VPN over HTTPs for a web service only

Question

I have a web service (PHP & MySQL on Ubuntu 12.04) running in a corporate intranet. I have also connected it to internet through a firewall letting incoming connections on HTTPs only (port 443). I'm considering now to add VPN over it to add additional security level, to open VPN ports and close HTTPs. That seems to be more secure but more inconvinient for an end user too. Users will be loginging from ther PCs, tablets and phones using a VPN client to access the web service and the their login and password to access their data.

As I understand it adds additional login/password pair to the authentication process and basically that is the only advantage. Of course such a set up adds IPSec encryption but I don't think VPN encryption is a useful feature here as the traffic already encrypted with HTTPs.

In a VPN case a malicious user would scan a server for open ports, find the VPN ports open and start to brute force VPN user access credentials before he can start to brute-force/code inject the actual web service.

But if I would just need another login/password pair I can just make a double-step authentication process on the web service instead of bothering users with a VPN client set up.

So it seems like a VPN pros in my case are: Additional authentication step using a VPN client IPSec encryption Everybody think you are safe

VPN cons are: Additional authentication step which adds complexity for the users Useless encryption of already encrypted HTTPs traffic VPN user get access not only to the web service but to the entire sub network so extra equipment needed to put the server to DMZ.

Am I wrong on any of those points? Would a VPN really add more security in my case or it will give more unnecessary complexities instead without really adding anything useful?

Answer 1

It's a tradeoff. You're probably better off behind the VPN, but at a cost.

• VPN will add a 2nd layer of authentication
• VPN prevents unauthenticated attackers from attacking web app
• VPN increases support burden
• IPSec VPN doesn't traverse NAT well
• VPN potentially makes things slower

Your webserver should already be in a DMZ. Exposing a service to the internet that's on an internal (non-DMZ) network is a significant risk.

If you have users authenticate to the VPN, you should try to use some sort of single-sign-on solution so they don't have to authenticate to the app as well. The idea of adding 2 sets of usernames/passwords to the app is just cruel to your users, and would offer very little security benefit (might actually encourage the use of weaker passwords, increases attack surface).

Answer 2

To answer in short and keeping things only from security perspective:

• Without VPN Your web application or web server being vulnerable will be enough to get you compromised.
• With VPN you would mostly rely on VPN server's security, which I would say would have a lesser chance of being vulnerable than your web application. Your web server's or web application's vulnerabilities wouldn't be accesible by third parties who do not have VPN access. They would first have to get access through VPN.

There is also your firewall's security which is important, but it makes no difference in this case.