Staff in several offices need to work through internet lines located elsewhere, controlled and audited, without software on office PCs and without exposing routers to the internet. First solved by hand in 2019 for a company with offices in several countries.

Every router must connect outbound (works behind NAT); one line = one tunnel; the line router must know nothing about users; when a line drops, traffic must stop, never leak.

Central WireGuard hub; MikroTik routers that connect from behind any modem; policy routing per session; a root agent with a command whitelist reconciling the system to the database; an address plan so a new line needs no new decisions.

Portal (roles, lines, offices, devices, sessions, audit, live updates), agent, monitor, a proxy per line, generated router configurations with rollback, an end-to-end test in a network namespace.

Office routers via SSH; geolocation API for line verification.

Line status from three independent checks; passive throughput; six connection methods measured before recommending one.

In production. New lines are added without touching office equipment. Security debt (backup, HTTPS, two-factor) is written down where anyone can see it.