VPN & Remote Access

Site-to-site and remote-access VPN on the firewall

IPsec, WireGuard, and OpenVPN tunnels connect branch offices and remote users to exactly the resources they need - centrally managed from one dashboard.

🔒 IPsec · WireGuard · OpenVPN

Three Protocols, One Appliance

Pick the protocol that fits the client, the peer, or the compliance requirement - all three run on the same appliance without separate licensing.

WireGuard
Modern, lightweight tunnels for site-to-site and remote-access connections. Server-generated client keypairs with .conf and QR-code export make onboarding a laptop or phone a two-minute job.
IPsec
Standards-based site-to-site and remote-access tunnels via strongSwan, with IKEv1/IKEv2, AES and ChaCha20 encryption, and pre-shared key, RSA, or ECDSA authentication - the protocol most other vendors interoperate with.
OpenVPN
SSL/TLS-based remote-access and site-to-site VPN with certificate, username/password, or combined authentication, tls-crypt hardening, and inline .ovpn client bundles that carry the CA, certificate, and key in one file.
Two Connection Modes

Connect Offices. Connect People.

A site-to-site tunnel links two networks together permanently - a branch office to headquarters, or one data center to another. A remote-access tunnel is established on demand by a single user's laptop or phone dialing in from wherever they are. Firecradle handles both from the same VPN configuration screens, on whichever protocol fits the peer.

How a Tunnel Comes Up
Peer Initiates the Connection
A branch gateway or a remote user's client dials in
Authentication Checked
PSK, certificate, or EAP - plus MFA for remote users
Firewall Auto-Permits the Listen Port
No separate firewall rule to remember
Traffic Routes by Policy
Allowed subnets and split-tunnel rules apply
Dead Peer Detection Watches the Link
A dropped WAN reconnects the tunnel automatically
Sample Tunnel Status
Name
branch-hq-01
Protocol
IPsec (IKEv2)
Mode
site-to-site
Remote Gateway
203.0.113.9
State
ESTABLISHED
Last Handshake
12s ago
✓ Tunnel up - both local and remote subnets reachable

Onboard a Client with a QR Code

Every protocol ships a client-ready artifact, not a page of manual settings to transcribe by hand.

.conf + QR Export
WireGuard peers get a ready-to-scan QR code or downloadable .conf file - no manual key entry on the client.
Inline .ovpn Bundles
OpenVPN clients receive a single file with the CA, certificate, key, and tls-crypt secret already embedded.
MFA for Remote Users
Require a second factor alongside certificate or password authentication before a remote-access session is established.
Centralized Management
Create tunnels, add peers, and monitor handshake status for every protocol from the same cloud dashboard.

Real-World Use Cases

Remote Workforce Access

Challenge: A team of remote employees needs secure access to internal file shares and line-of-business apps without exposing them to the open internet.

How it's handled:
✅WireGuard remote-access peers provisioned via QR code
✅MFA required before OpenVPN or IPsec road-warrior sessions connect
✅Firewall automatically permits only the VPN listen port on the WAN
✅Internal resources stay unreachable outside the tunnel

Branch Office Interconnect

Challenge: Two branch offices need an always-on, encrypted link between their local networks without paying for a dedicated circuit.

How it's handled:
✅IPsec site-to-site tunnel negotiated with IKEv2 and a pre-shared key
✅Local and remote subnets defined once - no manual route entry
✅Dead peer detection reconnects automatically after a WAN blip
✅Traffic between sites never traverses the open internet unencrypted

Key Advantages

✅Three protocols on one appliance: IPsec, WireGuard, and OpenVPN, no separate licensing
✅Site-to-site and remote-access covered from the same configuration screens
✅Client-ready exports: WireGuard .conf/QR and inline OpenVPN .ovpn bundles
✅MFA available for remote-access users on top of certificate or password auth
✅Firewall integration: tunnel listen ports are auto-permitted, never a manual step

Connect Every Site and Every Remote User

IPsec, WireGuard, and OpenVPN for site-to-site and remote-access connectivity. Firecradle is in development.

In development · early access · Onboarded hands-on by our team