2

For doing ssh into our AWS infrastructure outside of office, we are required to connect to a VPN which gives us an office IP. Once we are connected to this VPN we are required to connect to another VPN (which is only accessible from office IPs), and only when we are connected to this VPN, we can ssh into the machines.

The first layer of VPN makes sense, but does second layer adds any extra security?

The reason that I'm given is that opening ssh ports to office IPs is dangerous as there are way to many computers in our network and if any one of them is compromised it would simply leave the window open.

On questioning why can't the external VPN be made publicly accessible, I'm told that it is akin to having a SSH bastion open to the world.

Connecting to two VPNs every time is slow and fragile and even the latest MacOSs don't support.

So what do you guys think? Having two layer of VPNs really adds up security? Is the trade-off worth it?

Improve this question
0

1 Answer 1

Reset to default
3

There is no general answer to that.

Usually, a security system is implemented to protect against a specific set of threats. In your case, implementing two layers of protection could have resulted from the necessity to protect against a number of potential threats:

  • Improper access control of application in network 2 from users in network 1
  • Requirement of using a known weak VPN product as first access layer.
  • Different networks being managers by different teams.
  • General network access security guidelines (for instance "no direct access to systems in network 2 from external system").
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .