STACK.GE
ქარ Let’s talk

Infrastructure 06.4 — VPN

VPN and secure access

Branches, remote staff and external services — all in one secure network. WireGuard, IPsec, L2TP and site-to-site, on physical hardware or an OPNsense VM.

Start a project Explore
0
Ports exposed
4protocols
WireGuard · IPsec · L2TP · SSL
24/7
Remote access

VPN / capabilities

What it covers

I configure both the server and the client side — and expose only what is genuinely needed.

WireGuard

Modern, fast and simple. I set up the server, generate clients and manage access centrally.

Site-to-site

Two offices as one network — an IPsec or WireGuard tunnel with a persistent link and automatic recovery.

IPsec and L2TP

Compatibility with older gear and the built-in Windows client — where WireGuard is not an option.

OPNsense VM

A virtual firewall and VPN gateway on Proxmox — full functionality without a separate appliance.

Physical appliance

Consulting, selection and setup — Netgate, Protectli or another appliance, sized to you.

Access policy

Who connects where, what they see and when — split tunnel, groups and key rotation.

process

How the process runs

  1. 01

    Requirement

    How many users, how many sites and what must be reachable.

  2. 02

    Architecture

    Protocol, topology and where the gateway lives — physical or VM.

  3. 03

    Configure

    Server, clients, routing and firewall rules.

  4. 04

    Handover

    Profiles, instructions and testing on real devices.

cases

Examples

Branches

Three offices, one network

Site-to-site tunnels and shared internal services — as if you were in one building.

Remote

A team from home

WireGuard profiles on phones and laptops — internal systems with no exposed ports.

faq

Common questions

Which protocol is better?

For new deployments — WireGuard. IPsec/L2TP when existing gear or the built-in Windows client requires it.

Will it slow down my internet?

With split tunnel only internal traffic goes through the tunnel — normal browsing stays direct.

Is a physical appliance required?

No. An OPNsense VM is enough in most cases; a physical appliance when the network is critical.

All directions

Other sub-directions

06.1 Proxmox VE 06.2 Backup 06.3 Network 06.5 Proxy and HTTPS 06.6 S3 storage 06.7 Uptime Kuma

Need secure access without open ports?

I will prepare the architecture and show it working in a test environment.

Let’s talk

Contact

Get in touch about your technical task

Contact me by phone or WhatsApp. Critical incidents are covered 24/7; other requests are handled within the agreed support schedule.

Call now +995 510 10 35 35 Straight to the phone

24/7 on critical incidents — Response mode

If I miss your call, I will get back to you.