Setting Up a Business Network for Remote Employees: The 2026 Practical Guide

Over 50% of employees in Germany work at least partially remote. But how do you securely connect home office employees to the company network – without open ports, without a VPN gateway bottleneck, and without weeks of setup? This guide shows what a modern business network for distributed teams looks like and how to set it up with NetBird in minutes.

Also worth reading: OpenVPN Alternative 2026 – Why Businesses Are Switching to NetBird · NetBird vs. Tailscale 2026

Table of Contents

• The Problem: Remote Access for SMBs in 2026
• Traditional Approach vs. Modern Approach
• Case Study: Agency with 30 Employees
  • The Starting Point
  • The Solution with NetBird
  • The Architecture
• Step by Step: Setting Up a Business Network with NetBird
  • Step 1: Set Up Managed Instance
  • Step 2: Install Routing Peer in the Office
  • Step 3: Add Office Network as Network Resource
  • Step 4: Define Access Rules
  • Step 5: Onboard Employees
• Common Scenarios and How NetBird Solves Them
  • Scenario 1: Home Office Access to File Server and ERP
  • Scenario 2: External Contractor Needs Temporary Access
  • Scenario 3: Connecting Multiple Offices
  • Scenario 4: Connecting Cloud Servers and On-Premises
  • Scenario 5: Remote Desktop (RDP) Over the Internet
• Why Not Just a Router VPN or OpenVPN?
• Security: Zero Trust Instead of Network Trust
  • What Zero Trust Means for Remote Access
  • How NetBird Implements Zero Trust
• GDPR and Compliance for Remote Access
• Cost: What a Secure Business Network Should Cost
• Checklist: Business Network for Remote Employees
• Conclusion
• Sources

The Problem: Remote Access for SMBs in 2026

The requirement sounds simple: employees should securely access the company server from home – the file server, ERP software, CRM, database, printer. In practice, many businesses fail at this. Not because the technology doesn't exist, but because common solutions create the very problems they're supposed to solve:

• Router VPN works for 2–3 users, but not for 20 – and certainly not with SSO, MFA, or granular access control
• OpenVPN requires certificate management, PKI expertise, and a dedicated server – and becomes a permanent project for the IT department
• Hardware VPN appliances (Sophos, Fortinet, Lancom) are expensive, create vendor lock-in, and require specialized knowledge
• Consumer VPNs (NordVPN, Surfshark) are built for streaming and privacy, not for business networks – they connect users to the internet, not to the company network

The result: either remote access is implemented insecurely (TeamViewer, open RDP ports, Dropbox instead of file server) or not at all – and productivity suffers.

Traditional Approach vs. Modern Approach

Case Study: Agency with 30 Employees

The Starting Point

A digital agency with 30 employees, office in a mid-sized German city. The infrastructure:

• Office: File server (SMB/CIFS), NAS with project data, a local database server, network printer
• Cloud: 2 Hetzner servers (staging, production), an AWS-hosted CRM
• Team: 15 in the office, 10 in home office, 5 remote/on the road
• Problem: Previously router VPN for 3 people – now all remote employees need secure access

The Solution with NetBird

Instead of setting up an OpenVPN server, creating certificates, and maintaining firewall rules, the agency deploys a birdhost instance via the merkaio self-service portal. In minutes, their own dedicated NetBird instance is ready – hosted in Germany, fully managed.

The Architecture

                        birdhost Management
                        (hosted in DE)
                              │
                    ┌─────────┼─────────┐
                    │         │         │
            ┌───────┴──┐ ┌───┴───┐ ┌───┴──────┐
            │ Office PC│ │Laptop │ │Smartphone│
            │(Routing  │ │(Home  │ │(on the   │
            │ Peer)    │ │office)│ │road)     │
            └───┬──────┘ └───────┘ └──────────┘
                │
        ┌───────┼────────┐
        │       │        │
   File server NAS   Printer
   (no NetBird needed)

The key point: file server, NAS, and printer need no NetBird installed. A single machine in the office acts as a routing peer – it routes traffic from the NetBird mesh into the local office network. All other devices on the office LAN are immediately reachable.

Step by Step: Setting Up a Business Network with NetBird

Step 1: Set Up Managed Instance

1. Go to portal.merkaio.com
2. Create account (email or SSO)
3. "New Instance" → select birdhost
4. Choose plan (Startup from €99.90/month)
5. Region Germany → Deploy

Your dedicated NetBird instance is ready in minutes. You get access to your own NetBird dashboard with its own URL.

7 days free trial.

Step 2: Install Routing Peer in the Office

In the office, you need a machine that runs continuously and acts as a gateway to the local network. This can be an existing server, a mini PC, a NAS with Docker, or even a Raspberry Pi.

