I wonder how safe is it to whitelist honorable VPN service provider's IP (for example NordVPN) in, for example Azure/AWS to use RDP/SSH? Is it any better then whitelisting local ISP's IP assigned to me?

  • The IP will be shared among multiple VPN users (which is one of the key privacy mechanisms of VPN services) while the IP assigned by the ISP will usually be exclusive to you for the time you're logged on. – Arminius Aug 19 '17 at 4:18

While restricting the address space that is allowed to access the ports is always a good idea, both your options are equivalent, generally speaking.

If your local ISP has as many customers as the VPN provider - or both numbers are in the same ballpark - you have equivalent security gains if the ISP uses an IP pool where you regularly get a new IP from that pool. There's one thing to consider though: VPN providers allow access from everywhere for basically everyone who wants. This is either a pro for you while you travel and do not have an IP from your local ISP assigned or a pro for an adversary that is not able to get service from your local ISP.

If restrictions on the ACL are so wide, either way, you should still consider the ports public and use public key authentication rather than password authentication and keep your machine up to date.

If you only use the currently assigned ISP's IP or if your ISP does not use a pool, you'd be better off using that IP to whitelist.

If you need to access the services while away, you might host a VPN proxy in your home network

  • I have a VPN server at home both to access my home network and to provide me some privacy – Rui F Ribeiro Aug 19 '17 at 8:20
  • Thank you for the extended explanation. In the end I've chosen to use Dedicated IP, provided by online VPN provider, to have access to all my services in any location with hight probability of ONLINE VPN server (my home server can be inaccessible quite often due to some house stability issues: ISP/Electricity issues). Sure that is additional money, but I think its worth for security reasons. – 0x49D1 Aug 20 '17 at 18:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.