2

Suppose I'm hosting a web server and a separate box offsite that crunches data. The web server interacts with the worker using the worker's API over port 2888. What would be the design of a secure infrastructure be like?

I was thinking to have just 2 firewalls: one in front of the web server with port 80 open to the public and port 28888 (for the worker) open just to the worker's IP and one firewall in front of the worker with just 28888 open to the web server's IP. Would this be secured or would I need an VPN?

Thanks

Improve this question

1 Answer 1

Reset to default
3

Whether a VPN is necessary in this scenario would largely depend on the nature of the traffic between the worker and the web server and whether you're worried about Man-In-The-Middle(MITM) attacks.

A VPN could add two potential benefits to your security here. Firstly it should encrypt the data between the endpoints. This is obviously a security benefit if the traffic between the two endpoints is unencrypted by default (e.g. over HTTP). However if the data is already encrypted, then there may be a limited benefit here.

The other benefit could be authentication of the endpoints. At the moment you're restricting by source IP address using a firewall, but there are always potential risks (over an untrusted network like the Internet) that someone could place themselves "between" the endpoints as a Man-In-The-Middle. A proprerly configured VPN should include authentication of the endpoints which should preclude this kind of attack. However it could be that the application traffic already handles this (e.g. HTTPS with trusted certificates) so the VPN might not add much.

So there are potential benefits, depending on the nature of the application traffic.

Improve this answer
4
  • 1
    Thanks. Our budget is very low so I'm not sure whether we'd have the resources to maintain our own VPN. To prevent MTM, how about HTTPS (assuming it might take less effort?)?
    – Kar
    Commented Nov 18, 2014 at 11:21
  • 1
    HTTPS implemented correctly should serve the same goals, in that it encrypts data transferred between the two systems and should provide authentication of the endpoints, unless an attacker can get a fake certificate issued, which is unlikely unless you're worried about government level attackers.
    – Rory McCune
    Commented Nov 18, 2014 at 11:23
  • Do you mean HTTPS implemented correctly should serve the same goals as VPN in general or in my case? Is it typically simpler to set up HTTPS than to set up + maintain a VPN?
    – Kar
    Commented Nov 18, 2014 at 11:25
  • Not knowing everything about your company and set-up it's impossible to provide definitive advice I'm afraid, what's easier for one company is harder for another.
    – Rory McCune
    Commented Nov 18, 2014 at 11:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .