I'd like to reach some webservices on my home microserver when I am not at home. Since I don't want to reach other services like SMB, SSH, etc. I thought it might be better to use SSL VPN with a self-signed cert I would add to my client computers manually before using the webservices. Afaik. there are SSL security testers like comodo, so it will be much easier to check whether the VPN is secure or I need to update something. Is it true that if somebody manages to hack it, then they can access only the webservices but not the whole local network like by hacking a normal VPN server? Are there any advantages / disadvantages I did not mention?
closed as unclear what you're asking by GdD, Polynomial, John Deters, Rory Alsop♦ Dec 22 '17 at 12:59
Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
In general I don't understand why you want a VPN if you only want to access web services anyway. I mean if you don't want to access the local network why use a VPN? Just use a reverse proxy and htaccess, like this example.
Trying to answer the question:
Maybe you can add more information about what exactly you mean by SSL VPN and normal VPN. Using this SSL VPN definition the answer is probably not necessarily.
According to that website:
SSL VPN delivers the following three modes of SSL VPN access:
•Clientless—Clientless mode provides secure access to private web resources and will provide access to web content. This mode is useful for accessing most content that you would expect to access in a web browser, such as Internet access, databases, and online tools that employ a web interface.
•Thin Client (port-forwarding Java applet)—Thin client mode extends the capability of the cryptographic functions of the web browser to enable remote access to TCP-based applications such as Post Office Protocol version 3 (POP3), Simple Mail Transfer Protocol (SMTP), Internet Message Access protocol (IMAP), Telnet, and Secure Shell (SSH).
•Tunnel Mode—Full tunnel client mode offers extensive application support through its dynamically downloaded Cisco AnyConnect VPN Client (next-generation SSL VPN Client) for SSL VPN. Full tunnel client mode delivers a lightweight, centrally configured and easy-to-support SSL VPN tunneling client that provides network layer access to virtually any application.
But this only defines the access mode, so what the client does to access the VPN not what the VPN supports. So, it would depend on if your VPN server allows you to allow clientless mode only.
First, as @Elias already said, you don't need to use a VPN for this case at all, no matter if "normal VPN" (whatever this is) or "SSL VPN" (no matter what of the several SSL VPN technologies you actually mean).
But, to get to the second part of your question:
Is it true that if somebody manages to hack it, then they can access only the webservices but not the whole local network like by hacking a normal VPN server?
The impact of hacking your specific web service is not clear. But hacking web applications often results in the ability to executing attacker controlled code at the server. This usually also means that the attacker now can access other systems reachable by the system running the web service and/or that the attacker might use privilege escalation attacks to gain administrative access to the system.
In summary: restricting the access by using a SSL VPN or port forwarding is not magically more secure compared to using a "normal VPN". But the attack vector differs.