I have a cloud-hosted server that I can Remote Desktop into. I have a web application that is hosted on this server via IIS. I also have a backend server on this same server that runs to get backend data to the web application. The data is transferred from the backend to the web app via HTTP and not HTTPS. The web application is not meant to be accessed freely via the internet like a normal website. It's meant to be accessed more like a local resource in an intranet. We do however expose some ports once connected to a VPN.

In order to access this web application, you need to be connected to a VPN and then do one of the following:

  • Connect to the server via Remote Desktop and use the browser on the machine to access the web application by navigating to the server's local IP address (essentially localhost) in the browser

  • Navigate to the server's local IP address using the browser on your own local machine.

My questions

  • What are the security implications of this architecture?
  • Is having the VPN acting as a gateway to the resource enough of a security measure?
  • Are there other things I should consider?
  • What advice do you have that would help make this application more secure?

1 Answer 1


Two problems here:

  1. Your VPN server should be in a DMZ and your Application server should NOT be in your DMZ. This allows you to lock down the ports / subnets that someone on the VPN server has access too and/or have an IDS / IPS inbetween your DMZ and the rest of your network.

  2. Having a head on your VPN server as well as running IIS on it seems like super super overkill when you could achieve the same end result through proper SSH port forwarding or dynamic tunneling ... w/ out the proccessing overhead of a full on desktop environment and web client to hit a webserver on the same box ... and then sending the content back as a RDP video stream. This is the equiv of putting a self address stamped envelope in a shipping container and hiring a professional moving company to get it to its destination.

  • 1. I understand why someone would do this for publicly facing application but in my case since its not a public application - more like a local resource - would this still apply? 2. I should have stated that there are other applications installed on the server that require a full desktop experience. But I get your point. Will consider this in the future. Thank you for your replies so far. Commented Apr 20, 2023 at 14:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .