A Complete Guide to Setting Up a Secure VPN for Accessing SIMRS from Outside the Hospital Network

In the era of digital transformation, the ability to access crucial systems such as SIMRS (Hospital Management Information System) from outside the hospital's physical network is no longer a luxury, but a strategic necessity. Imagine a scenario where a specialist doctor needs to access the medical records of a critical patient while at a conference, or the IT team has to perform troubleshooting on the system from home during emergency hours. Without a secure remote access mechanism, productivity can be hindered, and vital medical decisions can be delayed. However, opening direct access to SIMRS over the internet is a very risky action, given the sensitivity of patient data which is strictly regulated by regulations such as Permenkes No. 24 of 2022 on Medical Records. The best solution to bridge the need for accessibility and security is to implement a Virtual Private Network (VPN). This article will guide you comprehensively, step by step, in building a robust and encrypted VPN infrastructure using OpenVPN, enabling SIMRS access from anywhere while maintaining data integrity and confidentiality. We will discuss basic concepts, implementation details, server and client configuration, and best practices to ensure your system runs optimally and securely.

Basic Concepts of VPN and Its Relevance to SIMRS

Understanding the basic concepts of VPN is an important foundation before moving to implementation. Simply put, VPN creates an encrypted "tunnel" through a public network (internet) that connects the user's device to a private network (your hospital's network). All data traffic passing through this tunnel is encrypted, so third parties cannot intercept or read sensitive information. For the SIMRS context, this means electronic medical record (EMR) data, financial information, and other operational data remain secure even when accessed from unprotected locations. Modern encryption standards such as AES-256-GCM, used by OpenVPN, offer a very high level of security, almost impossible to break with today's computing.

The importance of VPN for SIMRS cannot be overstated. Regulations such as Permenkes No. 24 of 2022 explicitly emphasize the importance of security and confidentiality of electronic medical records. Article 34 paragraph (1) states that "The implementation of Electronic Medical Records must guarantee the security of data and information of Electronic Medical Records." Without VPN, SIMRS access from outside the network will be vulnerable to various cyber threats, ranging from eavesdropping, man-in-the-middle attacks, to brute-force attacks. With VPN, every external connection is treated as if it originates from within the hospital's network itself, complete with firewall protection and internal access controls. This allows medical teams, operational managers, or IT staff to work flexibly without compromising regulatory compliance or data security.

There are several commonly used VPN protocols, such as IPsec, L2TP/IPsec, PPTP, and SSL/TLS VPN. For SIMRS needs, SSL/TLS VPN such as OpenVPN is a highly recommended choice. Its advantage lies in its ability to traverse most NAT (Network Address Translation) and firewalls without complicated special configuration, as well as its flexibility in using standard TCP or UDP ports (for example, port 1194). In addition, OpenVPN offers strong authentication features through digital certificates (Public Key Infrastructure/PKI) and username/password, providing a double layer of security. Older protocols like PPTP, for example, are no longer considered secure due to known vulnerabilities. While IPsec is also strong, its more complex configuration often becomes a barrier for some organizations. Therefore, our focus on OpenVPN is a pragmatic and secure choice for the SIMRS environment.

The use of VPN also supports the SatuSehat Platform initiative by the Ministry of Health. Although SatuSehat interacts through APIs with the FHIR R4 standard which is already encrypted via strong HTTPS/TLS 1.2+, access to the internal SIMRS system that is the source of SatuSehat data still requires maximum protection. VPN ensures that the internal infrastructure hosting the SIMRS database (for example, PostgreSQL 16 or MySQL 8) and backend applications (Laravel 11.x, Node.js 20 LTS) remains protected from unauthorized access from the public internet, even when API bridging to SatuSehat is running. This is a layered approach in a comprehensive hospital cybersecurity strategy.

OpenVPN Server Implementation: Building a Security Foundation

For the OpenVPN Server implementation, we will use the Debian 11 "Bullseye" or Ubuntu Server 22.04 LTS operating system as the base platform. Both Linux distributions are known for their stability and security, making them ideal choices for a VPN server. Ensure your server has adequate hardware specifications, at least 2 CPU cores, 4GB RAM, and 40GB SSD to accommodate the OS, OpenVPN, and certificates. This server should be located in the DMZ (Demilitarized Zone) of the hospital network or have a very strict firewall configuration that only allows the OpenVPN port (default 1194 UDP) from the internet.

