Brian, you should consider if there is any NAT between the iPad and your VPN server. If yes, the NAT should support VPN passthrough.
I think the most popular client to server mode VPN is PPTP. And it is easy to use.

Thanks alphhha! I'm still in need of more info and I'm hoping you can assist further.

Right now, the cable modem at the cafe is connected to the WAN port on an Apple Airport Extreme (WiFi router, if you are not familiar). All the local iPad POS terminals communicate wirelessly and all printers are wired to the LAN ports on the Airport.

I'd prefer to put a VPN gateway "behind" the Airport, i.e. connected to a LAN port, but I suspect that won't work. Am I correct that a VPN router, like a TP-Link TL-R600VPN, would need to be at the "edge" of the local network, connected directly to the cable modem? If so, would I have any issues if I connect one of the TP-Link's LAN ports to the Airport's WAN port? Put another way, what is the proper topology for these devices, cable modem -> VPN router -> Wireless access point?

If I buy a TL-R600VPN, might you be willing/able to help me with administration if I get confused (highly likely)?


Brian

This Airport is the NAT what I mentioned before. Note the cable modem should work in bridge mode rather than a modem router. Or you will need to bypass two NAT devices

Thanks again alphhha

I apologize for not explaining how much of a neophyte I am relative to VPN technology, so I remain somewhat confused. I know how to use it (been doing it for many years, just never had to set one up).

I know what NAT is and although I have not logged into the Charter cable modem, I'm pretty sure it is operating in bridge mode out of the box. I say that because before we switched to Charter we had AT&T DSL and our Airport was always bitchin' about double NAT (although everything worked just fine regardless). When we installed the Charter modem, all we did was take the Airport's WAN cable out of the DSL modem and plugged it into the Charter modem and the complaining stopped.

Assuming I am correct, the question remains: where should a VPN router be installed, between the cable modem and the Airport, or beyond the Airport? One additional clarification about our need: we want to VPN in from a remote iPad to reach just one device at the cafe: another specific iPad (the 'host' for the POS system). We would expect to use DDNS (since the cafe does not have a fixed IP address from Charter) like we do with our security cameras. But we cant point a URL directly to the internal iPad, as both the local host iPad and the remote client iPad must be on the same network. Thus the need for VPN. I'm assuming that DDNS will be used by the remote iPad's built-in VPN client to reach the cafe's VPN router (rather than the host iPad directly). Do you agree so far?

Assuming that I am correct, the original question remains: what should our topology be (what device connected to what device in what order). And one last question )for the moment, anyway), would you say that, one way or another, a TL-R600VPN will satisfy our needs? If so, I'll order one and start trying to figure out how the devil to set it up.