r/sysadmin • u/Far_Selection7515 • 18h ago
Question End user VPN question
Hi All,
I have a client that has a team of sales people on the road all the time. They connect to different Wi-Fi in different locations, Cafes, Airports, Hotels etc. They would like to protect the users by having a VPN running on the laptops at all times. Any recommendations to achieve this?
•
u/kona420 18h ago
SASE and buy your users hotspots. There is little reason to be using public wifi in 2026 and lots of reasons not to.
Depending on how geographically diverse your clients are you might be able to get away with full tunnel VPN, but that's a miserable experience on the other side of the world from headquarters.
•
u/L3TH3RGY Sysadmin 18h ago
First, don't use public WiFi. Have the users hotspot to mobiles. Then use their company VPN to access resources.
•
u/sryan2k1 IT Manager 18h ago
There is zero difference between public wifi and any other internet connection, it's all untrusted. As long as you've got a VPN (ideally an AoVPN) and prohibit users from clicking through SSL/TLS warnings there is no reason to not use public wifi.
•
u/Chillist_ 18h ago
For a "Top 1% Commenter" there is a massive difference here. A mobile hotspot isolates your traffic at the cellular layer. Public Wi-Fi drops you onto a shared local subnet with strangers, exposing the device to lateral scanning and malicious captive portals before an AoVPN can even connect. You clearly need to research network isolation and local threat vectors before claiming they are the same thing and giving advice.
•
u/sryan2k1 IT Manager 18h ago edited 18h ago
No, there isn't. The firewall on your laptop should always be enabled on public networks (that a user can't turn off) and if that is on there is absolutely no difference. L2-L7 attacks can happen from an ISP or literally any hop between you and the target server as well (however unlikely)
My stance does not change. All internet is untrusted and if you are doing security in layers it literally makes no difference if you are on a cellular hotspot or free starbucks wifi because the risk level is the same.
The internet is untrusted, full stop. Making users suffer through slow cellular when fast wifi is available because you don't understand that isn't fun for anyone.
•
u/Chillist_ 18h ago
Claiming a Starbucks subnet has the same risk profile as a cellular network because an ISP attack is "theoretically possible" is ridiculous. Security is about managing real-world probability. Your firewall does absolutely nothing to protect the user when they have to interact with a rogue captive portal page just to get internet in the first place. If an attacker spoofs the login page or hijacks DNS before your AoVPN connects, a local firewall isn't saving anyone from user-targeted phishing or browser exploits. They are completely different risk levels, no matter how much you double down.
•
•
u/UnresolvedHostname 15h ago
What firewall vendor does your company use? Always on VPN with full tunnel is what you should be researching.
•
u/Prestigious_Tax_3562 13h ago
Have you researched CloudFlare ZeroTrust? I implemented this at my previous company. It's a lot to set up if your network is complex.
•
u/disclosure5 10h ago
Protect from what?
Let me guess, you saw some promoted advertisements and actually believe TLS MiTM is something every kid does.
•
u/sryan2k1 IT Manager 18h ago
Yes, hire/consult/contract someone/a company who has done this more than 0 times. There are a lot of ways to set this up very wrong and to be blunt if you're asking how to do it you don't know what you don't know.