
![VPN for small and mid-sized businesses](/images/blog/wireguard-vs-l2tp-ipsec-koji-vpn-protokol-izabrati-za-mala-i-srednja-preduze-a-1510511459019.jpg)

## Introduction

Working from home, in the field or from another office means staff need a secure way to reach servers and shared files. That is what a VPN is for. In small and mid-sized businesses the choice usually comes down to two protocols: WireGuard and L2TP/IPsec. Below we compare performance, setup complexity, NAT traversal, clients and authentication, then give concrete scenarios for each choice.

## WireGuard – Modern Minimalism

WireGuard is a newer VPN protocol designed for:

- **High performance:** Higher speeds and lower latency.
- **Simplicity:** Minimalist configuration, less room for errors.
- **Security:** Uses modern cryptography (ChaCha20, Poly1305).
- **No conventional sessions:** Does not use traditional sessions, but enables fast reconnection (roaming) and stability even during frequent disconnections.

## L2TP/IPsec – The Proven Classic

L2TP/IPsec is a traditional VPN solution that offers:

- **Wide compatibility:** Works on all operating systems without additional software.
- **Integration with user bases:** Supports user authentication via password (PPP, RADIUS).
- **Stable operation:** Reliable for site-to-site network configurations.
- **Classic sessions:** Establishes conventional sessions that may be more sensitive to connection drops and require reconnection.

## Direct Comparison

| Feature                | WireGuard                          | L2TP/IPsec                              |
| ---------------------- | ---------------------------------- | --------------------------------------- |
| Performance            | ✅ Higher speeds, lower latency    | ⚠️ Solid, but slower than WG            |
| Setup complexity       | ✅ Simple                          | ⚠️ More complex, higher chance of error |
| Client support         | ⚠️ Application required            | ✅ Built into OS                        |
| Connection stability   | ✅ Excellent roaming and reconnect | ⚠️ More sensitive to drops              |
| MikroTik support       | ✅ RouterOS 7+                     | ✅ All RouterOS versions                |

## IPsec vs WireGuard: The Wider Picture

When people say L2TP/IPsec, IPsec is the part actually doing the encryption. L2TP is only a tunnel and protects nothing on its own. So the question "WireGuard or L2TP" is, in practice, almost always a comparison between WireGuard and IPsec.

IPsec is not a single protocol either, but a family of standards: **ESP** and **AH** protect the packets themselves, and **IKE** (IKEv1 or IKEv2) handles key exchange and connection setup. L2TP/IPsec is just one way to deploy IPsec. You will also come across:

- **IKEv2/IPsec** – the modern variant, built into Windows, macOS, iOS and Android, and well behaved when the network changes (MOBIKE).
- **IPsec in tunnel mode** – for site-to-site links between two locations, with no client software at all.
- **IPsec in transport mode** – less common, protecting traffic between two individual hosts.

Comparing WireGuard against IPsec in general, rather than against the L2TP/IPsec combination specifically, looks like this:

| Feature                 | WireGuard                                    | IPsec (IKEv2 + ESP)                                       |
| ----------------------- | -------------------------------------------- | --------------------------------------------------------- |
| Code size               | ✅ A few thousand lines, feasible to audit   | ⚠️ Far larger surface in a typical implementation         |
| Cryptography            | ✅ Fixed modern suite, no bad choice to make | ⚠️ Negotiated, legacy ciphers still selectable            |
| Parameter negotiation   | ✅ None, both ends share the same suite      | ⚠️ IKE negotiates, mismatches are a common failure        |
| NAT traversal           | ✅ Plain UDP with PersistentKeepalive        | ⚠️ Needs NAT-T, ESP often blocked on networks you do not own |
| OS-native client        | ⚠️ Application required                      | ✅ IKEv2 built into Windows, macOS, iOS and Android       |
| User authentication     | ⚠️ Per-peer keys, no user directory          | ✅ Certificates, EAP, RADIUS, Active Directory            |

The practical conclusion: if you need a VPN with no client to install and a link to Active Directory or RADIUS, IPsec, and IKEv2 in particular, still has a clear edge. If you want a configuration that fits on one screen and behaves predictably, WireGuard is the better choice.

One thing worth stating plainly: the fact that something is IPsec does not make it more secure. A badly configured IPsec tunnel with weak ciphers and a guessable pre-shared key is weaker than WireGuard out of the box, because WireGuard gives you no choice you can get wrong.

## Practical Use-Case Scenarios

### When to Choose WireGuard?

- If the project is "greenfield" and you have complete freedom in technology choice.
- You have simple needs and want easy maintenance.
- You use newer MikroTik routers with RouterOS 7+.

### When to Choose L2TP/IPsec?

- You work with older infrastructure or devices that don't support WireGuard.
- It's important that users don't install additional software.
- You need centralized user authentication (Active Directory, RADIUS).

## Conclusion

For most small and mid-sized businesses WireGuard is the better choice: the configuration fits on one screen, it is faster, and it does not drop the connection when a laptop moves from Wi-Fi to mobile data. L2TP/IPsec, or better IKEv2/IPsec, remains the right choice when users must not install extra software or when login has to be tied to Active Directory or RADIUS.

If you would rather not choose and configure it yourself, VPN is part of our [IT maintenance](/usluge/it-odrzavanje) service: we set it up on MikroTik or Fortinet equipment, tie it to your existing accounts and monitor that it works.



![WireGuard configuration](/images/blog/wireguard-obja-njenje-svih-polja-u-konfiguraciji-interfejsa-i-peer-a-1558494949.jpg)

## Introduction

A WireGuard configuration is short, but every field has consequences: a wrong `AllowedIPs` sends traffic to the wrong place, and without `PersistentKeepalive` a client behind NAT loses the connection. The configuration file (`wg0.conf` or similar) has two parts: `[Interface]` describes this side, and `[Peer]` sections describe the other participants in the VPN. Here is the basic structure, followed by an explanation of every field:

## Complete Configuration Example

```ini
[Interface]
PrivateKey = BAsdfasJf38slfs93fsdf89sd8f==
Address = 10.0.0.1/24
ListenPort = 51820
DNS = 1.1.1.1

[Peer]
PublicKey = KJhsd9s8d9s8d8s7f9s8s9d8f9sd8f98sd9f8sd=
AllowedIPs = 10.0.0.2/32
Endpoint = vpn.example.com:51820
PersistentKeepalive = 25
```

## Explanation of [Interface] Section Fields

### PrivateKey

**Description:** The private key of the WireGuard interface (server or client).
**Important:** This is a secret key and must not be shared! It is generated using `wg genkey`.

### Address

**Description:** The IP address(es) used by the interface within the VPN network.
**Example:** "10.0.0.1/24" means the interface uses IP 10.0.0.1 and expects a /24 network.
**Note:** Multiple addresses can be entered, separated by commas.

### ListenPort

**Description:** The port on which WireGuard listens for incoming connections.
**Example:** "51820" is the default port, but it can be any open UDP port.
**Note:** Only required on the side that receives connections (e.g., the server).

### DNS

**Description:** The DNS server to be used when the VPN tunnel is active.
**Example:** "1.1.1.1" or "8.8.8.8"
**Note:** Effective when used with a WireGuard client that supports this option.

## Explanation of [Peer] Section Fields

### PublicKey

**Description:** The public key of the remote peer.
**Important:** It must match the private key of the other side. It is shared publicly.

### AllowedIPs

**Description:** Networks/IP addresses that are routed through this peer.
**Example:** "10.0.0.2/32" means that traffic destined for 10.0.0.2 will be sent to this peer.
**Special:** If you enter "0.0.0.0/0", you create a "full tunnel" – all traffic goes through the VPN.

### Endpoint

**Description:** The address and port of the remote peer.
**Example:** "vpn.example.com:51820"
**Note:** Used only on the client side or the side that initiates the connection.

### PersistentKeepalive

**Description:** How often the client sends a packet to keep the connection alive.
**Example:** "25" seconds is typical for devices behind NAT.
**Useful:** Prevents the tunnel from "dying" due to inactivity.

## Conclusion

- The configuration is stateless, there are no "sessions"; everything is based on keys and routing.
- On the server, you can have multiple [Peer] sections, one for each client.
- On the client, there is usually only one [Peer] (the server).

If you are choosing between WireGuard and IPsec, see the comparison [WireGuard vs L2TP/IPsec](/blog/wireguard-vs-l2tp-which-vpn-protocol-to-choose). If you need a VPN that someone sets up and maintains, that is part of our [IT maintenance](/usluge/it-odrzavanje) service.



