Would the TCP port of a VPN with access to the VPC be considered as a "Server administration port" in CIS benchmark?

Question

I'm deploying an AWS Infrastructure that should adhere the CIS Benchmark.

I'm trying to understand if the TCP port of the VPN server that permits access to the VPC has to be considered as a "Server administration port" and thus the access must be allowed only from specified IP addresses as stated in

5.1 Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports (Automated)

5.2 Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports (Automated)

Answer 1

The TCP Port for a VPN is not what's meant as a remote server administration port. The rationale listed for 5.2 clear identifies these ports as 22 or 3389 (ssh or remote desktop protocol).

Public access to remote server administration ports, such as 22 and 3389, increases resource attack surface and unnecessarily raises the risk of resource compromise.

In other words, ports that allow a user to login remotely to administer the server.

Here's an example of how a TrendMicro tool identifies and remediates 5.1:

Check your Amazon VPC Network Access Control Lists (NACLs) for inbound/ingress rules that allow unrestricted traffic (i.e. 0.0.0.0/0) on TCP ports 22 (SSH) and 3389 (RDP) and limit access to trusted IP addresses or IP ranges only in order to implement the Principle of Least Privilege (POLP) and reduce the attack surface at the subnet level. TCP port 22 (Secure Shell – SSH) is used for secure remote login by connecting an SSH client application with an SSH server. TCP port 3389 (Remote Desktop Protocol – RDP) is used for secure remote GUI login to Windows VM instances by connecting an RDP client application with an RDP server.

That being said, if you are able to limit access to your VPN server you should (this isn't always possible). It decreases the attack surface. Decreasing your attack surface is never a bad thing.

Reference
TrendMicro KB ACL Inbound Access on Admin Ports

Answer 2

"Are only administrators allowed to connect to the VPN server?" If yes, the server have to comply with these checks. Else, creating a Virtual IP range on the VPN server dedicated only to administrators.

For the administrators VIP range, the access can be filtered by the IPs that can connect to it (static public IP of the company or ISP IPs ranges, or country IPs ranges).

The goal is to limit as much as possible the location(s) from where the server can be accessed especially for privileged tasks.