The first step is to update the system and install the OpenVPN package and Easy-RSA for certificate management. This process ensures all necessary components are available and up-to-date before further configuration. It is important to always use stable and officially supported versions to avoid potential security vulnerabilities or compatibility issues.

sudo apt update && sudo apt upgrade -y
sudo apt install openvpn easy-rsa -y

After installation, we need to set up a Public Key Infrastructure (PKI) using Easy-RSA version 3.1.x. This involves creating a Certificate Authority (CA) that will become the root of trust, a server certificate to identify the VPN server, and a Diffie-Hellman key for Perfect Forward Secrecy. Creating the PKI is a fundamental step for strong certificate-based authentication.

make-cadir ~/easy-rsa
cd ~/easy-rsa
./easyrsa init-pki
./easyrsa build-ca nopass
./easyrsa gen-req server nopass
./easyrsa sign-req server server
./easyrsa gen-dh

This process will generate a CA certificate (ca.crt), server certificate (server.crt), server key (server.key), and Diffie-Hellman parameters (dh.pem). These files are very crucial and must be stored securely, with access restricted only to authorized administrators. The server private key, in particular, must not leak to other parties.

Next, we will create the OpenVPN server configuration. The main configuration file is usually located at /etc/openvpn/server.conf. The following is an example of a recommended basic configuration, which includes important security and performance parameters. Be sure to adjust push "dhcp-option DNS 192.168.1.1" to the DNS IP address of your hospital's internal server. This address is vital so that VPN clients can resolve the internal hostnames of the SIMRS (for example, simrs.local or api.simrs.rs-anda.id). After configuration, copy the certificate and key files to /etc/openvpn/ and start the OpenVPN service. Finally, enable IP forwarding in the Linux kernel by editing /etc/sysctl.conf and adding net.ipv4.ip_forward = 1, then apply it with sudo sysctl -p. Firewall configuration (e.g., UFW or iptables) also needs to be adjusted to allow UDP traffic on port 1194 and forward traffic from the VPN interface (tun0) to the internal network. Example UFW rules: sudo ufw allow 1194/udp and sudo ufw allow in on tun0 from 10.8.0.0/24 to 192.168.1.0/24 (replace with your hospital's internal subnet). This ensures that VPN traffic can enter and leave the server and reach the internal network.

Client Management and Multi-Factor Authentication

After the OpenVPN server is ready, the next step is to create certificates and keys specifically for each client that will access the SIMRS. Each client must have a unique certificate for authentication and non-repudiation purposes. If one client is compromised, its certificate can be revoked without affecting other clients, maintaining the integrity of the overall system. This process requires returning to the ~/easy-rsa directory on the VPN server to run the certificate generation commands.

cd ~/easy-rsa
./easyrsa gen-req client1 nopass
./easyrsa sign-req client client1

Repeat this step for each client (for example client2, client3, etc.), ensuring each user has a unique cryptographic identity. After the client certificate is created, we need to combine it with the CA certificate and the client OpenVPN configuration into one .ovpn file that will be distributed to users. This file will be the only thing the client needs to connect.

Example Client Configuration File (client1.ovpn): You need to copy the contents of ~/easy-rsa/pki/ca.crt, ~/easy-rsa/pki/issued/client1.crt, and ~/easy-rsa/pki/private/client1.key into the <ca>, <cert>, and <key> tags respectively. This .ovpn file is then distributed securely to each user, for example via encrypted media or an in-person meeting. The security of distributing this file is very crucial.

client
dev tun
proto udp
remote your_public_ip_or_domain 1194 # Ganti dengan IP Publik atau Domain VPN Server Anda
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA256
cipher AES-256-GCM
comp-lzo no
verb 3
explicit-exit-notify 1

<ca>
-----BEGIN CERTIFICATE-----
# Konten ca.crt dari server Anda
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
# Konten client1.crt dari server Anda
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
# Konten client1.key dari server Anda
-----END PRIVATE KEY-----
</key>

In addition to certificate authentication, it is highly recommended to implement multi-factor authentication (MFA) for an additional layer of security. OpenVPN can be integrated with RADIUS or PAM to use a username/password and an OTP (One-Time Password) token from systems such as FreeRADIUS, Google Authenticator, or commercial MFA services. This provides much stronger protection than single-factor authentication.

Example of integrating OpenVPN with PAM for username/password authentication (requires openvpn-plugin-auth-pam): Edit /etc/openvpn/server.conf and add the following lines. With this configuration, the client will be prompted for an additional username and password after the certificate is verified. To integrate with Google Authenticator (as an OTP example), you can install libpam-google-authenticator on the server and configure pam_google_authenticator.so in /etc/pam.d/openvpn. Each user will run google-authenticator once to create their OTP secret key, which must be stored very securely.

plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so login
verify-client-cert optional
username-as-common-name

Example configuration /etc/pam.d/openvpn (after installing libpam-google-authenticator): With this configuration, users must enter their UNIX password and then the OTP code from their Google Authenticator app. This significantly improves the security of access to SIMRS, in line with recommended cybersecurity best practices for systems that handle sensitive data. Be sure to communicate this procedure clearly to users, including the importance of keeping their OTP keys confidential.

# Standard UNIX account and session management
auth       required   pam_unix.so try_first_pass
auth       required   pam_google_authenticator.so

account    required   pam_unix.so
session    required   pam_unix.so

Ensuring SIMRS Communication: Payload Examples and Error Handling

After the VPN is connected, the next crucial step is to ensure that the SIMRS application can communicate smoothly through the VPN tunnel. This often involves testing connectivity to the database, API, and other services that are the backbone of SIMRS operations. Assume your SIMRS uses a modern architecture with a RESTful API for frontend-backend interaction and a relational database such as PostgreSQL.

Example Patient Data Request Payload via SIMRS API (after connecting to VPN): Suppose the SIMRS has an API at http://192.168.1.100/api/v1/patients/{patient_id} that is accessed from a web or mobile application. Once the VPN is active, the client will be able to access this internal IP, which previously could not be reached from outside the hospital network. This is the core of VPN functionality.

{
  "method": "GET",
  "url": "http://192.168.1.100/api/v1/patients/RM20230001",
  "headers": {
    "Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
    "Content-Type": "application/json",
    "Accept": "application/json"
  }
}

Example Successful Response: This payload shows a request for patient data with ID RM20230001 using a JWT authentication token. Through the VPN, this request will be encrypted and routed directly to the SIMRS API server on the hospital's internal network, passing through the internal firewall that allows traffic from the VPN subnet (for example, 10.8.0.0/24). The response received will contain the requested patient data, indicating a successful connection and authorization.

{
  "status": "success",
  "data": {
    "patient_id": "RM20230001",
    "name": "Budi Santoso",
    "dob": "1980-05-15",
    "gender": "Laki-laki",
    "address": "Jl. Merdeka No. 45, Jakarta Pusat",
    "contact": "08123456789",
    "medical_history_summary": "Riwayat hipertensi sejak 2010. Alergi penisilin.",
    "last_visit": "2024-03-10"
  }
}

Examples of Common Error Messages and Their Handling:

1. "Connection Refused" or "Host Unreachable": This is the most common error indicating basic connectivity problems. The cause may be that the SIMRS server is not running, the configured IP address is incorrect, or a firewall on the SIMRS server or internal router is blocking connections from the VPN subnet (10.8.0.0/24). Effective handling includes verifying the SIMRS IP address (for example, ping 192.168.1.100 from the VPN client), ensuring the SIMRS application is running on the target server, checking the firewall configuration on the SIMRS server (sudo ufw status or sudo iptables -L) to ensure there is a rule that allows connections from the VPN subnet to the ports used by SIMRS (for example, ports 80/443 for web, port 5432 for PostgreSQL), and checking routing on the hospital's internal router to ensure there is a return route (return route) from the internal network to the VPN subnet via the OpenVPN server IP. Without a return route, traffic from SIMRS will not be able to reach the VPN client.

2. "TLS Handshake Failed" or "Certificate Verification Failed": This error is related to OpenVPN certificate issues. The cause may be an expired or revoked client certificate, or a mismatch between the CA certificate on the client and server. The necessary handling includes checking the expiration dates of the client and server certificates, ensuring that the ca.crt in the client .ovpn file is exactly the same as the ca.crt on the server, checking the CRL (Certificate Revocation List) if used, and, if necessary, regenerating the client certificate. Certificate consistency is the key to a successful TLS handshake.

3. "Authentication Failed" (if using username/password/MFA): This error indicates a problem with credentials. The cause may be an incorrect username or password, or an invalid/expired OTP code. Handling includes ensuring the entered username and password are correct, synchronizing server and client time for OTP (a time difference of more than a few minutes can cause the OTP to be invalid), and checking the authentication logs on the OpenVPN server and PAM logs (for example, /var/log/auth.log) to get more details about the authentication failure. Time accuracy is very important for TOTP.

Initial connectivity testing can be done by ping to the internal SIMRS IP, then telnet or nc to the application port (for example telnet 192.168.1.100 80). After that, use Postman or cURL to test the API directly with the example payload above. With an in-depth understanding of these potential errors, the IT team can quickly diagnose and resolve issues, ensuring stable and secure SIMRS access.

Best Practices

Implementing a VPN for SIMRS requires more than just basic configuration; it requires comprehensive best practices to ensure long-term security, performance, and reliability. Here are some best practices you should implement to secure your SIMRS infrastructure:

1. Use Multi-Factor Authentication (MFA) for All VPN Users: Do not rely solely on a single certificate or username/password. Implement MFA, such as time-based OTP (TOTP) via Google Authenticator or YubiKey, integrated with OpenVPN through PAM or RADIUS. This drastically reduces the risk of unauthorized access even if one credential is compromised, adding a critical layer of security.

2. Apply the Principle of Least Privilege: Grant VPN access only to individuals who truly need it to perform their duties, and limit the internal access they can reach through the VPN. For example, a doctor may only need access to the EMR module, not to financial servers or backup servers. Use a firewall on the VPN server or on the internal router to restrict access from the VPN subnet to specific internal resources.

3. Regularly Audit and Monitor Logs: Configure the OpenVPN server to log all activities, including connections, disconnections, and authentication attempts. Use a SIEM (Security Information and Event Management) solution such as the ELK Stack (Elasticsearch, Logstash, Kibana) or Splunk to collect, analyze, and monitor these logs in real-time. Anomaly detection can help identify potential security threats early and respond quickly.

4. Strict Certificate Management: Implement a clear certificate lifecycle. Set certificate validity periods (for example, 1-2 years), and create procedures for certificate renewal and revocation. Actively use a Certificate Revocation List (CRL) to revoke client certificates that are lost, stolen, or no longer in use. This prevents unauthorized certificate use and maintains the integrity of your PKI.

5. Regularly Update and Patch Systems: Ensure that the OpenVPN server operating system (Debian/Ubuntu), OpenVPN package, and Easy-RSA are always updated to the latest versions. This is important to patch discovered security vulnerabilities and ensure you get the latest features and fixes. Schedule regular updates, ideally outside peak operating hours to minimize disruption.

6. Perform Regular Penetration Testing: Conduct penetration testing (pentest) regularly on your VPN infrastructure by an independent third party. This will help identify potential configuration weaknesses or vulnerabilities that may have been missed during implementation, providing a security perspective from an objective and professional attacker's point of view.

7. Document Configurations and Procedures: Create comprehensive documentation of the entire VPN configuration, including network diagrams, a list of certificates and their validity periods, user onboarding/offboarding procedures, and incident handling steps. Good documentation is essential for maintenance, troubleshooting, and operational continuity, especially in a dynamic IT team.

8. Use Strong Cipher and Hashing Algorithms: Ensure that your OpenVPN configuration uses strong and modern encryption and hashing algorithms, such as AES-256-GCM for the cipher and SHA256 or SHA512 for authentication. Avoid old algorithms or those known to have vulnerabilities, as this can compromise the security of your VPN tunnel.

9. User Training: Educate users about the importance of VPN security, how to use the VPN client correctly, and what to do if they suspect a security issue (for example, loss of a device or credentials). User awareness is a vital first line of defense in a hospital's cybersecurity strategy, reducing the risk of human error.

By implementing these practices, you are not only building a working VPN, but also a resilient and secure remote access infrastructure, essential for protecting your patient data and SIMRS operations from various evolving cyber threats.

FAQ

1. Q: Is this VPN access safe for highly sensitive SIMRS patient data? A: Yes, with proper implementation, VPNs use strong encryption protocols such as AES-256-GCM, which is globally recognized as a high security standard. When combined with multi-factor authentication (MFA) and strict certificate management, the risk of data leakage can be significantly minimized. This level of security already meets compliance standards such as Minister of Health Regulation No. 24 of 2022 on Electronic Medical Records, which mandates protection of medical record data.

2. Q: What if the internet connection at the hospital is lost? Will the VPN still work? A: VPN relies on a stable internet connection to operate. If the hospital's main internet connection (where the OpenVPN server is connected) is lost, then VPN clients from outside the network will not be able to connect to the VPN server. Therefore, it is important to have a redundant or backup internet connection at the hospital to ensure the availability of VPN and SIMRS services, in order to maintain operational continuity.

3. Q: Can I use the existing VPN on the office router (for example, the built-in VPN feature of Mikrotik or Fortigate) instead of a separate OpenVPN setup? A: Of course you can. Many enterprise-class router devices such as Mikrotik RouterOS version 7.x or Fortigate FortiOS version 7.x have very capable VPN server features (IPsec, L2TP, OpenVPN client/server, SSL VPN). If you already have such a device and your IT team is familiar with it, it can be a more integrated option. However, make sure the protocol used is secure (avoid PPTP) and its security configuration is equivalent to what is discussed in this article, including strong cipher and MFA.

4. Q: How can I ensure that only authorized staff can access SIMRS through VPN? A: In addition to strong authentication (certificate + MFA) at the VPN level, you must implement role-based access control (Role-Based Access Control/RBAC) at the SIMRS application level itself. VPN only provides access to the internal network; authorization to view or modify specific data must be managed in your SIMRS application. Additionally, use a firewall on the VPN server or on the internal network to restrict the VPN subnet to only access certain SIMRS servers, not the entire internal network.

5. Q: Is there any significant performance impact when accessing SIMRS via VPN? A: Yes, there is a slight performance overhead due to the encryption/decryption process and additional routing that must be done. However, for modern internet connections (e.g., 50 Mbps and above), the impact is generally minimal and not very noticeable for daily SIMRS use. Performance is more influenced by the client and server internet connection speeds, as well as network latency. Make sure your VPN server has enough CPU to handle the encryption/decryption load efficiently.

6. Q: How do I revoke VPN access if an employee leaves the hospital? A: The access revocation process is very important and must be done immediately. For OpenVPN with PKI, you must revoke the client certificate in question using Easy-RSA on the VPN server (for example ./easyrsa revoke client1). After that, update the CRL (Certificate Revocation List) and ensure the OpenVPN server loads the latest CRL. Thus, even if the employee still has the old .ovpn file, their certificate will no longer be accepted by the server, so their access is effectively and quickly blocked.

Building a secure VPN infrastructure for SIMRS access from outside the network is not a trivial task, but it is a strategic investment that is essential for the operational continuity and regulatory compliance of modern hospitals. By following this step-by-step guide, from understanding basic concepts, implementation details of OpenVPN server and client, to the application of two-factor authentication and error handling, you now have a clear roadmap. Patient data security is the top priority, and VPN is a crucial defense in the healthcare IT ecosystem. Do not let security vulnerabilities become a barrier to innovation and efficiency at your facility. If you need further assistance in designing, implementing, or auditing VPN solutions and other healthcare IT systems, our expert team at Nugroho Setiawan is ready to be your trusted partner. Visit our website or contact us directly for a free consultation and discover how we can help realize a secure and efficient IT infrastructure for your healthcare facility.

This article is part of the education of Nugroho Setiawan, an IT consultant in Jogja. Related solutions: SIMRS BPJS & SatuSehat Bridging Integrator. Need free consultation?