Setup of Secure VPN Access Infrastructure with Network Segmentation

Project Description:

The client approached us with the need to organize a comprehensive secure infrastructure for employees' remote access to servers via RDP. There was a threat of direct internet access to critical systems. The SVC Service team developed a multi-layered solution based on OpenVPN on Mikrotik with mandatory tunnel access and network segmentation.

Implemented Tasks:

• Conducted an analysis of the existing network infrastructure and security requirements.
• Deployed and configured an OpenVPN server on a hardware Mikrotik router in the client's server room.
• Built an architecture with mandatory server access exclusively through the VPN tunnel.
• Configured server (Windows) firewalls to allow RDP only from VPN pool IP addresses.
• Implemented network segmentation via VLAN on Mikrotik and Cisco: main VLAN for employees and servers, guest VLAN for visitors and IoT devices.
• Configured firewall rules between VLANs to enhance security.
• Configured VPN connection profiles for users with dynamic IP assignment.
• Implemented split tunneling for external traffic optimization.
• Organized centralized management of certificates and access keys.
• Deployed a VPN connection stability monitoring system.

Tools Used:

• Mikrotik RouterOS
• Cisco Catalyst
• OpenVPN
• RDP (Remote Desktop Protocol)
• Windows Server Firewalls
• Security Certificates

Project Results:

• Established a reliable, secure channel for employees' remote work from any location.
• All RDP sessions are protected by a dual layer: VPN encryption and server-level access restrictions.
• Significantly improved the overall network security level by eliminating direct RDP ports to the internet.
• Reduced risks of internal threats through traffic segmentation via VLANs.
• The client received centralized access management and a transparent security architecture.
• Ensured high availability and minimal latency for critical services.
• The client is satisfied with the result and continues cooperation with SVC Service.

This case demonstrates the comprehensive approach of the SVC Service team to building secure infrastructure, combining hardware resilience, VPN technologies, and a multi-layered protection strategy based on network segmentation.