![Email solutions for small businesses](/images/blog/office-365-vs-google-workspace-vs-cpanel-email-koje-re-enje-je-najbolje-1601370552761.jpg)

Almost every company that contacts us has one of three setups: email on cPanel hosting next to the website, Google Workspace, or Microsoft 365. This article does not compare feature lists. It looks at the differences you feel in daily work, and says when it makes sense to move from one to another.

A note on the name: Office 365 has been called Microsoft 365 since 2020. We use the new name in the text and kept the old one in the title because most people still search for it.

## The three options in short

**Microsoft 365** is a suite where email runs on Exchange Online, alongside Outlook, Word, Excel, PowerPoint, Teams, OneDrive and SharePoint. The applications work on the desktop and in the browser.

**Google Workspace** is Gmail on your own domain, with Drive, Docs, Sheets, Slides, Calendar and Meet. Everything runs in the browser, and real-time collaboration on the same document is the main strength.

**cPanel email** comes with most shared hosting packages that host the website. You get addresses on your domain, webmail (usually Roundcube) and IMAP/SMTP for Outlook or Thunderbird. There is no calendar, no documents and no video calls.

## What differs in practice

### 1. Whether the email arrives

With cPanel email you share the server IP address with other hosting customers. If one of them sends spam, your domain ends up on a blocklist too, and you find out when a client says they received nothing. You set up SPF, DKIM and DMARC yourself, and mailbox size limits are often small.

Microsoft 365 and Google Workspace send from infrastructure whose reputation is protected, the spam and phishing filters are serious, and DKIM is enabled with a single DNS record.

### 2. Security

With cPanel email the password is the only lock. Two-factor authentication usually does not exist, and webmail is often on old versions. When an employee leaves, someone with hosting access has to remember to close the account.

Both platforms have 2FA, sign-in logs, remote session termination and an admin console where an account is closed in one click and the mailbox handed to a colleague.

### 3. Collaboration

Microsoft 365 has Teams and shared calendars and mailboxes through Exchange, and documents are edited in the desktop applications everyone knows. Google Workspace is better when several people work on the same document at the same time in the browser. cPanel email offers none of this.

### 4. Price

Prices change and depend on the plan, so we do not list them here. Roughly: the basic plans of both platforms cost a few euros per user per month, and cPanel email is usually included in the hosting price. The difference per user is small. The difference is in what you get for the money, and what one lost email or one still-active account of a former employee costs you.

### 5. Who looks after it

Both platforms have an admin console and a clear procedure for new and departing staff, licences and devices. With cPanel email that is usually the person who built the website, who is often no longer around.

## Which solution is right for you

**cPanel email** makes sense for one to three people who use only email and do not exchange sensitive data. If you stay on it, set up SPF, DKIM and DMARC, use long passwords and back up the mailbox.

**Google Workspace** is the right choice if the team works mostly in the browser, shares documents and uses mixed devices: Mac, Windows, Chromebook, Android.

**Microsoft 365** is the right choice if you use Windows and desktop Office, need Exchange with shared calendars and mailboxes, Teams for meetings, or a link to Active Directory or Entra ID.

If you have five or more people on cPanel email, it is time to move. The three most common reasons companies contact us: lost or undelivered email, a domain on a blocklist, and a former employee who still has access.

## What the move looks like

We migrate email history, contacts and calendars from the existing system, whether that is cPanel, on-premises Exchange or another host. Before the migration we test on a small number of accounts, and we do the switch outside business hours so the interruption is as short as possible. After that we set up 2FA, security policies and accounts, and you can run the administration yourself or leave it to us.

Details are on the [Microsoft 365 and Google Workspace](/usluge/microsoft-365) page. If you are not sure which platform suits you, get in touch for a [free consultation](/kontakt): we look at what you have and propose a plan based on the number of users and how you work.



![Managed IT services for your business](/images/blog/kako-upravljane-it-usluge-mogu-va-em-biznisu-u-tedeti-vreme-i-novac-1632343084107.jpg)

Most small and mid-sized companies handle IT in one of two ways: they hire one administrator, or they call a technician when something stops working. Managed IT services are the third model. This article explains exactly what you get, where the real savings are, and when this model is not the right choice.

## What managed IT services are

Managed IT services mean that an external provider, an MSP (Managed Service Provider), takes over the day-to-day running of your IT for a fixed monthly fee. You do not pay for every visit and every hour separately. You pay for the system to work.

That difference in billing also changes how the provider behaves. A technician who bills per call earns money when something breaks. An MSP earns money when nothing breaks, so it pays for them to invest in monitoring, updates and backup before a problem appears.

