Are VPNs on the way out?

[BJG]

I've recently been asked to arrange VPN access for a couple of Macbook users, which is proving difficult; I haven't yet managed to get them to cooperate with the protocols like IKEv2 and MS-CHAP that have been set up for Windows users. But with the increasing adoption of cloud services like OneDrive, Sharepoint, Azure etc., I'm wondering if VPNs are on the way out anyway. I've been browsing articles like this one.

 

"One of my clients had VPN access for staff (it's a small school), we disabled that about 3 years ago. No one has remote access to on-prem (except for me and I don't use VPN) but they all get by through storing their files in OneDrive for Business, and of course they have access to Teams and email from anywhere (Office 365)."

 

No doubt VPN is still useful/essential for some things, but these Mac users only want access to a shared folder, so I'm thinking VPN probably isn't the best way forward anyway...? We're just starting testing OneDrive as a substitute for personal network folders, and I guess shared network folders would ultimately be replaced too, eg by Sharepoint sites...? (Sharepoint on-prem is widely used here, recently started looking at Sharepoint online.)

 

I guess I'm wondering if anyone here has moved away from VPN towards cloud-based alternatives, and whether Teams sites are a future substitute for shared folders in the same way that OneDrive replaces personal network folders.

Edited July 14, 2022 by BJG

[TechMonkey]

I guess the question is, as ever, what do they want to achieve? If they need access to onsite resources or software, then VPN will be the only way to do it. Finance or HR team may have legacy application on site and need it to work from home (though if using a Mac I doubt it is either of them!)

If they just need access to documents, then I would encourage SharePoint or Teams migration. Currently doing the same process. Going to set certain network drives to read only so staff can retrieve documents but not update. Previous place we were completely moved to Teams and SharePoint except for finance and they were getting there.

[mavhc]

Yes, VPNs are on their way out, because we're moving to Zero Trust. Just because you're on the lan doesn't mean you should be privileged, therefore treat the internet and the lan the same. Put all your internal services on the internet....which sounds crazy, but put them behind a robust authentication system.

 

Device certificates, user certificates unlocked with passwords and MFA. Along with automated pen testing to make sure the configurations are always correct

[3s-gtech]

I agree that they'll become less necessary - but surely a VPN with certificate based auth is pretty secure? Yes, it's privileged once it's back on the LAN, but it was before. No way of getting onto that LAN without the certs.

[mavhc]

Problem is keeping track of who's allowed on and who isn't.

 

Certificates are easy, certificate management is hard

[dmj]

Not on there way out, just evolving. It's all VPN meshes for the future.

https://www.zerotier.com/

https://tailscale.com/

[3s-gtech]

Ah okay. Ours is device based - device can get on, user cannot. Both can be remotely terminated with prejudice.

[mavhc]

Tailscale uses Wireguard, and then adds key distribution and config on top of it.

 

Their linux client is open source, and handily: https://github.com/juanfont/headscale someone reimplemented their control server

[chazzy2501]

I've just started to use a VPN for my home use, I have a hybrid VPN on the router and all my clients go through that. (ultimately trusting the VPN rather than my ISP)

[dmj]

Tailscale uses Wireguard, and then adds key distribution and config on top of it.

 

Their linux client is open source, and handily: https://github.com/juanfont/headscale someone reimplemented their control server

 

All the good tech is free if you have time to implement it yourself

[Oaktech]

I would say yes, based on the fact that so many schools are working towards being fully cloud based with 0 onsite servers to VPN into.

[dmj]

I would say yes, based on the fact that so many schools are working towards being fully cloud based with 0 onsite servers to VPN into.

 

We're fully cloud bases (not in a school anymore) and still need to VPN into servers.... The problem doesn't disappear because you are using someone elses computers.

[Oaktech]

We're fully cloud bases (not in a school anymore) and still need to VPN into servers.... The problem doesn't disappear because you are using someone elses computers.

