One office PC becomes the gateway, and your home PC joins the office LAN through an encrypted tunnel — server, shares, printer and your own desktop, all reachable with no static IP and no open ports.
Most remote-access guides stop at one PC. This one goes further: your whole office network from home. The method is a mesh VPN with a subnet router — the pattern used by tools in this class (Tailscale and ZeroTier are two examples). One always-on office machine becomes the gateway, every staff member joins with a named account and MFA, and nothing in the office is ever exposed directly to the internet. Follow the order below: shape first, accounts second, gateway third, tests last.
Reaching one office PC from home is easy. Reaching the entire network — the server, the shared folders, your desktop, the printer — needs one extra piece: a gateway. One machine inside the office (an always-on PC, the server itself, or a supported router) joins the VPN and agrees to pass traffic to the rest of the office LAN. In mesh VPN language this is called a subnet router. Your home PC talks to the gateway over an encrypted tunnel, and the gateway introduces you to everything else, exactly as if your laptop were plugged into an office desk.
This is why no static IP and no port forwarding are needed. Both sides connect outward to the VPN service and the tunnel is built between them, so dynamic IPs, CGNAT and double routers do not block it.
The admin (the owner or the IT person) creates the VPN network and invites each staff member with their own named account — never one shared login for the whole office. Turn on two-factor authentication (MFA) on the admin account first, then on every member account the tool supports. This one decision controls everything later: who can enter, whose access you can remove in one minute, and whose name appears in the logs.
Install the VPN app on the always-on office machine, sign in with the admin account and enable it as a subnet router for the office LAN range, for example 192.168.1.0/24. The route then has to be approved in the admin console — a good tool never trusts a gateway silently. Pick a machine that does not sleep: set its power plan so it never goes to sleep during office hours, or every remote user will find the whole office missing whenever that PC naps.
Honest limit: the gateway is your single door. If it is switched off, restarted for updates or its internet dies, remote access dies with it. For a bigger office, a router or a small dedicated box as gateway is the grown-up version of the same idea.
On the home PC, install the same app and sign in with your own named account — not a colleague's, not the admin's. Complete the MFA prompt. The moment you are connected, your PC is logically inside the office network, so treat it that way: this is no longer just your family computer, it is an office endpoint for as long as the tunnel is up.
ping 192.168.1.10 — the office server answers through the tunnel\\192.168.1.10\Accounts, and open one small fileIf step 1 fails, nothing above it can work — check the gateway is awake and the route is approved. If ping works but a share fails, the tunnel is fine and the problem is Windows sharing permissions, a completely different fix.
A VPN tunnel moves the office boundary to your home PC, so these rules are not decoration:
The complete walkthrough — gateway setup, route approval and the live test — is demonstrated in the video.
▶️ Watch Full VideoYes. A mesh VPN builds the tunnel with outward connections from both sides, so it works behind CGNAT, on dynamic IPs and even behind two routers. No inbound port ever needs to open, which is also why this pattern is safer than port forwarding.
It is one machine inside the office — an always-on PC, the server, or a supported router — that joins the VPN and passes traffic between the tunnel and the rest of the office LAN. Without it, remote users can reach only the devices that have the VPN app installed. With it, they can reach the whole subnet, including printers and old devices that cannot run any app.
Yes — that is the correct way to use it. RDP itself is a normal office tool; the danger is only when its port is exposed directly to the internet. Inside the encrypted tunnel, protected by your named VPN account and MFA, RDP to your own office PC is the standard safe pattern.