Yep VPN. The devices don't support TLS. (We have Cloudflare in front of other services)