We are thinking about using VPN to connect our remote office and the main office and also support developers working from home. To do this, we are planning to purchase 2 CISCO (or similar) routers to connect via IPsec. Our CEO is very much concerned about this setting. He feels that enabling VPN on routers puts our entire network at risk of being exposed to the outside network.
So, my question is:
- Is using VPN (IPsec) on CISCO router less secure than our current VPN settings? This is how our VPN is setup now:
- So, when a remote worker connects to our VPN, first, he/she has to open an SSH tunnel and start VPN client to make connection. This is not terribly difficult but sometimes tunneling fails and we have to reopen tunnels manually. Also, because it has to go throw SSH encryption/decryption process, it is slower. Basically our CEO wants to have our VPN server outside of our LAN so that people can't connect to make connection to internal network. Is this really more secure?
Update: Thank you for your comments. Please see below for my answers:
You do or do not currently have a VPN setup? – raz Jun 11 at 11:50
We do have OpenVPN setup as described in the diagram above. The problem is that we need to create SSH tunnel first to the intermediary server and make OpenVPN connection through SSH tunnel. This is OK but it is pretty annoying since we need to use 2 different programs.
Your question is very unclear from what i can gather is your CEO expects you to connect to a vpn which will push invalid routing routes which will block internal network access?
No. My CEO doesn't want to forward a port to our VPN server (which is located inside our NAT) from our router. He thinks this can be a security risk.
or is it that your CEO has a current vpn where your internet connection gets routed and you can currently access pc's on the network.
Our VPN is setup as I described above and is working fine now. But, I want to find a better way implement VPN. With our current settings, VPN users have to, first, create SSH tunnel to the intermediary server and then make VPN connection through the SSH tunnel. This works but it requires 2 separate programs to use VPN and it's quite annoying. What I want to know is that if we decide to use a CISCO router that supports VPN, is it less secure than our current setting in any ways?
Your CEO wish's to exclude pc's at the office from the vpn.
No. He just doesn't want to add a port forwarding rule to our router. He thinks adding a port forwarding rule to our router increase the risk of our network being expose to the outside network (WAN).
So people connecting from outside network cant access internal pc's?
No. Our VPN users can connect to our internal PCs. This is not an issue. I just want to know if using a CISCO router with builtin VPN support is less secure than our current settings.
– Tim Williams Jun 11 at 13:18
Thank you, Tim.