Install NetBird client (one command on Linux):

curl -fsSL https://pkgs.netbird.io/install.sh | sh
netbird up

On Windows or macOS, simply download and install the client from the NetBird website. After signing in, the device appears in the dashboard.

Step 3: Add Office Network as Network Resource

In the NetBird dashboard under Networks:

1. Click "Add Network"
2. Give it a name (e.g., "Office HQ")
3. Enter subnet – e.g., 192.168.1.0/24 (the local office LAN)
4. Assign the routing peer as gateway

From now on, all NetBird peers with access can reach devices on the office LAN – file server, printer, NAS, all via local IP addresses.

For even more granular access, you can expose individual IPs instead of the entire subnet – e.g., only the file server (192.168.1.50/32).

Step 4: Define Access Rules

In the dashboard under Access Control, define who can access what:

• Group "All Employees" → Access to file server and printer
• Group "Development" → Additionally access to staging server and database
• Group "Management" → Access to everything
• Group "External" → Only access to the staging system, time-limited

All graphical in the web UI – no JSON policies, no firewall rules, no iptables.

Step 5: Onboard Employees

For new employees, there are two paths:

With SSO (recommended): The employee installs the NetBird client, clicks "Login", is redirected to your identity provider (Google Workspace, Azure AD, Okta, Keycloak), signs in – done. Group membership is automatically controlled via the IdP.

With Setup Key: For devices without a browser (e.g., servers, IoT devices), generate a setup key in the dashboard. The device is automatically assigned to the correct group.

No certificate. No config file. No call to IT.

Common Scenarios and How NetBird Solves Them

Scenario 1: Home Office Access to File Server and ERP

The problem: Home office employees need access to the company file server (SMB shares) and ERP software that's only reachable on the local network.

The solution: The routing peer in the office makes the entire local network reachable via NetBird. Employees map network drives as usual – just via the NetBird connection instead of the local LAN. Performance thanks to WireGuard: nearly identical to being in the office.

Laptop (Home Office) ──► NetBird Tunnel ──► Routing Peer ──► File Server
                                             (Office)       (192.168.1.50)

Scenario 2: External Contractor Needs Temporary Access

The problem: An IT contractor needs server access, but only temporarily and only to specific systems.

The solution: Generate a setup key with an expiration date that automatically assigns the contractor to the "External" group. This group only has access to the defined resources. After expiration, access is automatically revoked.

Scenario 3: Connecting Multiple Offices

The problem: Main office in Cologne, branch office in Munich. Both should feel like one network.

The solution: A routing peer at each location. NetBird connects the locations via a site-to-site connection – without IPsec tunnels, without VPN hardware, without a static IP at the location.

Cologne Office ──► Routing Peer ──► NetBird ──► Routing Peer ──► Munich Office
(192.168.1.0/24)                                              (192.168.2.0/24)

Employees in Munich access the file server in Cologne as if it were local.

Scenario 4: Connecting Cloud Servers and On-Premises

The problem: The production environment runs on Hetzner, the database is in the office. Both need to communicate.

The solution: Install NetBird client on the Hetzner server. Define access rules so that only the production server can access the database server – and only on port 5432 (PostgreSQL).

Scenario 5: Remote Desktop (RDP) Over the Internet

The problem: Employees want to use RDP from home to access their office PC. Exposing RDP directly to the internet is a security risk.

The solution: Via NetBird, the office PC is reachable by internal IP. RDP connects to 192.168.1.25:3389 – through the encrypted NetBird tunnel. No open port on the internet, no attack surface.

Why Not Just a Router VPN or OpenVPN?

Both are valid solutions – for certain scenarios. But they quickly hit their limits:

Router VPN (WireGuard/IPsec):

• Maximum ~10 simultaneous connections (depending on model)
• Every user must be manually configured
• No granular access control – whoever is connected has access to everything
• No SSO, no MFA (except possibly via TOTP on the router account)
• Performance limited by router hardware
• No central management with multiple locations

OpenVPN:

• Full flexibility, but high operational overhead
• PKI and certificate management as an ongoing burden
• Central gateway as bottleneck and single point of failure
• No native zero trust – access control via firewall rules
• Every expired certificate = support call

NetBird (via birdhost):

• Unlimited users and devices at a flat rate
• SSO, MFA, SCIM provisioning out of the box
• Graphical access control by groups and resources
• No central gateway – peer-to-peer mesh
• Managed service: updates, monitoring, support included

The router VPN is perfect for the CEO who briefly needs server access in the evening. For 10+ remote employees with different access rights, it's not the right solution.

