The server has moved to the cloud, but accounting wants to work “like before” — open 1C without thinking about connections. A VPN solves this, but there are three options, and they differ greatly in security.
Option 1. Open a port to the internet
The simplest approach: RDP or the 1C server is reachable directly by IP address. It’s the most common setup — and exactly how ransomware gets into offices. An open RDP port gets scanned by bots within an hour of appearing; password brute-forcing runs around the clock. Acceptable only for websites (80/443) and with protection; for RDP, SQL and 1C — no.
Option 2. A VPN client on every computer
A VPN server (WireGuard or OpenVPN) runs on the cloud server, and each employee has a client and a key. Connect and you’re on the same network as the server; disconnect and the server is invisible from outside. Pros: works from home and from a laptop on a business trip, and access is revoked by deleting the key when someone leaves. Cons: you need to install the client on every device and explain why.
Option 3. Site-to-site VPN on the router
A tunnel is established between the office router (MikroTik, Keenetic, or any with WireGuard/IPsec support) and the cloud. Every computer in the office sees the server as if it were “next door” — no clients or settings on workstations. Office cameras connect to cloud video surveillance the same way, as does the office PBX. Downside: for working from home, you still need option 2.
What to choose
| Task | Solution |
|---|---|
| Website, public API | 80/443 open, everything else closed |
| 1C, RDP, files for office staff | site-to-site VPN on the router |
| The same staff working from home | + VPN client with 2FA |
| Office cameras → cloud archive | site-to-site VPN or Bridge-32/64 without VPN |
| External 1C developer | a separate VPN key restricted by port, revoked after the job |
Practical details
- WireGuard is simpler and faster than OpenVPN; it’s supported by MikroTik routers with RouterOS 7, Keenetic and pfSense.
- Office and cloud address spaces must not overlap: if the office uses 192.168.1.0/24, use 10.10.0.0/24 in the cloud.
- Tunnel speed is limited by the office internet connection — for 1C over RDP, 10 Mbps is enough for 10 users.
- Backup link: a second internet connection in the office (4G) with automatic tunnel failover.
How we do it
Our “Network & IP” service includes setting up a VPN server in the cloud and a tunnel to your office router, issuing keys to employees and instructions for them. Usually it takes one business day. For cameras, a VPN-free alternative is the Bridge device with local recording if the internet goes down.
Need help with the task from this article?
We’ll pick a configuration, calculate the cost and help with the move.