“We need a VPN” is one of the most common - and most misapplied - requests we get from Perth businesses. Sometimes it's exactly the right call. Often it's solving the wrong problem, or being set up in a way that creates more risk than it removes. Here's what a business VPN actually does, when you need one, and how to avoid the mistakes that turn a security tool into a security hole.
What a business VPN actually does
A VPN (Virtual Private Network) creates an encrypted tunnel between a device and a network, making that device behave as if it's plugged in locally - even from a cafe, a home office, or another country. There are two distinct types businesses use, and confusing them is where a lot of setups go wrong.
Remote access VPN
One person, one device, connecting into the office network. A staff member working from home opens a VPN client, authenticates, and gets access to internal file shares, an accounting server, or other on-premises systems as if they were sitting at their desk. This is what most people mean when they say “VPN.”
Site-to-site VPN
Two networks, permanently connected. A warehouse and a head office, or a Perth CBD office and a regional site, linked so traffic flows between them automatically without anyone connecting manually. This is typically built between two firewalls and stays up continuously. For businesses with several sites and heavy cloud usage, SD-WAN has largely replaced basic site-to-site VPN as the modern approach - it does the same job with better performance and automatic failover.
Do you actually need one?
This is the question worth answering before anything else, because a lot of Perth businesses have a VPN they don't need - or need one they don't have.
You probably need a VPN if: staff need to reach an on-premises server, an internal line-of-business application that isn't published to the internet, or network-attached storage that only exists on your office LAN.
You probably don't need one if: your business runs on Microsoft 365, SharePoint, a cloud-hosted line-of-business system, or similar platforms already built for secure access from anywhere. Adding a VPN on top of a cloud-first setup usually adds a login step, a support burden, and a false sense of security, without protecting anything that wasn't already protected. We cover this distinction in more detail in our guide to remote work IT setup for Perth businesses.
Business VPN vs consumer VPN
These get confused constantly, and they solve completely different problems.
| Feature | Consumer VPN (NordVPN, ExpressVPN, etc.) | Business VPN |
|---|---|---|
| Purpose | Hide browsing location, encrypt public WiFi traffic | Securely reach your own company network or servers |
| Traffic routed through | Third-party provider's servers | Your own firewall or cloud gateway |
| Authentication | Username/password to the VPN provider | Your own directory - Microsoft Entra ID, on-prem AD, or firewall user database |
| Gets you access to your office network? | No | Yes |
| Supports MFA and conditional access? | Rarely | Yes, when configured properly |
A consumer VPN is a reasonable personal tool for working securely on public WiFi. It is not a substitute for business remote access, and it should never be the only thing standing between a staff laptop and your company data.
Common business VPN platforms
The right platform depends on what you're running already:
- Firewall-based (FortiClient, SonicWall, WatchGuard) - remote access VPN built into your existing firewall. The most common setup for Perth SMBs, since it's usually included in firewall licensing you already pay for.
- Cloud-native (Azure VPN Gateway, AWS Client VPN) - for businesses whose “office network” is really a cloud environment rather than a physical site.
- Mesh VPN (Tailscale, ZeroTier) - increasingly popular for small teams. Connects individual devices directly to each other rather than routing everything through a central gateway, with simpler setup and per-device access control.
- Windows Always On VPN / Entra Private Access - Microsoft's own remote access options for businesses already deep in the Microsoft 365 and Intune ecosystem.
Where VPN setups go wrong
Most VPN-related incidents we see aren't caused by the VPN itself - they're caused by how it's configured:
- No MFA on the VPN login - a stolen password becomes full network access. This is one of the most common initial access points in ransomware incidents nationally.
- Full tunnel by default - routing all internet traffic through the office connection, including video streaming and personal browsing, which slows the VPN down and increases load on your office internet for no security benefit. Split tunnelling (only routing traffic bound for the office network) is usually the better default.
- Shared or generic VPN accounts - one login used by multiple staff, which destroys any audit trail when something goes wrong.
- Access left open after offboarding - former staff or contractors retaining VPN credentials because account disablement wasn't part of the offboarding checklist.
- Outdated VPN protocols - older PPTP or unpatched SSL VPN appliances have a poor security track record. Modern IPsec (IKEv2) or WireGuard-based VPNs are the current standard.
Is VPN outdated? VPN vs Zero Trust
A traditional VPN works on an “inside vs outside” model - once you're authenticated and connected, you're broadly trusted as being inside the network. Zero Trust flips that assumption: no request is trusted by default, regardless of whether it's coming from inside the tunnel or not, and every request is verified against identity, device health, and context.
In practice, this isn't VPN versus Zero Trust - most Perth businesses run both. A VPN or ZTNA client still provides the connection; Zero Trust principles (MFA, conditional access policies, least-privilege permissions) determine what that connection is actually allowed to do once it's established. A VPN without MFA and access controls behind it is the setup we'd flag first in a security review.
What does a business VPN cost?
- Firewall-based remote access VPN - typically included in existing FortiGate or equivalent firewall licensing, no extra cost for a small number of users
- Mesh VPN (Tailscale, ZeroTier) - roughly $5-$15 per user per month, depending on plan and features
- Cloud gateway VPN (Azure/AWS) - usage-based, generally $30-$150/month for a small business depending on data volume and connection hours
- Site-to-site VPN between offices - free between compatible firewalls, aside from configuration time; budget a few hours of setup work
Frequently Asked Questions
Does my Perth business actually need a VPN?
Only if staff need to reach resources that aren't already internet-facing - an on-premises server, an internal line-of-business system, or network-attached storage. If your business runs entirely on Microsoft 365, SharePoint, and other cloud platforms, a VPN usually adds complexity without much security benefit - focus on MFA and endpoint management instead.
What's the difference between a business VPN and a consumer VPN like NordVPN?
Consumer VPNs route your traffic through a third-party provider's servers to hide your location and encrypt browsing - useful on public WiFi, but irrelevant to accessing your office network. A business VPN creates an encrypted tunnel directly into your own network or servers, authenticated against your own directory (Microsoft Entra ID, on-prem AD, or a firewall's user database) - not a third party's.
Is a VPN outdated compared to Zero Trust?
Not outdated, but increasingly limited on its own. A traditional VPN grants broad network access once a user authenticates, which is risky if that account is compromised. Zero Trust Network Access (ZTNA) verifies every request individually rather than trusting everything inside the tunnel. Many Perth businesses now run both - a VPN or ZTNA client for connectivity, with Zero Trust principles (MFA, conditional access, least privilege) layered on top.
How much does a business VPN cost?
For a firewall-based VPN (most common for Perth SMBs), there's typically no extra cost beyond your existing FortiGate or similar firewall licensing - remote access VPN is usually included. Dedicated remote access platforms like Tailscale or Azure VPN Gateway run roughly $5-$15 per user per month. Site-to-site VPN between offices is generally free between compatible firewalls, aside from setup time.
Not sure if your VPN is set up securely - or whether you need one at all?
We design and manage secure remote access for Perth businesses, from a straightforward firewall VPN to a full Zero Trust rollout. We'll assess what you actually need and configure it properly - MFA included.
Talk to us about secure remote access →For related reading, see our guides to Remote Work IT Setup for Perth Businesses and Zero Trust Security for Perth Businesses.