Many companies don’t move all their services to the cloud at once. The finance software or website moves to a cloud server, while the file server, printers and perhaps the domain controller stay in the office. For the two parts to work as a single network, you need a secure, stable connection between the office and the data center. This article focuses on what is specific to connecting an office to cloud servers.
Why VPN instead of open ports?
Without a VPN, the only way to reach a cloud server is to open service ports to the internet: RDP, database, file sharing. That puts every service directly in the line of attack. With a VPN, the cloud server is reachable only over an encrypted path from the office network, and its internal ports stay closed to the internet.
Two common patterns
- VPN directly on the server: If you have only one cloud server, you can build the tunnel directly between the office firewall and the server itself. It is simple, but becomes hard to manage as servers are added.
- A virtual firewall or router in the data center: A virtual firewall, such as pfSense, OPNsense or a MikroTik virtual router, sits in front of the cloud servers, and the tunnel runs between it and the office firewall. The servers sit behind it on a private network. For more than one server, this is the cleaner and more secure pattern.
Common protocols for this connection are IPsec and WireGuard. The choice depends on the equipment at each end; what matters is that both sides support it well.
Address and DNS design
- Avoid duplicate IP ranges: If the office network and the servers’ private network are both
192.168.1.0/24, routing won’t work. Choose different ranges from the start. - Align DNS: If you have an Active Directory domain, the cloud server must use the domain’s internal DNS so names and domain logons work correctly.
- A second domain controller: If the cloud servers depend on the domain, a domain controller on the cloud side ensures that a tunnel outage doesn’t stop authentication there.
Which services work well over VPN?
However good a VPN tunnel is, its speed and latency can’t compare with the office’s local network.
- Good fit: Remote Desktop and RemoteApp, web-based applications, email and nightly backups.
- Problematic: Opening large files from a cloud file share, and client-server applications where the program is installed on the user’s computer and talks directly to the database on the cloud server; these usually become very slow over a link with latency.
For client-server applications, it is usually better for users to work on the same server through Remote Desktop or RemoteApp, so the application and database sit side by side and only the screen image crosses the VPN.
Connection reliability and security
- Give the office a backup internet link and configure the tunnel so it can also come up over the second link.
- Monitor the tunnel status so outages are spotted before users call.
- In the firewall, instead of allowing everything between the two networks, allow only the necessary traffic; for example, from the office to the server’s RDP port and specific services.
- After the VPN is set up, close the cloud server’s management ports on its public IP.
Checklist
- The office and data center IP ranges don’t overlap.
- DNS and the domain work correctly on both sides.
- Latency-sensitive applications are used through RDP or the web.
- Firewall rules between the two networks are limited and specific.
- The cloud server’s management ports are closed to the internet.
- The tunnel is monitored and has a backup path.
When designed correctly, a hybrid model combines the best of the office and the data center. ITPlus724 engineers can design, deploy and maintain the VPN connection between your office and your cloud servers.