Build a company VPN server on a Windows VPS
An always-on Windows machine, with the administrator access that lets you install the RRAS role and connect your own workstations.
Starting at €8/mo
Introduction
A company VPN server is a machine you place between your staff and your own resources: each person opens a tunnel to it, then works as if sitting on the internal network. At By-Hoster that machine is a Windows VPS with full administrator access: the RRAS role and the Windows Server VPN components install on it normally. The Windows - Core plan at €8/month incl. VAT covers this use: 4 vCores, 8 GB of RAM, 50 GB of SSD, 500 Mbps.
Two conditions make it workable, and both are included on all four configurations: a dedicated IPv4 address, so a fixed entry point your workstations can reach, and a machine that stays powered on in a datacenter rather than a tower somebody switches off on Friday evening. The server is delivered in 10 minutes with its Administrator credentials, and a fallback VNC console catches you if a firewall rule shuts the door in your face.
Let us state up front what we do not do. By-Hoster supplies the machine: the operating system, the network, the IP address and human 24/7 support on that infrastructure. We do not configure your VPN and we provide no assistance on it — not the choice of solution, not the certificates, not the routing, not your filtering rules. The Microsoft licence remains yours to buy. The server runs in our single DC-FR_NA(01) datacenter in Nouvelle-Aquitaine.
What the machine allows, and what we do not do
Full administrator access
You get the machine's Administrator account, not a locked-down panel. The RRAS role, the Windows Server VPN components and whatever firewall rules you judge useful install and change without going through us. That is the basic condition for building a tunnel: without it, the question does not even arise.
Dedicated IPv4 and an always-on machine
A VPN needs a stable entry point. Every Windows VPS has its own dedicated IPv4 address and runs continuously in the datacenter. Your workstations therefore have a fixed destination to reach, without depending on the office router or on a PC left running in a cupboard.
Core is enough, unless the machine does more
Windows - Core at €8/month: 4 vCores, 8 GB of RAM, 50 GB of SSD, 500 Mbps. Our published rule of thumb is 4 GB for light use and 8 GB as soon as business software or several concurrent users are added. If the same machine also hosts your applications, aim at Plus (16 GB, €13/month).
No configuration, no VPN support, no licence
We deliver a bare system. The VPN solution, its certificates, its routing and its filtering rules are your work, or your provider's. Our 24/7 support covers the machine: operating system, network, access, snapshots, reinstallation. The Microsoft licence and your business software licences stay on your side.
When this server makes sense
Connecting your colleagues' workstations
A laptop on the road, a machine at home, a second site: each one opens the tunnel to your server and regains access to your own resources. You decide what sits behind it; we neither see nor configure that perimeter.
Linking the office network to the remote server
If you run a secondary domain controller or an internal service on the machine, the office and the server have to talk to each other. The tunnel is that link, and you are the one who establishes it, with your own addressing and routes.
No longer leaving RDP open to the whole Internet
Many companies would rather have port 3389 answer only the addresses on the tunnel than the entire world. That is doable with administrator access and the Windows firewall. Keep the fallback VNC console in mind before you close the door behind you.
Reaching a file share without publishing it
An SMB share does not belong on the open Internet: port 445 exposed publicly is universally discouraged. Carrying it inside a tunnel you set up yourself is one of the two reasonable approaches, the other being to work straight inside the RDP session.
A fixed address for your allow lists
Some internal services only accept connections from a known address. By routing those accesses through the server, you present one dedicated, stable IPv4 instead of the ever-changing addresses of each travelling colleague.
Opening temporary access to a provider
Your integrator needs a week on your application? You grant access to the tunnel, then you revoke it. Creating, revoking and tracking those accesses is part of your administration, not ours.
Frequently asked questions
Yes. Every Windows VPS ships with full administrator access: the RRAS role and the Windows Server VPN components install exactly as they would on a physical server, and you stay in charge of your firewall rules. The machine has a dedicated IPv4 address and runs permanently, the two conditions for a reliable entry point. One immediate clarification: we do not configure the VPN and we give no assistance on it. We supply the machine; the tunnel is yours.
Four configurations, monthly prices incl. VAT: Core at €8 (4 vCores, 8 GB, 50 GB SSD), Plus at €13 (8 vCores, 16 GB, 200 GB), Max at €26 (16 vCores, 32 GB, 500 GB) and Titan at €49.99 (24 vCores, 64 GB, 800 GB, 1000 Mbps). Annual billing takes 10% off. For a gateway that only routes traffic, Core is enough. That price covers the machine and infrastructure support; it does not include the Microsoft licence.
No. That is the point to take in before ordering. We deliver a bare system with its Administrator credentials, and both installation and configuration are down to you or your provider: choice of solution, certificates, accounts, addressing, routes, filtering rules. Our human 24/7 support — ticket, Discord, phone — answers on the machine: operating system, network, access, snapshots, reinstallation. It does not troubleshoot a VPN configuration.
Our published rule of thumb is 4 GB of RAM for light use and 8 GB as soon as business software or several concurrent users are added. A machine that only carries the network link stays in the first case: Windows - Core at €8/month, with its 8 GB, already leaves headroom. If the same server also hosts your application or a database, move up to Plus (16 GB, €13/month).
Fair question, honest answer: if your colleagues simply need to open one piece of software remotely, an RDP session is enough and takes ten minutes to set up, with nothing to build. A VPN becomes useful when networks have to be joined, when several internal services must be reached, or when you would rather not expose RDP directly. If your need is one remote desktop, look at the RDP server page instead: simpler and cheaper to maintain.
No. By-Hoster installs the operating system at order time but neither supplies nor resells a Microsoft licence: it stays on your side. Another limit worth knowing: Windows Server allows 2 concurrent administrative RDP sessions; beyond that, for application access, Microsoft requires RDS CAL licences that you buy yourself. That does not concern connections travelling through your tunnel, but the Remote Desktop sessions opened on the machine.
Three systems are offered at checkout, at no extra cost: Windows Server 2025 (mainstream support until 13 November 2029, security until 14 November 2034), Windows Server 2022 (mainstream until 13 October 2026, security until 14 October 2031) and Windows 11. For a network role such as RRAS, take Windows Server: Windows 11 is a client operating system, not designed to host a multi-user service. Windows Server 2019 can no longer be installed.
That is the classic accident when closing accesses down. Two safety nets exist, included on every plan: the fallback VNC console in the client area, which takes back control of the machine even when RDP stops answering, and the snapshot, to trigger before touching network rules so you can roll back. As a last resort, a reinstall runs on your own from the client area. To be clear: only snapshots are documented, there is no automatic off-site backup.
The machine runs in our single DC-FR_NA(01) datacenter in Nouvelle-Aquitaine, France, operated directly by the association's technical team. Virtualisation runs on KVM with Proxmox. Your data stays under French jurisdiction, within the GDPR framework, with no transfer outside the European Union. By-Hoster is a French non-profit association (RNA W162005815, SIRET 92395660100010) founded in 2023. We claim no sector certification, and we would rather say so.
For companies and associations that want to connect their own workstations to their own resources: a business application, a file share, a directory, a remote server. It is not a turnkey service: it is a machine on which you build your own, with the administrator access that makes it possible. If you are looking for an installation and operations service, you need an integrator on top of the hosting — that is not a role we fill.