Are there any negative consequences to encrypting an unencrypted service/protocol like FTP, VNC, telnet, and so on by using forced encryption like ssh tunneling or OpenVPN tunnels?


Not knowing the use case, it is difficult to anticipate what would count as a downside.

But performance is often a problem. TCP has a flow control feature whereby it automatically slows down in response to perceived network congestion, so if you tunnel TCP on top of TCP, like e.g. FTP over ssh, or over OpenVPN with the TCP transport option, you can have surprisingly serious issues. The OpenVPN documentation explains this well, and switching to OpenVPN UDP can resolve. But then you might need to adjust default packet fragmentation, I once saw that become a problem. It helps if you know your way around a network sniffer like wireshark to diagnose / resolve such performance issues.

As for other issues, debugging the protocol you are encrypting obviously can't be done with a sniffer anymore once the traffic is encrypted, unless you give your sniffer knowledge of the key. (Wireshark has some capabilities related to this.) But then that's also the point, so not sure if we should consider it a downside.

You'll also need sufficient processing power to handle the encryption / decryption. I find a Raspberry Pi 3 can stream video over OpenVPN very reliably (if you use UDP transport option and resolve any packet fragmentation issues), but that Pi is kinda busy. I find the processors in some cheap routers are not able to encrypt / decrypt that quickly - so just depends how much processing power you have conveniently available.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.