## What a contract usually covers

- Helpdesk for your staff: phone or email, during business hours.
- Monitoring of servers, network and workstations, 24/7. Alerts go to the provider, not to you.
- Planned updates and patches, instead of random installs.
- Backup on the 3-2-1 principle, with periodic checks that recovery actually works.
- Security: antivirus and EDR, firewall, VPN, 2FA, DNS filtering.
- Account and licence management for Microsoft 365 or Google Workspace.
- System documentation and a periodic report with recommendations.
- When needed, vCTO consulting: procurement, budget and project planning.

What is usually billed separately: hardware and licence procurement, larger one-off projects (an office move, a migration to a new platform) and after-hours support, which is arranged according to what the company actually needs.

## Where the savings are

**1. The cost becomes predictable.** The fixed monthly fee is set by the number of users and devices. It does not rise when a problem appears. The IT budget is planned in advance, not after a failure.

**2. Downtime is shorter or does not happen.** Monitoring notices a disk at 95 percent or a backup that failed before your staff do. Most problems are solved through remote access, without waiting for a technician to arrive.

**3. You do not pay for training, licences and tools.** The MSP already has the tools for monitoring, backup and protection, and the people who know them. With an in-house administrator you buy and learn all of that from scratch.

**4. Knowledge does not leave with a person.** The system is documented and the whole team knows it. Annual leave, sick leave or one person leaving does not leave the company without IT.

## In-house administrator, on-call technician or MSP

An in-house administrator is on site and knows the company. The downside: one person rarely covers servers, network, security and users equally well, nobody covers for them, and a salary with contributions and training is a fixed cost no matter how much work there is.

An on-call technician is the cheapest while everything works. The downside: they react only when something stops, there is no monitoring and no documentation, and the knowledge of your system is in the head of one person you may not reach when it is urgent.

An MSP gives you a whole team, monitoring and documentation for a fixed fee. The downside: part of the control over IT operations moves to the provider, so the contract must clearly define scope, priorities and who remains the owner of accounts, licences and backups. That should be you.

This is not necessarily an either-or choice. In companies that have their own IT person, an MSP most often works as a complement: it takes over servers, security and night-time alerts, while the in-house person stays on users and business processes.

## When an MSP is not the right choice

If you have two computers and no server, a monthly contract is probably more than you need, occasional help is enough. If you have your own IT team of several people covering every area, you may need an MSP only for specific services, for example backup or security.

## How it starts

The first step is an assessment: what you have in terms of equipment, licences, network, backup and accounts. Without it, neither the scope nor the risk can be estimated, and no honest quote can be given. After that comes a scope proposal and a contract, then the takeover: monitoring, backup where there is none, closing the obvious gaps and documentation.

eOffice Network has worked on this model since 2008, with small and mid-sized businesses in Serbia. Details of the service levels are on the [Managed IT Services](/usluge/upravljane-it-usluge) page, and if you only need maintenance without a whole IT department, see [IT Support and Maintenance](/usluge/it-odrzavanje).



![Photo by Towfiqu barbhuiya on Unsplash](/images/blog/ultimativni-vodi-za-za-titu-malih-preduze-a-od-phishinga-1633265486064.jpg)

Phishing is an attempt to trick you into handing over a password or card details yourself, or into opening an infected attachment. The attacker does not need a hole in your systems. They need one employee in a hurry. That is why small businesses are a frequent target: fewer filters, less training, and often the same person has access to the bank, the email and the invoices.

This guide has four parts: how to recognise phishing, how to train staff, which technical measures work even when attention slips, and what to do when someone clicks anyway.

## How to recognise phishing

Most phishing emails have at least one of these traits:

- The sender is not in your contacts, but the name looks familiar: a bank, the post office, a courier, Microsoft, the tax office.
- The sender address does not match the name. The text names one company, but the domain after @ is another, or looks like the real one with one letter changed.
- You did not start the conversation. The email appeared on its own, often with "urgent" or a deadline of a few hours.
- Something is being asked of you: click a link, open an attachment, sign in to an account or enter card details.
- The language is off: English for no reason, or your language with mistakes and odd word order.

Examples we actually see: an "invoice attached" from an unknown domain, "your account will be closed, sign in here", a message from "the director" asking for an urgent payment or gift card purchase, and a notice about a "parcel" that needs a customs fee.

Mass phishing goes to thousands of addresses and is easier to spot. Targeted phishing (spear phishing) is written for one company or one person, uses real names of colleagues and real projects, and is harder to catch. The technical measures in part three help most against it.

