VPN for accessing your endpoints can only end in pain for both your clients and your company. Are your endpoints not protected by oauth?