The network gear I manage is only accessible via VPN, or from a trusted internal network…

…and by the gear I manage, I mean my home network (a router and a few managed switches and access points). If a doofus like me can set it up for my home, I’d think that actual companies would be able to figure it out, too.