I had an argument with a person a few months ago when I proposed we forward port 12xyz to an internal SSH server.

The target server was tied down in a manner similar to the one recommended by @stribika at https://stribika.github.io/2015/01/04/secure-secure-shell.html. Specifically, no root access, public key authentication only, non-standard ssh port, high-quality ciphers, kex, and, macs.

I was arguing that the forwarded port was not inherently dangerous in itself, and that the safety was dependant on the service at the target port. I maintained my method was a perfectly safe way to gain remote access. He vehemently argued that it was not, stating that a VPN tunnel is the only safe way to achieve remote access.

Who was right?

up vote 9 down vote accepted

Forwarding ports is NOT inherently dangerous in itself and YES the safety is dependant on the service at the target port. But safety also depends on how good is your router's firewall and how well it is protected, both internally and externally.

For remote access, both SSH and VPN works as good as each other. Neither is more secure than the other when similar levels of encryption are used. But since SSH works at application level, supports only TCP and provides remote access to a single computer only I would prefer VPN tunnelling which in fact works at the transport layer, supports both UDP and TCP and allows secure access to multiple resources.

VPN tunnel is NOT the only safe way to achieve remote access, but definitely the preferred way due to the above reasons. Not to mention SSH is really difficult to implement properly in case of multiple resources, can cause DNS leaks and has to be configured separately for each application.

  • Thanks, Joseph. In our situation, application-level tunnelling is preferable to transport layer tunnelling, which is why I wanted to use ssh in the first place. :-) Also thanks for your comments re DNS leaks. I'm reading about that now, but I see its possible to have DNS leaks even via a VPN connection. – Rhyven Mar 29 '15 at 11:29
  • 1
    Yes, DNS leaks are possible even with VPN tunnelling. Try DNSCrypt which is a protocol for securing communication between the client and DNS server. – Joseph Mar 29 '15 at 16:02

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.