4

I was looking at the features of the Asus RT-N66U router and noticed the built-in VPN feature. I am currently running an OpenVPN server on an ESXi VM, but I was wondering: would using the VPN feature on a router be more secure? After all, this way you wouldn't have to do any kind of port forwarding to the internal network, right?

Or perhaps, security-wise, there are no differences between the two approaches?

Improve this question

2 Answers 2

Reset to default
2

It depends; there are about three things you must consider:

  • Does the software provided meet your needs (security and performance)?
    • Since you're using OpenVPN Server on ESXi, you'd probably be fine using OpenVPN Server on a pfSense firewall. IPSec VPN on that same pfSense box would also probably work for you, if you know how to configure it correctly.
    • The specific consumer router you listed appears to have PPTP VPN, which may or may not meet your needs.
  • Does the software contain known vulnerabilities as first obtained (installed or bought)?
    • This is always a "check current news" item.
    • So, you must ask - where can you find such news for a given product, i.e. how would you know?
      • Forums?
      • Contact the maker?
      • CERT?
  • When a vulnerability is found in the future, how will it be addressed?
    • Some vulnerability will be found, at some point in the future. Such is the way of code written by humans.
    • Look at past performance: how well has a given maker addressed the recent big bugs, like Heartbleed and Shellshock, etc.?
      • On their current products?
      • On their older products? Look for a product about as old as you hope to keep this one; see how they handle updates and patches.

My gut instinct is that serious firewalls will be quite good at handling all of these with their built-in VPN's, if they either have free maintenance or you buy the support plan, and the consumer grade stuff will not be kept up to date.

As far as port forwarding to the local network, you are correct; my pfSense installation simply asks which interface (WAN, in your case) to open the specific OpenVPN server port on. However, I'd be hard pressed to see opening a single port for UDP only (or TCP only), to a single internal address which runs OpenVPN as a significant security flaw; this is, after all, what you use a firewall for.

Improve this answer
2
  • Fair enough, but one question: how would you use a firewall to improve security in this case? After all, the OpenVPN port is open, what would you filter on?
    – user1301428
    Jan 1, 2015 at 11:24
  • @user1301428 The OpenVPN port doesn't have to be open to everyone (at least not on a rules-based firewall/router). You could use very simplistic filtering to only allow certain IP address ranges access (for instance, the IP addresses you expect to be on). You could put time limits on the rules. You might have access to more advanced rules, like guessing at the source agent, or use Layer7 filtering to only allow OpenVPN traffic over that port, not http or https. You could then go to IPS/IDS type solutions (with pfSense, Snort or Suricata) or even just pfBlocker to impede some threats more.
    – Anti-weakpasswords
    Jan 1, 2015 at 18:56
-1

The main difference between the two approaches security wise is that when your router takes all communications and then tunnels them to the VPN you shouldn't have to worry about leaks and some applications not routing through the vpn like you might with just having a vpn on your client machine.

A suggestion I would make would be purchase 2 different VPN services from 2 different VPN providers and then have one act as the vpn for the router and then connect to another vpn with your client side software, thus giving you an additional layer to route through, I'm not sure whether your main concern is security or anonymity but this will most certainly help with both.

Improve this answer
6
  • I don't think this is what he's asking about. He seems to be setting up a VPN server, to use a VPN to connect to his own network.
    – cpast
    Dec 31, 2014 at 22:49
  • Either way it would still work, whether it be a server or his client side software.
    – CPagan
    Dec 31, 2014 at 22:52
  • Purchasing VPN services isn't actually relevant to this situation, and there is absolutely no reason to use VPN-inside-VPN here (you don't nest VPNs connecting you to the same network, because there's no point to doing that). Likewise, the client would not be behind the router, so router vs. separate box has no effect on whether things are routed through the VPN.
    – cpast
    Dec 31, 2014 at 22:54
  • @cpast that's correct, I am using a local VPN server at the moment and was thinking about moving it on the router
    – user1301428
    Dec 31, 2014 at 22:59
  • He asked which method is more secure, His reasons for needing a VPN in the first place are not provided, I didn't offer advice on how to buy a vpn service I simply suggested that VPN inside VPN would be more secure as it relates was his original question.
    – CPagan
    Dec 31, 2014 at 23:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .