Work / Case study
Secure Remote Access — pfSense Firewall + WireGuard VPN
Designed, deployed and administer the agency's perimeter firewall and zero-cost WireGuard VPN, enabling secure remote access for a hybrid workforce of 20+ users.
Business impact
Delivered secure, zero-license-cost remote access for a hybrid workforce of 20+ users without granting local admin rights, and made VPN access part of the offboarding control set.
Problem
Remote and hybrid staff needed secure access to on-premises resources (file server and printers), but the agency had no managed firewall or VPN, and staff laptops don't grant local admin rights.
Solution
Procured and deployed a Netgate 2100 running pfSense as the network perimeter, with WireGuard as the single standardized VPN. The rollout was engineered so non-admin users can connect and disconnect on their own, without weakening endpoint controls.
Results & highlights
- Procured the Netgate 2100 (October 2025) and brought the VPN into production in December 2025
- Onboarded 20+ remote and in-office users
- Achieved non-admin enablement: WireGuard deployed as a Windows service with a least-privilege network-operator role (January 2026)
- Built VPN access revocation into the employee offboarding checklist (access governance)
- Led incident response: diagnosed and resolved a server-side issue blocking remote access to on-prem systems (August 2026)
- Benchmarked file-share throughput over the VPN against the LAN, and used the data to move bulk workloads on-network
Competencies demonstrated
- Network security: Netgate 2100 running pfSense as the agency's perimeter firewall.
- VPN engineering (WireGuard): One standardized VPN, with the tunnel deployed as a Windows service.
- Identity & access management: Least-privilege network-operator role, and access revocation built into the offboarding checklist.
- Incident response: Diagnosed and resolved a server-side issue blocking remote access to on-prem systems (August 2026).
- Performance benchmarking: Measured LAN vs VPN throughput and used the data to move bulk workloads on-network.
Architecture
- Staff laptoptunnel runs as a Windows service
- Non-admin togglelimited operator UI, no keys shown
- Encrypted WireGuard tunnelremote access
- pfSense firewallperimeter + VPN endpoint
- Office resourcesfile storage, printing, internal tools
Notes
- Network specifics (addresses, interfaces, peers) are intentionally omitted.
Open-source companion
wireguard-nonadmin-windows on GitHub: Rolls out a WireGuard VPN to Windows laptops where users don't have admin rights, and lets them turn the tunnel on and off without ever seeing a key.