VPN to protect traffic from one server to a remote site

Question

I need to install a server at a customer's site (Site A) that needs to communicate securely to a network at another site (Site B). The communication between Site A and Site B is over the internet. There are a number of un-encrypted protocols that need to be secured. The plan, I think, is to send everything through a VPN tunnel between Site A and Site B.

I assume the VPN could be configured to only send packets to site B that came from the IP Address of our server at Site A rather than send all source IP Address from Site A?

A high-level design that I've have seen has a site to site VPN, but no further details than that.

I presume this means that data would flow in the clear until it hit the firewall at Site A and would then be directed through the VPN tunnel to Site B.

My concern is the data flowing in the clear at site A's network before it goes into the VPN tunnel from Site A to Site B. I am not concerned about the data when it pops out of the tunnel at Site B as this is a trusted Zone.

Wouldn't it be more secure to have the VPN running all the way from the server we install at Site A to Site B. Isn't this more secure than having a site to site VPN? What is the typical way this type of problem is resolved?

I am not very familiar with VPNs. Am I missing something? What would be the advantages/disadvantages of either approach?

The server will be running Windows 2012 R2. What is a good VPN client that could be used on that server to send traffic over a VPN to Site B? Is IPSec the protocol that most VPNs use for this type of scenario?

Answer 1

The idea of a VPN is that traffic between two endpoints is securely encrypted and that the endpoints are configured to know about each other, thus expanding the private network over the inherently untrusted Internet.

Secure encryption is not particularly special and no particular method is required to make a VPN. The assumption is that data in the wild-west Internet is unbreakable. This is true with other secure protocols like SSL and SSH, etc.

The VPN is special and convenient because it extends your private network resources and address space via an internet connection. A client-server VPN (e.g. connection to a company network from home computer) puts the client (home computer) on the network as though it was plugged into the network directly. A peer-to-peer VPN such as you describe makes the network at one end equally accessible to those at the other end.

Typically, a VPN endpoint is a feature of, or linked to the firewall and router. Traffic is efficient because unlike one-time connections, it's persistent, so the security handshake and key exchange happens infrequently. (Compare this to an SSL connection between a browser and website).

If your VPN is to a customer (as opposed, for example to another office of your company) each side will decide what traffic is allowed and how much access A has to B's resources, and B has to A's. These become standard firewall rules -- the same that may isolate one subnet of your network from another. The nice thing about the VPN is that once established, who has access to what can be changed independently of the VPN connection itself.

I think your scenario is a peer-to-peer VPN setup. There are standard protocols that allow VPN Brand A to talk to VPN Brand B, and there's some good free VPN software out there (OpenVPN). Cisco, Checkpoint and others make devices and software that will work in most configurations and may be easier to manage than setting up a server to run OpenVPN or other software-based VPN.

Answer 2

If the server you deploy at the customer site needs to talk to your companies servers securely, a site-to-site VPN is a good solution. Usually, site-to-site VPNs are established via endpoints on each networks DMZ. But, if you are a vendor deploying your solution to a customer premises they may not like the idea of deploying a box on their DMZ for you. Also, it sounds like you are not assuming the customers internal network is secure -- which by the way is a good assumption to make.

Based on the requirements and the thoughts above, I'd recommend deploying a VPN server (OpenVPN on pfSense is a good option) at your site and configure the servers you deploy with VPN client which can connect and establish a secure VPN to your VPN server and yoru network.

You will still need to ask the customer to allow your server to establish an outbound VPN session through their firewall, but that shouldn't be a huge issue.