0

This questions is somehow connected to this other one, where I asked whether it was better to have a dedicated VPN machine or to use the built-in VPN feature of the router when connecting from an external network to my home network.

Regardless of what approach is chosen, does it make sense to use a VPN when you are on the same local network of the VPN server?

I mean, obviously it makes more sense to use a VPN when you are on an untrusted network and you want to secure it, but is there any reason why you should force your local traffic through the VPN server even when you are on your local network?

1

In a corporate environment using a VPN for employees while they are on-site opens up some interesting possibilities. You might be able to organize them by group or role and assign them IPs from certain pools and then build network rules around those ranges. When someone from the Finance department connects, you can only allow their traffic to resources they should be able to access.

A VPN across the internal network would also encrypt all of the traffic from your end-user systems to the VPN device. If you had zero trust in your networking infrastructure (hubs and vulnerable switches where you thought people could be running tcpdump all day long) the VPN might mitigate that weakness (although, an attacker might be able to try all kinds of attacks to impersonate the VPN).

1

It all depends on what you want to secure against. VPNs are great when you want a secure channel in an insecure medium, but the definition of "insecure" is up to you.

For example, I know system admins who use VPNs to connect to resources that use plaintext credentials. The VPN hides the authentication process from the network. This type of thing is done in legacy environments.

So, yes, it does make sense, but only if the performance hit is worth it to provide the benefits of VPNs that you are looking for.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.