A customer asked us for a VPS. Instead of selling one, we asked why.
The answer led to a simpler, safer setup built from equipment they already owned: a secure way to share one computer with an overseas supplier, without exposing the rest of their network.
Book a free conversationRead the original post- The aska VPS, to share a system with an overseas supplier
- The answeran old laptop, a WireGuard VPN and Dynamic DNS
- The resultsecure access from anywhere, without paying a typical $30 to $40 a month for a VPS
The challenge
An e-commerce business came to us asking for a VPS. We were curious, and asked what they planned to use it for. We also pointed out the significant ongoing cost of running one.
After talking it through, the real need became clear. They had to give an overseas supplier partner shared access to a system so the two companies could work together on tasks. What they did not want was to hand over their own PC on their own network, which could expose their data and network to security risks.
Why renting compute adds up
A VPS looks cheap on the first invoice. The cost is that it never stops. You pay for the server every month whether anyone is logged in or not, and compute is not getting cheaper: demand for cloud capacity keeps growing, and providers price CPU, memory, storage, bandwidth and backups accordingly.
- It is a subscription, not a purchase. At a typical $30 to $40 a month, a VPS runs roughly $360 to $480 a year, and $1,080 to $1,440 over three years, with nothing left to show for it.
- The base price is rarely the final price. Backups, extra storage, bandwidth and software licences are commonly add-ons.
- You still have to maintain it. A rented server does not patch or secure itself. Someone still has to keep it updated and locked down.
- Idle time costs the same as busy time. This client only needed access for a handful of tasks, but a VPS bills around the clock.
Two ways to solve it
| Rent a VPS | Use what they already had | |
|---|---|---|
| What it is | A rented server in a data centre | An old laptop on their own network |
| Ongoing cost | Typically $30 to $40 per month, every month | Built on equipment and a network they already owned |
| Control | Depends on the provider | Firewall rules written and owned by the client |
| Risk to the main network | Kept apart by design | Kept apart by firewall rules we set up and tested |
The second path was more custom work up front, but it fit the client’s situation better. We had already installed a UniFi solution for them, which made it straightforward.
How the pieces fit together
The supplier connects over an encrypted VPN. The firewall lets that connection reach one machine and nothing else.
How we built it
- 01
Harden the PC
We made sure the machine was running the latest version of Windows. Then we restricted what the supplier’s account could reach, limiting it to specific applications and folders using Windows Policy Manager under the user account created for this purpose.
- 02
Turn on remote access
We enabled Remote Desktop Protocol (RDP) on the hardened PC, so the supplier’s team could work on it as if they were sitting at it.
- 03
Build the VPN
Using the UniFi OS interface, we spun up a WireGuard VPN server. Each of the supplier’s users got their own client account, so access can be given or taken away person by person.
- 04
Lock down the network
Strict firewall policies let VPN clients reach that one PC and nothing else. Access to the rest of the internal network was explicitly blocked.
- 05
Control internet traffic
We also blocked direct internet access (WAN) for connected VPN clients. Their internet traffic has to go through the designated PC, which prevents access to other online resources and keeps the client’s bandwidth from being misused.
- 06
Keep it reachable
The client had no static IP address, so we set up Dynamic DNS with a free service such as no-ip.com, directly from the UniFi interface. The VPN stays reachable even when the home IP address changes.
Security layers at work
No single control carries the whole job. Several layers back each other up:
- A hardened machine. Updated, and limited to the applications and folders the work needs.
- Individual accounts. Each supplier user has their own VPN credentials, so access can be tracked and removed one person at a time.
- Network segmentation. VPN clients can reach the one PC and are explicitly blocked from everything else.
- Controlled internet use. Connected VPN clients cannot go straight out to the internet. That protects the client’s bandwidth and keeps the setup from being misused.
- Encrypted access. WireGuard keeps the connection private between the supplier and the client’s network.
The result
The client and their supplier can now securely access the system from anywhere in the world, without the recurring cost of a VPS, which typically runs $30 to $40 a month. The integrity and security of the client’s internal network stay protected.
What this shows
It is a small example of how we like to work. We ask what the problem really is before choosing the tool, we look at what a client already has, and we build in security from the first step instead of adding it later.
- Start with the use case. The right answer depends on what the business needs to do, not on the product they first asked for.
- Reuse before you buy. Equipment and networks you already own can often do more than expected.
- Give access to a thing, not to the network. Limit what a partner can reach, and nothing more.
Could this work for your office?
Plenty of small offices need to give a supplier, contractor or remote employee access to one system without opening up everything else. If that sounds familiar, we would be glad to talk through the options and tell you plainly what fits.
Related reading
- Cybersecurity. How we assess risk, lock down firewalls and protect small offices.
- Network and Wi-Fi. Segmented networks, guest Wi-Fi and secure remote connectivity.
- Identity Services. Individual accounts, MFA and access control.
- Managed IT Plans. How per-device and per-server plans work, with or without on-site support.
- 2025 password guidelines. Practical advice on passphrases and multi-factor authentication.
- The original blog post. The short version of this story.
Need secure access without the monthly cost?
Tell us what you need to share and with whom. We will tell you plainly how we would approach it.
Book a time[email protected]