A zero-trust network for a nine-site hospital group
Replaced a single VPN concentrator that took the whole group offline with a role-based overlay that onboards a new site in three minutes.
- Client
- Hospital group · 9 sites
- Role
- Network advisor
- Timeline
- 6 weeks
- Stack
- ZeroTier, OIDC, OPNsense
9
sites connected
3 min
to onboard a site
0
single points of failure
01 — The challenge
One VPN concentrator served all branches. When it failed, no site could reach the HIS system, and adding a branch took days.
02 — Approach
Designed an overlay split by role (clinical, office, administrators) with flow rules constraining ports and destinations, plus SSO for roaming users.
03 — Outcome
No further concentrator outages, IT self-serves new branches in three minutes, and the setup passed regulatory review.
Stack
Principles
Nobody should reach everything, patients should not lose access because a VPN died, and adding a site should not require the central team.
Flow rules in use
# clinical network: HIS only, no outbound internet
action: accept
src: clinical devices (10.20.0.0/24)
dst: his-server (10.20.99.10) ports 443, 1521
# admin network: scoped SSH
action: accept
src: admins (10.20.50.0/25)
dst: all servers port 22, 443What to do next
- Enforce MFA at the identity provider
- Review memberships quarterly
- Retain join/leave logs for at least a year