cMorrow
Hello,
I'm not currently using OpenVPN in any way, so if that's necessary to post here, then feel free to close/ignore this.
Now some background: I'm an intern and more or less "the IT person" at my company. Unfortunately my specialty is programming, not networking (I know the basics, enough to have solved a few network problems here, but that's it).
Most of the employees use Macs, connecting to a local NAS. The NAS is a rather simple consumer-grade model — for example, it has no SSH capability unless I were to give it different firmware, and I'd rather not take that risk. Recently, they've wanted to be able to use the workplace NAS from home. On our router, I enabled forwarding on port 548 to the NAS so that they can use AFP remotely. (I know that AFP is being phased out in favor of SMB2, but they like being able to use the color labels feature, and also there's a different set of visible files depending on the protocol used, for reasons I don't entirely understand.)
It works for them, but I understand it's totally insecure — AFP sends everything in plaintext except the credentials. A VPN of some kind seems like the best solution to that. (A simpler solution might be a basic cloud program like Dropbox, but they're interested in everything remote being "the same" as it is at work.)
What should I do to ensure that all the AFP traffic into and out of our network passes through a VPN? Ideally, non-AFP traffic would be untouched, so that the speed of using the Internet at work is still the same. However, accessing the NAS is the only thing that actually requires access from outside (we don't host our own website, etc).
I've done a lot of research but I feel like I'm going in circles — every webpage with relevant advice either assumes that one's workplace has a VPN already, or that one's server is a relatively advanced Mac or Windows server that you can make serious changes with, as opposed to a dinky thing accessible only over the browser. (If I'm not mistaken, a computer running either Mac or Windows Server can act as its own VPN server.) So I apologize for basically asking "How do I do everything?"
Thanks in advance!
