN gives false comfort: the tunnel exists and works, yet the admin ports stayed open to the internet exactly as before. We apply the list below on every installation and verify it by scanning from outside after delivery, so you see in black and white what still answers. It stays in your documentation, together with the procedure for revoking a lost or stolen device.

• SSH, databases and admin panels reachable ONLY over the VPN or a private network
• Per-device keys with periodic rotation and immediate revocation when someone leaves
• Split tunnelling by default: company traffic goes through the VPN, not the whole internet
• A bastion or jump host for administration, instead of direct access to servers
• Logging of connections and configuration changes, with alerts on anomalies

WireGuard, OpenVPN, Tailscale and authentication

WireGuard is easier to audit, reconnects faster on mobile and is simpler to maintain: a few dozen lines of configuration instead of hundreds. OpenVPN remains useful for old equipment that cannot run WireGuard, or when you must integrate with an existing certificate infrastructure. Hosted tools such as Tailscale are convenient, but they tie your access to a third-party service. On top, we add multi-factor authentication at the admin portal and the bastion, so a stolen key is not enough on its own.

What the included hours cover

Installing the VPN, moving administration services onto the private network and configuring the bastion come out of your monthly hours: 1–8 h on VPS, 5–10 h on dedicated servers depending on the plan, 10 h on GPU servers. Request the work in the client panel under DevOps Services with a deadline of your choice. For a company with a few remote colleagues and two servers, the first setup usually fits inside one monthly allowance. Extra hours are billed separately.

How we work

1. Request it in the panel

   Tell us how many people need access, which offices you want linked and which servers must talk to each other, then propose a deadline.

2. We scope the work

   We draw the private network addressing, decide what stays public and what closes, and estimate the hours from your monthly allowance.

3. We build it and check from outside

   We install WireGuard, move administration into the tunnel, close the exposed ports, then scan from the internet to confirm what no longer answers.

4. Handover with documentation

   You receive the access profiles, the private network map, the procedure for revoking a key and the firewall rules we applied.

Use cases

Technology stack

• WireGuard
• nftables
• OpenSSH
• Fail2ban
• Ansible
• HashiCorp Vault
• Prometheus
• Grafana

Frequently asked questions

• What is a VPN, and why does a company need one?

  A VPN builds an encrypted tunnel between a device and the company network. You need it so internal services, such as SSH, databases, admin panels and test environments, are not exposed to the internet. Without one, your only defence is a password on a public port.

• WireGuard, OpenVPN or Tailscale: which should I choose?

  WireGuard in most cases: smaller configuration, better performance and quick reconnection on mobile. OpenVPN stays justified for old equipment or an existing certificate setup. Tailscale is convenient, but it adds a hosted control plane and a vendor dependency that a self-managed WireGuard network avoids.

• How do I set up a WireGuard site-to-site VPN between servers?

  You generate a key pair on each side, agree the private addressing, open one UDP port and write the routing and firewall rules. The delicate part is not the installation but what you close afterwards, which is why we verify it with a scan from outside.

• Do I still need a VPN if my servers have private networking?

  Provider-level private networking helps inside one data centre. A WireGuard mesh is the answer when servers sit in different data centres, or at different providers, and it adds per-device keys, rotation and an access log.

• How do I stop exposing database and cache ports to the internet?

  Bind the services to the private WireGuard addresses, close the public ports in the firewall and move administration into the tunnel. Then scan from outside. Databases, caches and queues stop listening on a public IP, so east-west traffic is encrypted and invisible from the internet.

• What happens when someone leaves the company?

  We revoke their key and access stops immediately, without touching anyone else, because every device has its own key pair. The procedure is in the documentation you receive, so you can apply it yourself in a few minutes.