3

We are thinking about using VPN to connect our remote office and the main office and also support developers working from home. To do this, we are planning to purchase 2 CISCO (or similar) routers to connect via IPsec. Our CEO is very much concerned about this setting. He feels that enabling VPN on routers puts our entire network at risk of being exposed to the outside network.

So, my question is:

  1. Is using VPN (IPsec) on CISCO router less secure than our current VPN settings? This is how our VPN is setup now:

Our current VPN setting. VPN server is in our LAN environment has SSH tunnel open to outside Linux server.

  1. So, when a remote worker connects to our VPN, first, he/she has to open an SSH tunnel and start VPN client to make connection. This is not terribly difficult but sometimes tunneling fails and we have to reopen tunnels manually. Also, because it has to go throw SSH encryption/decryption process, it is slower. Basically our CEO wants to have our VPN server outside of our LAN so that people can't connect to make connection to internal network. Is this really more secure?

When our user connects to our VPN server, he/she has to open a SSH tunnel first and then open a VPN session

Thank you.

Update: Thank you for your comments. Please see below for my answers:

You do or do not currently have a VPN setup? – raz Jun 11 at 11:50

We do have OpenVPN setup as described in the diagram above. The problem is that we need to create SSH tunnel first to the intermediary server and make OpenVPN connection through SSH tunnel. This is OK but it is pretty annoying since we need to use 2 different programs.

Your question is very unclear from what i can gather is your CEO expects you to connect to a vpn which will push invalid routing routes which will block internal network access?

No. My CEO doesn't want to forward a port to our VPN server (which is located inside our NAT) from our router. He thinks this can be a security risk.

or is it that your CEO has a current vpn where your internet connection gets routed and you can currently access pc's on the network.

Our VPN is setup as I described above and is working fine now. But, I want to find a better way implement VPN. With our current settings, VPN users have to, first, create SSH tunnel to the intermediary server and then make VPN connection through the SSH tunnel. This works but it requires 2 separate programs to use VPN and it's quite annoying. What I want to know is that if we decide to use a CISCO router that supports VPN, is it less secure than our current setting in any ways?

Your CEO wish's to exclude pc's at the office from the vpn.

No. He just doesn't want to add a port forwarding rule to our router. He thinks adding a port forwarding rule to our router increase the risk of our network being expose to the outside network (WAN).

So people connecting from outside network cant access internal pc's?

No. Our VPN users can connect to our internal PCs. This is not an issue. I just want to know if using a CISCO router with builtin VPN support is less secure than our current settings.

– Tim Williams Jun 11 at 13:18

Thank you, Tim.

closed as unclear what you're asking by RoraΖ, Stephane, Steve Dodier-Lazaro, Bob Brown, schroeder Jun 11 '15 at 16:05

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • I'm a little confused. You do or do not currently have a VPN setup? – RoraΖ Jun 11 '15 at 11:50
  • Your question is very unclear from what i can gather is your CEO expects you to connect to a vpn which will push invalid routing routes which will block internal network access? or is it that your CEO has a current vpn where your internet connection gets routed and you can currently access pc's on the network. Your CEO wish's to exclude pc's at the office from the vpn. So people connecting from outside network cant access internal pc's? Please add some more detail or modify your question it is very unclear – Tim Jonas Jun 11 '15 at 13:18
  • I answered your questions. Thank you for your comment. – Andrew W. Chang Jun 17 '15 at 9:11
  • I still don't get why you need to double encrypt your connection with SSH + VPN. If your CEO does not trust the security VPN provides, then why do you use it at all? – inf3rno Dec 7 '17 at 10:40

Browse other questions tagged or ask your own question.