 

I'm not really a cloud guy, so I might be missing something...

 

The solution we are pursuing is serverless, in as much as there are no dedicated servers for our cloud tenancy - Devices provisioned in intune, storage in onedrive & sharepoint, Uniflow Online cloud printing, authentication by AAD. Nothing to VPN into unless you are talking about a VPN simply to shield your traffic from the Internet?

[mavhc]

You can have off site VMs, or offsite SaaS, or likely both

[Oaktech]

You can have off site VMs, or offsite SaaS, or likely both

 

But if you don't?

[mavhc]

But if you don't?

 

Then you're not using any internet services apart from the one from your school to the local POP, and you'd need a vpn anyway

[Oaktech]

Then you're not using any internet services apart from the one from your school to the local POP, and you'd need a vpn anyway

 

But this is what I'm asking - are you saying I should still be deploying a client VPN to shield my general purpose internet traffic?

 

I'm not connecting to anything other than a bunch of webservers?

 

Like I said, I'm really not a cloud guy, I can't stand it, but I'm being forced down the route by my MAT and I'm trying to understand why my thinking that with entirely cloud native a VPN is redundant unless we are trying to shield general traffic?

[TechMonkey]

But this is what I'm asking - are you saying I should still be deploying a client VPN to shield my general purpose internet traffic?

 

I'm not connecting to anything other than a bunch of webservers?

 

Like I said, I'm really not a cloud guy, I can't stand it, but I'm being forced down the route by my MAT and I'm trying to understand why my thinking that with entirely cloud native a VPN is redundant unless we are trying to shield general traffic?

 

When we had a redundant DC in Azure we connected via VPN so that the DC was part of the network and all traffic was secure between the VM and us. Not sure if this is what is being suggested or something else though

[mavhc]

But this is what I'm asking - are you saying I should still be deploying a client VPN to shield my general purpose internet traffic?

 

I'm not connecting to anything other than a bunch of webservers?

 

Like I said, I'm really not a cloud guy, I can't stand it, but I'm being forced down the route by my MAT and I'm trying to understand why my thinking that with entirely cloud native a VPN is redundant unless we are trying to shield general traffic?

 

People are using VPN to connect their LAN to their cloud servers, if you're using better protocols than ones that work for a LAN (CIFS, RPC, RDP etc), that are designed for the hostile internet, eg HTTPS and proper authentication, then no need for a VPN

 

Mostly a VPN is used because a) the protocols you want to use aren't routable, b) they're not secure.

 

Or you're forcing all traffic via your on site proxy, because it's still 2005 (ie you've not had a budget since 2005)

[Davit2005]

We are going to have need for a VPN for many years to come, many reasons for this. There are services we can provide in Azure WVD, services completely in the cloud/3rd party providers, services not feasible to allow external access to without a VPN, etc.

 

How does this go with accessing CCTV and other site systems that you don't want to expose to the internet?

Edited July 15, 2022 by Davit2005

[Arthur]

How does this go with accessing CCTV and other site systems that you don't want to expose to the internet?

Even CCTV is starting to go cloud-based. e.g. Verkada, Meraki MV

[ITGURU]

VPN for IT Staff only so can remote/fix issues from home, RemoteApp for everyone else

[dmj]

Even with 100% cloud services there will be situations where you'll need to run a service that doesn't need public access, or want to run another service through a different cloud provider to keep costs down, provide redundancy etc. VPN is still a good option, infact I'd go as far as to say its great option now that wireguard has got such mainstream support now.

[MatthewL]

Small businesses maybe no VPN but large coporates yes I would say there is a need.

 

Yes many things are internet first and NHS is abopting that policy but there are lots of things still need local stuff.

 

At the end of the day AoVPN & Direct Access just sit in the background and most users are unaware!

[nicholab]

Also MS passwordless authentication requires a vpn. Having worked for a cloud first organisation we had some issues with not having a vpn.