I'm surprised they were stupid enough to use a commercial VPN - that would rightfully trigger lots of security alerts.

The proper way to do that is to VPN back home. They should sell these as preconfigured pairs where anything plugged into one's ethernet port comes out of the other (with some kind of layer-2 VPN between them).