Remote vs. VPN + Remote

Question

I am required to remote into my employer's Windows server for accessing certain programs for work. This server is on a network for which I have VPN access as well.

I was just wondering - from both a performance and a security standpoint - if there is a difference between logging into the remote server directly via its public IP address, versus logging into the VPN and then logging into the remote server via its private IP address.

The server is Windows Server 2012 R2, and my local machine is Windows 7.

Answer 1

The routes the packets would go should be the same or similar either way. So no performance difference that I can see, though if you notice a difference then you can overrule that estimatation.

If your "remote viewing"(or as it's more commonly known, desktop sharing) is done via remote desktop, that's encrypted. If it is done via some free VNC then it can be encrypted by going through SSH.

And if it is done within a VPN then that is encrypted. So there you go.. If you do it via a VPN then it's encrypted once by the remote desktop program itself, and once by the VPN. So it's encrypted twice. But i'm sure even just one encryption is fine.

And in both cases you have to have a server running.. I don't think that many use remote desktop server over the Internet perhaps for fear of its security. I just googled and read this https://technet.microsoft.com/library/security/ms12-020 So remote desktop has had that security issue. You could run remote desktop through SSH then it's more secure. An additional advantage of running servers through SSH is you only need to open one port on your NAT router.

I'm not aware of security issues with VPNs...though I haven't looked into it much, but this thread https://serverfault.com/questions/289552/is-a-pptp-vpn-too-insecure-to-consider-using doesn't mention any problem with VPNs but suggests OpenVPN as pretty secure.

So, in summary, i'd think that remote viewing through SSH, vs over a VPN, is the same in performance and security.

Desktop sharing can be secure in the sense of encryption e.g. windows remote desktop uses encryption, but it looks like it has been exploited before, so is perhaps not that secure in that sense. So remote viewing as it is, without something strongly secure, like SSH or a VPN, may be more likely to be exploited.

I'd note though there was a scare where even SSL got exploited.. So it may be worth checking the news from time to time even with SSH and VPNs.

Answer 2

First off, if you can Remote Desktop in to a business without a VPN, then you should bring it to their attention. That is a rather large security risk. Internal services, such as Remote Desktop, ideally should only be accessible via a VPN. Only services that are being offered to the public should be accessible through the firewall. This includes services such as http, ftp, etc...

Now is there a difference between using RD through a VPN or not. The answer is yes. The VPN encrypts the traffic over the tunnel so that if someone intercepts the traffic, they can not interpret it. This does slow down the speed of the transfer. Will it be noticeable? It depends on the bandwidth and latency of your connection and the VPN itself. If connecting directly feels quick, a VPN should not add so much overhead that you would notice the difference. If you do, the VPN is probably not configured properly.