Do I Need to Be in the Office? Network Access and VPN Setup for B1 Bridge

March 23, 2026 · 7 min read

One of the most common questions we get from new B1 Bridge customers is: "Can I use this from home?" The short answer is yes — but your computer needs to be able to reach your SAP server. This article explains exactly what that means, first in plain English, then with the technical details your IT team might want.

The Simple Explanation

For everyone — no tech background needed

Think of it like a phone call

Your SAP Business One data lives on a computer called a server, which is usually sitting in your office, in a server room, or at a data center your company uses. B1 Bridge needs to "talk" to that server to pull your data into Claude.

Think of it like making a phone call. If you're standing in the same building as the person you're calling, the call just works — you're on the same phone system. That's what happens when you're in the office, connected to your company's Wi-Fi or plugged into a network cable. B1 Bridge can reach your SAP server directly because they're on the same network. No extra setup needed.

But if you're at home or at a coffee shop, your laptop is on a completely different network. It's like trying to call an internal office extension from your personal cell phone — the call won't go through because you're not on the same phone system.

In the office: Your computer and the SAP server are on the same network. B1 Bridge works immediately.

Working remotely: Your computer is on your home (or hotel, or airport) network. You need a way to get back onto your company's network first. That's where a VPN comes in.

What's a VPN and why does it help?

A VPN (Virtual Private Network) is a piece of software that creates a secure, encrypted tunnel from your computer back to your company's network. When you connect to your company's VPN, your laptop behaves as if you're sitting in the office — even though you're on your couch at home.

Once the VPN is connected, B1 Bridge works exactly the same way it does in the office. You open Claude, ask your SAP questions, and get answers. The VPN handles the connection to the server behind the scenes.

If your company already has a VPN — and most companies that run SAP Business One do — you probably already use it for things like accessing shared drives, internal websites, or Remote Desktop. If your VPN lets you do those things, it will work with B1 Bridge too.

Already have a company VPN? Connect to it, then use B1 Bridge as usual. That's it.

Not sure if you have a VPN? Ask your IT team: "Do we have a VPN I can use to access the office network remotely?" They'll know.

No VPN at all? You'll need to use B1 Bridge while connected to the office network — either physically in the office or through whatever remote access method your company provides.

What about cloud-hosted SAP?

Some companies don't run SAP on a server in their office — they use a hosting provider (like Boyum, Alchemy, or another SAP partner) that runs their SAP server in a data center somewhere. In that case, your hosting provider gives you a way to connect — usually a VPN or a direct connection address. As long as your computer can reach the SQL Server where your SAP database lives, B1 Bridge will work.

If you're not sure how you connect to your SAP system today, think about how you normally log into SAP. If you use the SAP Business One client application from home without any special steps, your setup likely already supports remote access — and B1 Bridge will work the same way.

The Technical Details

For IT administrators and technical users

What B1 Bridge actually needs

B1 Bridge runs a lightweight MCP server process on the user's machine. This process connects to your SAP Business One company database via Microsoft SQL Server using the standard mssql Node.js driver (TDS protocol). The requirements are straightforward:

TCP connectivity to your SQL Server instance on the configured port (default: 1433)
SQL Server authentication (SQL auth or Windows/NTLM auth)
Read access to the target SAP B1 company database

That's it. No HTTP APIs, no web services, no cloud endpoints. It's a direct TDS connection to SQL Server — the same protocol SAP Business One itself uses.

Network scenarios

LAN / on-premises: If the user's machine and SQL Server are on the same LAN or VLAN, no additional configuration is required. Ensure the SQL Server is listening on TCP (not just named pipes) and that port 1433 (or your custom port) is accessible. If you're using a named instance, ensure the SQL Server Browser service is running on UDP 1434 so the client can resolve the dynamic port.

VPN (site-to-site or client-to-site): Any VPN that provides Layer 3 connectivity to the SQL Server subnet will work. This includes IPsec, WireGuard, OpenVPN, Cisco AnyConnect, Palo Alto GlobalProtect, Fortinet FortiClient, and similar. The VPN must allow TCP traffic to the SQL Server port. If your VPN uses split tunneling, ensure the SQL Server's IP range is included in the tunnel.

Cloud-hosted SAP: If your SAP B1 instance is hosted by a third party, you typically connect via a site-to-site VPN between your office and the hosting provider's data center, or via a client VPN provided by the host. As long as the user's machine can establish a TCP connection to the SQL Server endpoint, B1 Bridge will function normally. Ask your hosting provider for the SQL Server hostname/IP and port.

Firewall and security considerations

B1 Bridge establishes an outbound TCP connection from the user's machine to the SQL Server. No inbound ports need to be opened on the user's machine. The connection profile is identical to what the SAP Business One client application uses.

For environments with strict firewall policies:

Allow TCP outbound to your SQL Server IP on port 1433 (or your configured port)
If using named instances with dynamic ports, allow UDP 1434 for the SQL Browser service, or configure a static port for the instance
If your firewall inspects TLS, ensure TDS protocol traffic is whitelisted

B1 Bridge does not require any internet-facing ports on your SQL Server. The SQL Server should not be exposed to the public internet. All remote access should go through a VPN or private network — which is the same security posture you should already have for SAP Business One access.

Testing connectivity

Before running B1 Bridge, you can verify SQL Server connectivity from the user's machine with a simple test:

-- PowerShell: Test TCP connectivity to SQL Server
Test-NetConnection -ComputerName YOUR_SERVER -Port 1433

-- Or from any machine with sqlcmd:
sqlcmd -S YOUR_SERVER\INSTANCE -U sa -P password -Q "SELECT 1"

If the TCP test succeeds (TcpTestSucceeded: True), B1 Bridge will be able to connect. If it fails, the issue is network-level — VPN not connected, firewall blocking the port, or SQL Server not configured to listen on TCP.

Common troubleshooting

"Connection timed out" — The user's machine cannot reach the SQL Server at all. Check: Is the VPN connected? Is the server hostname resolving correctly? Is port 1433 open?

"Connection refused" — The machine can reach the server, but SQL Server isn't accepting connections on that port. Check: Is SQL Server running? Is TCP/IP enabled in SQL Server Configuration Manager? Is the correct port configured?

"Login failed" — Network connectivity is fine, but the credentials are wrong. Check: Is SQL authentication enabled on the server? Are the username and password correct? Does the user have access to the target database?

"Named instance not found" — The client can't resolve the dynamic port for a named instance. Check: Is the SQL Server Browser service running? If not, configure a static port for the instance and specify it directly in B1 Bridge.

Ready to connect your SAP B1 to Claude AI?

Works from the office or over VPN. 5-minute setup. $49/seat.

Get B1 Bridge →