Access PBX from outside

Hi Brian
We have our FreePBX located on “internal” lan subnet.
Since we don’t want open ports visible to the bad guys, we use a VPN solution to permit secure access thru our (separate) firewall to the PBX.
Seems uncomplicated. HTH and YMMV