Security: Zero Trust Instead of Network Trust

What Zero Trust Means for Remote Access

The classic VPN model is based on a simple principle: whoever successfully connects is "inside" and treated as trusted. It's like automatically letting anyone with a house key into every room – including the vault.

Zero trust reverses this principle: Nobody is automatically trusted. Every access is individually verified – based on identity (who?), device (with what?), resource (to what?), and context (when, from where?).

How NetBird Implements Zero Trust

Identity-based access control: Access rules are not defined by IP addresses but by user groups and specific resources. The developer can reach the staging server but not the accounting data. Accounting can access the ERP but not the code.

Posture checks: NetBird verifies the security status of the endpoint before establishing a connection. Is the firewall active? Is the operating system up to date? Is an endpoint security agent running? Non-compliant devices are automatically blocked.

SSO and MFA: Authentication via the company's identity provider. No separate VPN password, no VPN certificates. Multi-factor authentication is centrally controlled via the IdP.

Automatic offboarding: When an employee is deactivated in the identity provider (e.g., in Azure AD or Google Workspace), they immediately lose network access. No manual certificate revocation, no forgotten accounts.

Encryption without configuration: Every connection is encrypted by default with WireGuard – end-to-end, without anyone having to configure cipher suites. Optional: post-quantum cryptography via Rosenpass.

GDPR and Compliance for Remote Access

Remote access to company data brings GDPR responsibility. Relevant questions:

Where is connection data processed? With GDPR-compliant NetBird hosting from birdhost: in German ISO 27001 certified data centers. No metadata with US providers. No CLOUD Act.

Is there a DPA? Yes – available directly in the merkaio portal. No negotiations with US legal departments.

Are connections encrypted? Yes – WireGuard encryption end-to-end. Even birdhost as managed hoster cannot decrypt the traffic.

What happens in case of a security incident? birdhost operates 24/7 monitoring and responds to incidents – including zero-day patches and immediate measures.

Technical and organizational measures (TOMs)? Through the combination of encryption, access control, SSO/MFA, audit events, and German hosting, the essential technical measures under Art. 32 GDPR are covered.

Cost: What a Secure Business Network Should Cost

An honest cost calculation for a company with 30 employees:

With birdhost, server infrastructure, monitoring, updates, patches, and support are included in the monthly price. There are no per-user fees – whether 5 or 25 users, the price stays the same.

Checklist: Business Network for Remote Employees

Before you start, check these points:

Infrastructure:

• ☐ Which resources should be remotely accessible? (file server, ERP, printer, database)
• ☐ Is there a permanently running machine in the office that can act as a routing peer?
• ☐ What subnet does the office LAN use? (e.g., 192.168.1.0/24)
• ☐ Are there cloud servers that also need to be connected?

Access concept:

• ☐ What employee groups exist? (e.g., development, sales, management)
• ☐ Who needs access to which resources?
• ☐ Should external contractors get temporary access?
• ☐ Is there an identity provider (Azure AD, Google Workspace, Okta)?

Security:

• ☐ Is MFA activated for all users?
• ☐ Are employee devices adequately secured? (firewall, antivirus)
• ☐ Is there an offboarding procedure for departing employees?

Compliance:

• ☐ Where must connection data be hosted? (Germany/EU)
• ☐ Is a DPA (Data Processing Agreement) required?
• ☐ Must access be logged? (audit events)

Conclusion

A secure business network for remote employees doesn't have to be a major IT project in 2026. The era of VPN gateways, certificate chaos, and router workarounds is over.

With NetBird and managed hosting from birdhost, you set up a modern mesh VPN that connects your employees to the company network in minutes – secure, fast, and without IT specialist knowledge. Identity-based access control, WireGuard encryption, and automatic on-/offboarding via SSO make operations not just secure but also practical for everyday use.

Try it now: Start your own NetBird instance via the merkaio self-service portal – 7 days free, own dedicated instance, hosted in Germany, ready in minutes.

Recommended reading: OpenVPN Alternative 2026 · NetBird vs. Tailscale 2026 · Twingate Alternative 2026

Sources

• NetBird Documentation – Remote Worker Access
• NetBird Documentation – Site-to-Site Connectivity
• NetBird Documentation – Access Control
• NetBird Documentation – Posture Checks
• NetBird Documentation – Networks
• NetBird GitHub Repository
• NetBird Use Cases: Business VPN
• NetBird Use Cases: Remote Access
• WireGuard Protocol Specification
• Bitkom Study: Home Office in Germany
• BSI – Recommendations for Secure Remote Work
• GDPR Art. 32 – Security of Processing
• birdhost.de – Managed NetBird Hosting