I have a web service (PHP & MySQL on Ubuntu 12.04) running in a corporate intranet. I have also connected it to internet through a firewall letting incoming connections on HTTPs only (port 443). I'm considering now to add VPN over it to add additional security level, to open VPN ports and close HTTPs. That seems to be more secure but more inconvinient for an end user too. Users will be loginging from ther PCs, tablets and phones using a VPN client to access the web service and the their login and password to access their data.
As I understand it adds additional login/password pair to the authentication process and basically that is the only advantage. Of course such a set up adds IPSec encryption but I don't think VPN encryption is a useful feature here as the traffic already encrypted with HTTPs.
In a VPN case a malicious user would scan a server for open ports, find the VPN ports open and start to brute force VPN user access credentials before he can start to brute-force/code inject the actual web service.
But if I would just need another login/password pair I can just make a double-step authentication process on the web service instead of bothering users with a VPN client set up.
So it seems like a VPN pros in my case are: Additional authentication step using a VPN client IPSec encryption Everybody think you are safe
VPN cons are: Additional authentication step which adds complexity for the users Useless encryption of already encrypted HTTPs traffic VPN user get access not only to the web service but to the entire sub network so extra equipment needed to put the server to DMZ.
Am I wrong on any of those points? Would a VPN really add more security in my case or it will give more unnecessary complexities instead without really adding anything useful?