### The ten-second check

Before clicking any link in an email, four questions: who is the real sender (the whole domain after @), where does the link really go (hover over it), is the request unusual, and is there pressure to hurry. If you are not sure, do not use the link. Open the website yourself from the browser, or call the sender on a number you already have, not the number in the email.

## Training staff

Training does not have to be expensive or long. Three things that work:

**A short exercise every few months.** [Phish me if you can](https://www.phishmeifyoucan.com/) is a free inbox simulation: the user moves the emails they think are phishing to spam and gets a score and tips. Microsoft offers a free "Be Cyber Smart" kit with infographics, videos and templates for internal communication.

**A clear rule for money and passwords.** No payment, no change of a supplier's bank account and no gift card purchase happens on the basis of an email alone. Confirm by phone, on a known number, every time. The same applies to any request to enter a password through a link.

**No punishment for reporting.** An employee who says "I think I clicked" is worth more than one who stays quiet. If reporting is punished, you will learn about the next incident from the bank.

## Technical measures that do not depend on attention

Training reduces the number of clicks, but not to zero. These measures work even when someone clicks.

**1. Two-factor authentication (2FA) on everything.** A stolen password without the second factor is worth little. Email first, because every other password is reset through email, then the bank, Microsoft 365 or Google Workspace accounts and the VPN. For our clients we enable 2FA through an app, SMS or a phone call, depending on what staff can use.

**2. DNS filtering.** When an email gets past the filter and an employee clicks, a DNS firewall blocks the known phishing domain before the page loads. It works for the whole network, with no installation on devices, and also covers phones on the office Wi-Fi. Details: [DNS firewall](/usluge/sajber-bezbednost/dns-firewall).

**3. SPF, DKIM and DMARC on your domain.** These DNS records stop anyone from sending email in your name, to your clients and to your staff. Setup takes an hour and costs nothing. Most domains in Serbia do not have them.

**4. Antivirus and EDR on computers.** If an infected attachment is opened anyway, EDR notices the unusual behaviour and isolates the computer before the infection spreads to shared files. Details: [Cybersecurity](/usluge/sajber-bezbednost).

**5. Updates and backup.** Phishing is the most common entry point for ransomware. An updated system closes the holes an attachment tries to exploit, and a 3-2-1 backup with one copy not reachable from the network means that after an attack you restore data instead of paying a ransom. Details: [Backup and recovery](/usluge/bekap-i-oporavak).

**6. Safe browsing in the browser.** Google Chrome has built-in protection against known phishing sites. Turn on the stronger level: Settings, Privacy and security, Security, then "Enhanced protection". Edge and Firefox have the same.

A firewall at the network edge and a separate guest Wi-Fi are good practice, but phishing is stopped by the measures above, not by hardware.

## What to do when someone clicks

The first hour decides how much the incident costs.

1. **Do not delete the email.** Tell your IT, the company that maintains your IT, or the person responsible for security. The email is evidence and shows what the attacker was after.
2. **If a password was entered:** change it immediately, and everywhere else the same password is used. Sign out all active sessions on that account. Check whether forwarding rules were added to the mailbox; attackers often set them to keep reading the correspondence after the password is changed.
3. **If an attachment was opened:** disconnect the computer from the network (cable or Wi-Fi), do not switch it off, and call IT. Do not try to "clean" the computer yourself.
4. **If money was paid:** call the bank immediately. In the first few hours it is sometimes possible to stop the transfer.
5. **Report the email** as phishing in Gmail or Outlook, so the provider blocks the sender for others too.

## Conclusion

Phishing is not stopped by one tool. It is stopped by a combination: staff who know what to look for, 2FA that makes a stolen password useless, a DNS filter and EDR that catch the click, and a backup that makes ransomware not worth paying.

If you do not know which of these measures you already have, get in touch for a [free assessment](/kontakt). We look at your email domain, accounts, protection on computers and backup, and tell you what is already fine and what to close first. eOffice Network has done this for small and mid-sized businesses in Serbia since 2008.


Blog

WireGuard vs L2TP/IPsec: Which VPN to Choose

WireGuard Config: Interface and Peer Fields

Office 365 vs. Google Workspace vs. cPanel Email: Which Solution Is Best?

How Managed IT Services Can Save Your Business Time and Money

The Ultimate Guide to Protecting Small Businesses from Phishing