VPN/Security questions

[jjscott]

Before I start, let me say that I’m a novice when it comes to building networks and even more so when it comes to VPN’s, so please bear with me.

I currently have a QNap NAS, Desktop and a variety of other devices connected to my home network and I would like to securely access their content remotely from my laptop & iPhone. I may provide access to a few friends for media streaming purposes. However, I am extremely paranoid about opening up ports on my firewall to achieve this goal.

The QNap device provides several web-based interfaces for access to their services like Multimedia Station, Download Station, iTunes Server, Web Server, etc. Once enabled, each one of these services will listen on a certain port for a request and will in turn serve up its content. I played around with this a little bit – configuring my router to forward the appropriate port to the listening services and it worked. I configured the NAS with a complex password and blocked all ip addresses except the one from my laptop. I even configured it to email me on Error and Warning conditions. Not long after I began forwarding/opening the required router ports, I started receiving warning emails stating that someone was trying authenticate on certain ports. They were denied, but would automatically try again x number of hours later. I’m guessing this was a BOT on a port scan.

My research has brought me to the idea of installing a new router (I need one anyhow) with VPN support to provide a secure connection. I know that some have opted to install OpenVPN on their NAS, but in my mind, access should be authenticated on the router/firewall and not on a device that sits behind it. The VPN solution I’m looking at provides SSL & client based configurations, as well as, VLAN support.

Now that we have got that out of the way, I have a few questions relating to VPN configuration and general functionality. First, do you have to open a port on your firewall to allow incoming authentication requests to the VPN even if it’s built-in to the firewall? If so, how is this any different than the scenario I listed above from a security perspective? I can currently configure my NAS to require a complex username and password for authentication. I guess what I’m asking here is what’s the security benefit of a VPN from restricting access? I know that a VPN provides encrypted sessions, but there are software solutions that will do the same thing.

Next, what happens if I’m remotely connected to my home LAN via a VPN session and someone at home wants to surf the web? Is there any conflict or special configuration that needs to happen? Does their connection get dropped?

That’s all for now. Sorry for the long-winded post!

 

[thiggins]

Good questions.

First, any open ports on a router will be probed within minutes, if not seconds of connecting to the Internet. It's the nature of the beast.

A VPN-gateway router works without requiring ports opened to your LAN. But the VPN gateway behaves like a server and will respond to probes and therefore attract the same attention.

If you use password-based (PSK) authentication you don't really gain any more security from using a VPN since it's just a matter of guessing the username / password combination. You would need to use certificate-based authentication, which can be difficult to set up.

You may be better off using a regular router that has the ability to restrict its open ports to specific IP ranges. This feature allows connection only from the IP range (or single address) specified.

A better bet it to put the media you want to share on cloud storage, so it's not on your LAN at all. This keeps you safe and doesn't tie up your up / downlink bandwidth.

If someone were connected via a VPN session, it has no affect on LAN users other than competing for your Internet bandwidth.

 

[jjscott]

Good feedback.

A few things…don’t you gain a certain level of security with a VPN by blocking port access at the firewall rather than allowing someone past it and an opportunity to probe around for listening applications and then attempting to authenticate? I’m just wondering if there is any benefit for a hacker getting past my firewall even though listening applications are locked down with complex passwords.

I know that you can use a client or clientless base authentication model for VPN connectivity. Wouldn’t a client base implementation provide a pretty tight level of security since someone would have to have your client installed on their system and know the username and password on your VPN router?

I’m not sure about this, but I would assume that the client install would be seeded with a device/router specific key before the user would even be able to attempt to authenticate on the VPN. This would prevent someone from downloading… say a Cisco client install and attempting to connect. Is this assumption correct?

You made a very interesting suggestion in regards to purchasing a router that would allow restricting access to open ports based on an IP range. What would a vender call this functionality or capability? I don’t remember seeing anything like this when researching a variety of routers, but then again, they may have listed it under some crazy acronym.

Thanks for your help! I really appreciate it.

 

[stevech]

re
better off using a regular router that has the ability to restrict its open ports to specific [incoming]IP ranges

what low cost routers/WiFi routers can do this?

 

[jjscott]

I'm not looking for a low cost router. I'm looking for one that fits all of my needs and I'm willing to pay for that functionality - within reason.

I am interested in hearing back from "tiggins" on the advantages of the VPN solution - specifically, the client vs. clientless based options.

 

[thiggins]

Yes, a completely open port through your router firewall is less secure than exposing a service that requires a login. But any exposed server is going to expose you to probes, so your passwords better be strong.

Some of our VPN experts may chime in here with better information. But my understanding is that any IPsec client can connect to an IPsec gateway using simple PSK authentication as long as it has the username and password. I don't believe that a certificate is involved.

In general, routers that have rule-based firewalls include IP ranges as part of the inbound and outbound rules. These usually are routers intended for small-biz use vs. consumer, such as:

NETGEAR FVS318G / FVS318N (Inbound service rules)
Cisco RV series.

One consumer router is the TRENDnet TEW-692GR (Inbound Filter)