Modernizing Remote Access: How Beaver Excavating Secured Its Infrastructure with Firezone and WireGuard

The landscape of corporate networking has undergone a radical transformation over the last decade, moving away from centralized offices toward a distributed model that demands robust, high-performance remote access. As organizations grapple with the limitations of legacy Virtual Private Networks (VPNs), many are turning to modern protocols and software-defined solutions to bridge the gap between security and usability. This shift was the central focus of a recent episode of the Tech Bytes podcast, which explored how the construction industry—a sector often characterized by rugged field operations and complex logistical requirements—is navigating these digital challenges.

The episode featured a deep dive into the implementation of Firezone, a secure remote access solution built on the modern WireGuard protocol. To provide a real-world perspective on the transition, the podcast hosted Daniel Caruso, the IT Network and Systems Administrator at Beaver Excavating. Based in Canton, Ohio, Beaver Excavating is a major player in the construction industry, handling large-scale earthmoving, utility, and concrete projects. Managing the IT infrastructure for such a firm requires balancing the needs of office-based staff with those of project managers and engineers working from remote job sites.

Joining Caruso was Jamil Bou Kheir, the founder of Firezone, to discuss the technical underpinnings of the platform and the broader trends driving the adoption of WireGuard-based security architectures. The conversation highlighted a growing realization among IT professionals: the "castle-and-moat" security model of yesteryear is no longer sufficient for protecting modern remote desktop infrastructure.

The Challenge of Legacy Infrastructure

For many years, the standard approach to remote access involved traditional VPNs utilizing protocols like IPsec or OpenVPN. While these technologies served their purpose for a time, they have increasingly become a source of frustration for both administrators and end-users. Legacy VPNs are often criticized for their complexity, slow connection times, and the significant overhead required to maintain them.

For Daniel Caruso at Beaver Excavating, the search for a new solution was driven by the specific need to protect the company’s remote desktop infrastructure. In the construction industry, where employees frequently need to access heavy-duty design software, project management tools, and internal databases from the field, ensuring a stable and secure connection is paramount. However, exposing Remote Desktop Protocol (RDP) directly to the internet is a well-known security risk, frequently exploited by ransomware actors and other cybercriminals.

Caruso’s objective was to find a solution that could provide a seamless "on-network" experience for remote employees without the vulnerabilities associated with traditional port forwarding or the clunkiness of older VPN clients. The goal was to implement a system that offered granular control over who could access specific resources, effectively moving toward a Zero Trust approach to networking.

The Shift to WireGuard

The foundation of Firezone’s appeal lies in its use of WireGuard. As a modern, high-performance VPN protocol, WireGuard has gained significant traction in the IT community for its simplicity and speed. Unlike OpenVPN, which consists of hundreds of thousands of lines of code, WireGuard is lean, making it easier to audit for security vulnerabilities and significantly faster to establish connections.

Jamil Bou Kheir explained that Firezone was designed to take the core strengths of WireGuard—its encryption standards and performance—and wrap them in an enterprise-grade management layer. For an administrator like Caruso, the raw protocol is only part of the equation; the ability to manage users, define access policies, and integrate with existing identity providers is what makes the solution viable for a business environment.

During the podcast, Caruso detailed the evaluation process that led him to Firezone. Like many IT professionals, he looked at a variety of options, ranging from traditional hardware-based firewalls with built-in VPN capabilities to other emerging software-defined perimeter tools. The decision to go with Firezone was influenced by its ease of deployment and the performance benefits inherent in the WireGuard protocol. In a field like construction, where bandwidth at job sites can be inconsistent, the low overhead of WireGuard ensures that users spend less time waiting for connections to initialize and more time performing their core duties.

Implementation and Day-to-Day Operations

Transitioning an entire company’s remote access strategy is no small feat, yet the discussion revealed that the implementation of Firezone at Beaver Excavating was remarkably straightforward. Caruso noted that one of the most significant advantages was the improvement in day-to-day operations.

In a traditional VPN setup, administrators often deal with a constant stream of support tickets related to dropped connections, forgotten passwords, and client software conflicts. By moving to a more modern architecture, Beaver Excavating has been able to streamline the user experience. Firezone allows for seamless integration with identity providers, meaning users can authenticate using the same credentials they use for other corporate services. This not only improves security by enabling multi-factor authentication (MFA) but also reduces the friction for the end-user.

Furthermore, the management interface provided by Firezone allows Caruso to see exactly what is happening on the network in real-time. He can grant or revoke access to specific servers or applications with a few clicks, ensuring that even if a device is compromised, the potential lateral movement of a threat actor is severely restricted. This level of granularity is a cornerstone of the Zero Trust Network Access (ZTNA) philosophy, which assumes that no user or device should be trusted by default, even if they are "inside" the network perimeter.

Protecting Remote Desktop Infrastructure

A significant portion of the conversation focused on the specific use case of protecting remote desktop infrastructure. For a firm like Beaver Excavating, RDP is a critical tool. It allows employees to leverage the computing power of high-end workstations located in the main office from a simple laptop in the field.

However, the security of RDP has long been a concern for IT administrators. Caruso highlighted how Firezone acts as a secure gateway, masking the RDP ports from the public internet. By requiring a Firezone connection before the RDP session can even be initiated, the company adds a robust layer of encryption and authentication. This setup effectively mitigates the risk of brute-force attacks and other common exploits targeting remote desktop services.

Jamil Bou Kheir added that this is one of the most common use cases for Firezone. By providing a secure tunnel that is transparent to the user, organizations can maintain the productivity benefits of remote desktop environments without the catastrophic risks of leaving those services exposed.

The Role of Firezone in Modern IT

As the founder of Firezone, Bou Kheir provided context on where the product fits into the broader cybersecurity ecosystem. He emphasized that the goal is not just to replace the VPN, but to rethink how access is managed entirely. In the past, a VPN gave a user a "key to the front door," and once inside, they often had access to the entire network. Firezone and similar ZTNA solutions operate on the principle of "least privilege," ensuring that users only have access to the specific resources required for their roles.

This approach is particularly beneficial for companies like Beaver Excavating that may work with sub-contractors or third-party vendors. Instead of giving an outside party full network access, the IT team can create a policy that limits their access to a single server or application for a specific duration.

The podcast episode concluded with a look toward the future. As more companies move their workloads to the cloud and embrace hybrid work environments, the need for flexible, secure, and high-performance networking tools will only grow. For Daniel Caruso and the team at Beaver Excavating, the move to a WireGuard-based solution has provided a scalable foundation that meets their current needs while offering the flexibility to adapt to future challenges.

The success story of Beaver Excavating serves as a practical blueprint for other mid-sized firms looking to modernize their infrastructure. By prioritizing protocol efficiency and administrative simplicity, organizations can enhance their security posture without sacrificing the productivity of their remote workforce.

Episode Links:

For those interested in a deeper look at the technical specifications of the solution or the specific experiences shared by the guests, the following resources provide additional context:

Watch this episode on YouTube

Firezone.dev

Firezone documentation

Jamil Bou Kheir on LinkedIn

Beaver Excavating