We put an agency's whole staff on secure remote access in one afternoon.
An agency needed its whole staff, dozens of people, on secure remote access at once, each with a fixed static IP and full-tunnel egress. One afternoon, one batch, every account live on the first attempt. The method was recon first, batch second, verified by reading the state back.
In this article 3 sections
- A digital agency needed its entire staff, dozens of people, on secure remote access at once: each with a fixed static IP (so downstream systems recognize them) and full-tunnel egress through the agency's own public address.
- Doing this by hand, one console click at a time, is where mistakes and a lost afternoon live.
- We read the live gateway configuration before touching anything, and it set the plan.
- Then one API-driven pass: dozens of accounts, each with its own static IP, every one live on the first attempt, delivered as a package.
The ask, plainly: the whole staff, secure access, every user pinned to a static address, full-tunnel, done correctly, in one pass. Why one-pass matters to an agency is simple. Onboarding is overhead, and overhead scales with mistakes.
Recon before touching anything
The first move was read-only reconnaissance. We read the live gateway configuration first, which showed three things to account for. We confirmed the tunnel network had room for the whole roster. Full-tunnel was already enabled server-side, so no routing change was needed. And the static-IP override belongs under one specific configuration node, next to a similarly named key that is easy to confuse with it.
“Read the live configuration first. Then build.”
The batch, as a runbook
Recon, read-only
Enumerate the live config and update the notes to match it.
Create via the standard tooling
Each identity gets a certificate, a local credential, a generated client bundle, and a 32-character password, all through the gateway's REST API. The console stays closed, which is the house rule.
Pin the addresses
Each account assigned a static IP from a clean free range.
Verify by reading back, then prove one live
Re-read the override table after apply, then prove one bundle live end to end before the batch ships. Trust the state, not the write.
The receipt
ALL
1
1st
1
What made it one pass is position. These are gateways we operate, with the configuration model's traps already known, driven through an API where every step is repeatable and every result is checkable. The people who run the gateway are the people who provisioned it.
This was not a heroic one-off. The same toolkit and discipline recur across our agency customers, and the productized version is its own story in we built a VPN Control Center for an agency's own team. A pattern is stronger evidence than an anecdote.
“A whole staff onto secure access in one afternoon, and not one of them had to know how it worked.”
Straight answers
How do you give remote staff fixed static IPs on a VPN?+
Per-user address reservations on the gateway, from a clean unallocated range, applied through the API and then verified by re-reading the assignment table. The verification step is the part that matters most.
How do you bulk-create VPN users without errors?+
Recon first (the live config, not the wiki), collision-check every name, and create through the API with standard tooling.
Why is my static IP assignment not applying?+
On some gateway platforms the override belongs under one specific configuration node, next to a similarly named key. If the client gets a dynamic address, check which node holds the override.
Full-tunnel or split-tunnel for staff VPN?+
This rollout was full-tunnel by requirement: all egress through the agency's own public address so downstream systems see one identity. Split-tunnel trades that control for less backhaul. It is a policy decision, so make it before provisioning, because it defines the server-side config.
How long does onboarding a whole team onto a VPN take?+
This build took one afternoon, batch-provisioned, with a test bundle proven live before the rest shipped.
Onboarding a whole team?
Bring us the roster. One clean batch, no console clicking, and a bundle for each person that just works.
Talk to an engineerYou’ve reached the end.
Put the reading to work
What are
you running?
Tell us about the workload, traffic and recovery requirements. Start with the server builder, or talk through the details with an engineer.
Written by the engineers who build and run the infrastructure it describes.Talk to an engineer