I know the title is an oxymoron, but our manufacturer is based in China, so I need to get as much information as possible so that management are aware of the risk/s and make this as air tight as possible.

I am working for a small startup with significant IP concerns and curious as to others experiences with setting up site-to-site VPNs in China, especially with these IP concerns in mind.

From what I can tell so far, in regards to just getting the VPN working/not blocked, the best and most reliable way to get around the GFW is to have a Chinese company register an IP address with the Chinese administration for VPN purposes. Luckily, we are working with a company in China who has significant presence within the government - on the flip side, that brings up further anxiety inducing questions on their agenda but that might just be the paranoid NetSec mind talking.

In regards to the VPN itself, we have Sophos XG firewalls - I am intending on using SSL with AES-256-CBC encryption, SHA2 512 authentication with a 2048-bit key. Are there any inherent concerns with this configuration?

  • Are you sure it's SSL and not TLS? If it is SSL, well SSL is broken and should no longer be used, use TLS instead. Is your main concern really the communication channel and not access control of those using the VPN? – Jeroen Mar 4 at 10:51
  • @Jeroen-ITNerdbox I said SSL simply because that's what Sophos calls it, even though it is using TLS. Thanks for the heads up though, I double checked and it's connecting with TLS1.0. Time to fix that and disable TLS1.0/1.1. I'm not sure I totally understand your second question though. Being S2S, access control will be handled on either end of the site? At this point, my main concern is that our IP is as safe as possible, I would have thought that making sure that our traffic is safely encrypted and difficult to spy on is pretty high up there in China. More than happy for extra input! – ParanoidNetSecGuy Mar 5 at 4:02
  • What I meant with the second question is, are there no concerns regarding who can access what on either side of the tunnel. Based on your reaction, I now understand you are concerned about the Chinese government. The thing is, there are easier ways to retrieve intellectual properties. Think about firmware back doors or hard coded credentials in any of the used devices. Protecting against a government is quite challenging if not impossible. – Jeroen Mar 5 at 6:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.