I'd like to reach some webservices on my home microserver when I am not at home. Since I don't want to reach other services like SMB, SSH, etc. I thought it might be better to use SSL VPN with a self-signed cert I would add to my client computers manually before using the webservices. Afaik. there are SSL security testers like comodo, so it will be much easier to check whether the VPN is secure or I need to update something. Is it true that if somebody manages to hack it, then they can access only the webservices but not the whole local network like by hacking a normal VPN server? Are there any advantages / disadvantages I did not mention?

  • 2
    If somebody can hack a SSL encapsulated VPN, then what prevents them to hack an actual SSL connection? It's not about security. VPN over TLS is an obfuscation technique to hide VPN traffic from ISP's DPI. – defalt Dec 14 '17 at 11:44
  • @defalt What's your point? VPN is about reaching a local network through the internet securely. – inf3rno Dec 14 '17 at 11:54
  • 2
    SSL VPN is a vague term which encompasses a variety of technologies (see wikipedia for more). Similar VPN also encompasses various technologies. Thus, it is unclear what you exactly mean with SSL VPN and what you mean with "normal" VPN. Which also means that it is not really possible to answer the question since it is unclear what exactly you are talking about. – Steffen Ullrich Dec 14 '17 at 12:37
  • @SteffenUllrich I think the difference is that a normal VPN uses IPSec and an SSL VPN uses SSL. On client side you can connect to an SSL VPN with a browser, so you don't need a dedicated VPN client app. I am far from being an expert in the topic though. – inf3rno Dec 18 '17 at 5:28
  • @inf3rno: it might actually useful to know the common meaning of the terms you are using in the question before asking a question. "...connect to an SSL VPN with a browser, so you don't need a dedicated VPN client app..." - this is only true for "VPN" where you can only access web applications. These are not considered a true VPN since it does not provide network level connectivity (note that the N in VPN stands for network). SSL based real VPN need a specific client - contrary to some "normal" VPN where the client is already build into the OS. – Steffen Ullrich Dec 18 '17 at 5:48

In general I don't understand why you want a VPN if you only want to access web services anyway. I mean if you don't want to access the local network why use a VPN? Just use a reverse proxy and htaccess, like this example.

Trying to answer the question:

Maybe you can add more information about what exactly you mean by SSL VPN and normal VPN. Using this SSL VPN definition the answer is probably not necessarily.

According to that website:

SSL VPN delivers the following three modes of SSL VPN access:

•Clientless—Clientless mode provides secure access to private web resources and will provide access to web content. This mode is useful for accessing most content that you would expect to access in a web browser, such as Internet access, databases, and online tools that employ a web interface.

•Thin Client (port-forwarding Java applet)—Thin client mode extends the capability of the cryptographic functions of the web browser to enable remote access to TCP-based applications such as Post Office Protocol version 3 (POP3), Simple Mail Transfer Protocol (SMTP), Internet Message Access protocol (IMAP), Telnet, and Secure Shell (SSH).

•Tunnel Mode—Full tunnel client mode offers extensive application support through its dynamically downloaded Cisco AnyConnect VPN Client (next-generation SSL VPN Client) for SSL VPN. Full tunnel client mode delivers a lightweight, centrally configured and easy-to-support SSL VPN tunneling client that provides network layer access to virtually any application.

But this only defines the access mode, so what the client does to access the VPN not what the VPN supports. So, it would depend on if your VPN server allows you to allow clientless mode only.

  • I wanted to do more than just webservices that's why I thought a VPN would be a good solution. Good point. – inf3rno Dec 14 '17 at 16:20
  • Hmm probably a VPN would be another layer of defense. But I think doing it with SSL would be a mistake because that uses the same encryption as HTTPS. Thanks for your answer! – inf3rno Dec 14 '17 at 16:44

First, as @Elias already said, you don't need to use a VPN for this case at all, no matter if "normal VPN" (whatever this is) or "SSL VPN" (no matter what of the several SSL VPN technologies you actually mean).

But, to get to the second part of your question:

Is it true that if somebody manages to hack it, then they can access only the webservices but not the whole local network like by hacking a normal VPN server?

The impact of hacking your specific web service is not clear. But hacking web applications often results in the ability to executing attacker controlled code at the server. This usually also means that the attacker now can access other systems reachable by the system running the web service and/or that the attacker might use privilege escalation attacks to gain administrative access to the system.

In summary: restricting the access by using a SSL VPN or port forwarding is not magically more secure compared to using a "normal VPN". But the attack vector differs.

Not the answer you're looking for? Browse other questions tagged or ask your own question.