If a server uses public/private key authentication to access SSH, will there be any advantage of restricting the access of SSH over VPN? This link describes both approaches to solve brute force attacks but would one have an advantage against the other (Security-wise) and would the combination of both have any advantage or would it just add useless complexity?

  • 1
    In regards to your first question about the advantage of SSH or VPN, I think the article you referenced explains the advantage. If you use SSH, the port will have to be open to allow connections, authorized or not. To prevent unauthorised connections, a firewall rule set can be put into place to allow connections only from specific and authorised IPs. The advantage of using a VPN instead is that you eliminate that open port completely from external connections.
    – user79331
    Jul 1, 2015 at 8:59

2 Answers 2


SSH and VPN provides basically the same encryption mechanisms. Let’s imagine they both provide the same security, and you configured them well. If an attacker is able to decrypt your VPN communication in a reasonable time, it probably means that he can do the same thing for SSH in roughly the same time.

So, you did doubled your defence, but at a relatively high cost (you could have done better using a longer key for example).

Defence in depth is a good thing ; but I think that here it would be trying to double your defence at the same level, so my advice would be to focus on one of the solution (probably SSH if your are remotely login to one server only, VPN you want to connect to a network) to know and configure it well. A good defence in depth may consist in a firewall, fai2ban (as mentioned in the article)…


It is not currently possible to bruteforce an SSH connection using only keys-based authentication. A VPN on top of an SSH connection does not therefore add substantial security.

It would be better to concentrate on reducing the collateral effects of bruteforce attacks on your SSH connection (DoS and logs trashing would be the top ones), which is described in the article you linked.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .