As an IT admin, what can I do to countermeasure an attack performed like this page explains? http://www.pivpn.net/2015/08/hide-your-ass-hide-by-mac-address-and.html
What they do is to put a raspberry pi running SSL VPN software on the inside of the office network with a virtual interface connecting to a cloud server with a dynamic DNS name. The external VPN client then connects to the cloud server too, linking up with the virtual interface.
The interface on the raspberry is blocking all incoming traffic except the created link from the VPN server to the cloud.
Of course, this means that they have access to your network, but as far as I can see, nmap is not figuring it out.