🔐 Business VPN: how to protect calls and remote work

A Business VPN creates an encrypted tunnel between each employee's device and the company network. Everything that travels through it —calls, messages, files— stays protected even when people work from home, a hotel or a café.

Why it matters for communications

With remote work, your team's Softphone and Chat run over networks the company does not control. Without a VPN, the phone system has to be exposed to the internet so those devices can register, and every shared network becomes a weak spot. With a VPN, the phone system only accepts devices that arrive through the tunnel.

Regular VPN or fail-closed

Most VPNs depend on employees remembering to connect, and if the tunnel drops, traffic keeps flowing over the local network without anyone noticing. A fail-closed VPN does the opposite: if the tunnel is not active and validated, the services do not start.

• Regular VPN: more convenient, but a call can travel outside the tunnel without warning.
• Fail-closed: you lose "keep working anyway", and you gain that company traffic never leaves the tunnel.

One key per device

The classic mistake is a single configuration file emailed around to everyone. The right approach gives each device its own key pair and its own address inside the network. You always know which device connected, and when someone leaves or loses a laptop, you revoke that device without touching anyone else.

Split tunnel: company traffic only

With split tunnel, only corporate traffic enters the tunnel. Personal browsing goes out over the employee's own connection: it does not load the company link or mix the employee's private life with the corporate network.

What to ask of a VPN for remote work

• Reconnects on its own when switching from wifi to mobile data, so calls do not drop.
• Uses little battery and CPU on laptops and phones.
• Is managed from the same portal as users and extensions.
• Lets you revoke a device immediately.
• Does not expose the phone system to the internet.

How to roll it out without slowing the team down

1. Inventory the devices: which computers and phones each person uses for work. Each one will get its own key.
2. Start with a pilot group: three or four people who work from home. That surfaces networks with blocks before rolling out to everyone.
3. Provision from the portal: each device receives its configuration on activation, with no files emailed around.
4. Explain what changes: the Softphone not starting without the tunnel is a security measure, not a fault. Saying so up front avoids needless tickets.
5. Define the offboarding process: who revokes the device when someone leaves or reports a lost laptop, and how fast.

With those five steps, the VPN stops being a network project and becomes part of onboarding each user, just like their email or extension.

How TelHarbor does it

TelHarbor's VPN uses WireGuard, is fail-closed and comes included with the UCaaS platform: without an active tunnel, the Softphone, Chat, remote support, terminal and file transfer do not start. Each device has its own key, the tunnel restores itself and everything is managed from the portal. See the Business VPN and how we protect every service on Security and trust.