How to Set Up a VPN for Secure and Auditable SIMRS Access from Outside the Hospital Network

At 02:00 WIB, the emergency department doctor on duty wants to check the laboratory results of a new patient, while the pediatric specialist is at home, 12 km from the hospital. The quick solution often taken: IT staff open port 8080 on the router so SIMRS can be accessed from the internet. Done in 5 minutes, then becomes five years of security debt. Throughout 2023-2024, ransomware incidents at Indonesian healthcare facilities increased, and management services exposed to the public are one of the favorite entry points. Yet remote access to SIMRS is a legitimate operational need: duty schedules, night rounds, BPJS claim verification, up to board approval. What is wrong is not the need, but the method. VPN moves access from being open to the entire internet to being encrypted and only for registered devices.

Choose a VPN Architecture: WireGuard, OpenVPN, or Zero Trust

Before touching configuration, distinguish two models. Remote access VPN connects individual devices — doctor's laptops, manager tablets — to the hospital internal network. Site-to-site VPN connects two locations, for example the main hospital in Magelang with a satellite clinic 8 km away. For SIMRS, most cases are sufficient with remote access VPN plus one gateway; site-to-site is only needed when a branch has its own subnet and both must access the same server.

From the protocol side, WireGuard (native in Linux kernel 5.6+ and RouterOS 7) is the default choice we recommend. Its codebase is about 4,000 lines, compared with OpenVPN 2.6 at more than 70,000 lines — the attack surface is much smaller and auditing is realistic. WireGuard handshake completes in milliseconds, and throughput on an Intel N100 mini PC routinely reaches 600-800 Mbps, while OpenVPN on the same device usually stops at 150-250 Mbps. OpenVPN 2.6.8 remains relevant for one scenario: clients on networks that block UDP and only allow TCP 443.

For devices, the two most economical options: MikroTik hEX S RB760iGS with RouterOS 7.14 (around Rp1.3-1.5 million, 6 W power consumption) or a mini PC with pfSense CE 2.7.2. Both support WireGuard without additional licenses. If your hospital uses a Delphi-based client-server SIMRS with MySQL 8.0 on port 3306, the VPN gateway should be placed in front of the server subnet, not on the application server itself.

Quick mapping: web-based SIMRS (Khanza web version or in-house application) only needs split tunnel — clients only route 192.168.10.0/24 through the VPN, while other traffic remains over the local internet.

WireGuard Setup on Ubuntu 22.04 for SIMRS Access

Prerequisites: Ubuntu Server 22.04 LTS (kernel 5.15, WireGuard already in-tree), wireguard-tools package 1.0.20210914, and a static public IP or DDNS. Plan the addresses first: VPN server 10.10.10.1/24, each user gets a /32 (10.10.10.11, 10.10.10.12, etc.), and SIMRS subnet 192.168.10.0/24 with the application server at 192.168.10.20.

Generate keys with wg genkey | tee private.key | wg pubkey > public.key, then write the following configuration. One [Peer] block per device — never use one shared key for 20 doctors.

# /etc/wireguard/wg0.conf — Ubuntu 22.04, WireGuard 1.0.20210914
[Interface]
Address = 10.10.10.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY
PostUp   = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
# dr. Andi - laptop rumah
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 10.10.10.11/32

Enable IP forwarding via /etc/sysctl.d/99-wireguard.conf (net.ipv4.ip_forward=1), then systemctl enable --now wg-quick@wg0. Open only UDP 51820 on the firewall — no other port needs to face the internet. Verify with wg show: the latest handshake column must be filled a few seconds after the client connects.

On the client side (Windows 11, macOS 14, or the WireGuard Android/iOS app), set AllowedIPs to 192.168.10.0/24, 10.10.10.0/24 so that only SIMRS traffic enters the tunnel, and DNS = 192.168.10.10 if SIMRS uses an internal hostname. Add PersistentKeepalive = 25 so that office NAT or phone tethering does not drop the session when idle. For full tunnel, change AllowedIPs to 0.0.0.0/0 and set MTU 1420.

Access Control, Audit, and Operational Readiness

One key per user, without exception. When staff resign, revoke the peer with wg set wg0 peer PUBLIC_KEY remove — done in one second without disrupting other users. Store the peer list along with owner names in a private repository, because WireGuard does not store comments at runtime.

Layered firewall: the gateway only opens UDP 51820, and the SIMRS server still restricts port 3306 only from 10.10.10.0/24 via nftables or ufw. That way, even if the VPN gateway is compromised, the database is not automatically exposed. Enable connection logging via journalctl or send it to Loki/Graylog, and retain at least 90 days for forensic needs.

VPN does not replace application authentication. Still enable strong passwords and MFA in SIMRS, and separate access rights per role: doctors only read medical records, cashiers only the billing module. Rotate keys every 6-12 months and store private keys in Vaultwarden or HashiCorp Vault, not in the Desktop folder of IT staff.

Best Practices

1. Make split tunnel the default; full tunnel only for client-server applications that truly require the entire subnet.
2. Apply one key per device and revoke access within a maximum of 24 hours after a change in employee status.
3. Never expose 3306 or 3389 to the internet; VPN first, application firewall afterward.
4. Test the emergency path (console/IPMI to the gateway) before enabling firewall rules that lock access.
5. Document the IP plan, peer list, and key rotation procedure in the runbook so you do not depend on one person.

FAQ

Does VPN slow down SIMRS access?

The added latency is generally 5-15 ms for users in the same city. What matters more is MTU: set 1420 on the client to prevent fragmentation that makes the application feel like it is hanging when opening heavy modules.

My IndiHome public IP is dynamic or CGNAT, what should I do?

Use DDNS if you can still get a public IP. If CGNAT, put the WireGuard gateway on a VPS for Rp50-100 thousand per month as a relay, or use Tailscale, which traverses NAT without port forwarding.

Is it safe to open UDP 51820 to the internet?

WireGuard does not reply to packets without a valid key, so the port appears closed to port scanners. The risk is still managed with routine peer revocation and monitoring for unknown handshakes.

Can I just use Tailscale or ZeroTier directly?

For clinics with fewer than 10 users, both are very practical and save time. Consider data governance and vendor lock-in before choosing them for a hospital with many branches.

Setting up a VPN for SIMRS is not a big project: one Ubuntu server, 15 lines of configuration, and discipline in revoking access. What is expensive is actually the consequence of not doing it — patient data leaks, downtime during ransomware, and PDP Law sanctions. If your IT team is doing this while handling BPJS and SatuSehat bridging, we can help from network design, gateway hardening, to application SSO integration. Nugroho Setiawan provides IT consulting and application development — SIMRS, SIM Klinik, ERP, POS, and websites — for Yogyakarta, DIY, and Magelang. Starting from a one-business-day remote access audit, with no long-term project commitment.

This article is part of the knowledge base of Nugroho Setiawan, an IT consultant in Jogja (Yogyakarta). Related solutions: SIMRS (Hospital Information System) Clinic Management System BPJS & SatuSehat Integration. Need a free consultation?