1

I'm getting set up to work from home and I have an existing cable internet connection with a router connected to the cable modem for my home computers. My work's IT dept says it's their policy not to connect work at home computers to a router; they must have their own stand alone connection and modem. I thought VPN was secure no matter if directly connected or connected to a router. They are suggesting I add a "business connection" separately for my work at home computer, but this is about 90.00 monthly and I've already heard my dept director is balking at reimbursing that amount of money a month. What gives?

1
  • 1
    If the IT department is that strict, then nobody can use a company's laptop to connect to the VPN from some hotel either?
    – Arjan
    Nov 1, 2009 at 10:22

8 Answers 8

5

I'm wondering if the IT fellow is confusing the types of VPN connections: station-to-station, point-to-point and point-to-station.

Basically, if you have two VPN routers, you can connect them together with a VPN tunnel. This gives you a "station to station" VPN connection, where it is possible to have all machines in both networks visible to each other. This would not be desirable in a business-to-home situation, but most home folks don't have VPN routers, either.

Creating a VPN tunnel from a PC using it's VPN software (i.e. using Windows to create a tunnel) gives you either point-to-point (i.e. PC to PC) or point-to-station (PC to VPN router) tunnels. This allows the PC to see either the other PC or the other network. This is the most common business-to-home scenario. It is also quite secure from the business side as only the initiating (home) PC is a part of the VPN tunnel.

I've done the latter (PC to business) many times as part of my work, and the business network is quite secure - even though I may have many machnines at home connected through my own router/switch network.

Cheers,

-R

2

Thanks for the input. I talked to the IT guy and told him I didn't have a separate connection yet, and could I simply unhook my router and let him hook directly up to my modem until I can get another connection. He said that was OK. I am wondering if I can simply hook back up thru my router when he leaves. Not wanting to be dishonest, but I happen to know several of my co-workers who are already set up at home have done this because they only have one high speed internet connection with multiple computers. Will that work, or can he somehow set it up to where it won't work that way? Also, I'm guessing they may be able to tell from their end if I do that, but I have no idea what they will do about it, if anything.

4
  • 1
    The IT guy is nuts if he things it is safer for you, or his network, when you are directly connected to your modem. Behind your router, only your other computers could do evil things to your computer. Connected the modem directly means anyone in the world could use your computer to abuse the work network.
    – Zoredache
    Nov 1, 2009 at 3:04
  • You should also tell him to look into MS's (or other vendor's) network health software. At MS, my computer is required to pass a series of checks that makes sure I am virus free, up to date on patches, have an active virus scanner and so on. I'm sure other companies (such as Cisco) have similar setups. Nov 1, 2009 at 5:13
  • 3
    Your IT guy is simply wrong. The VPN connection is encrypted between your PC and the work network, period. Passing through your home router makes zero difference, since all your router sees are encrypted packets.
    – CarlF
    Nov 1, 2009 at 5:28
  • Actually, I'd give some points to the ideas behind what the IT chap was saying - firstly, if he connects his work PC to his home router, he's exposed to a bunch of home PCs, family, etc. Potential for infection, that can then traverse the VPN to the work network. Having said that, it's not much worse than connecting to a public Wi-Fi hotspot, but who wants to do that? It all depends on what you assume the IT guy is trying to prevent.
    – Jeeva
    Jan 29, 2014 at 14:54
2

If you have your computer behind a router connected to the modem then the VPN traffic goes through your home network and router, then out the modem and then to the telecos dslam somewhere, then god knows where through the bowels of several ISP's networks until it gets to your work.

The point is if you eliminate that first hop inside your network, what have you really acheived? The traffic still goes through the public internet where anything could be happening.

A VPN is a way of creating a secure encrypted "tunnel" between two trusted points, over an untrusted network. Its your computer that does the encryption, not the router so if an attacker could somehow intercept the traffic on your home network then it wouldn't do them any good anyway.

2

Well, it's your house, your computer, your internet service, your home network. If they aren't happy with that, tell them that they can pay for new service, as well as provide a dedicated pc.

Seriously.

If your company is using, say, a Cisco router, then they should be providing you a Cisco VPN client that you can install on your pc. It should be configured to allow you to connect to your work network. The VPN client doesn't care if your computer is behind 1 or 1000 routers. As long as it can establish a connection, it's doing its' job.

IMO, either your IT person is misinformed or unknowledgeable, or else they have other undisclosed reasons for wanting you to directly connect to a modem. As others have stated, not being behind the router leaves you vulnerable to the whole internet.

2

The IT guy is sort of correct in that you definitely do not want to have all your private home internet going through their corporate system. However he is missing the point of a VPN. The idea is that it secures data between you and the corporate network when outside their offices, hotels, conferences, trains etc and home. If you hook up using a software VPN client on you PC then connect to their VPN host, it will work fine and just your PC will go though the tunnel. All other traffic, Kids, XBox, Wife/Husband's browsing will go out through normal channels.

1

The concern is probably the possibility of your home network affecting the corporate LAN (propagating a virus, for example) you're connecting to. They probably want a point-to-point between your work at home computer and no connection from it to your home LAN.

It's you vs. them. We had a similar policy at a company I used to work for and the common sense prevailed (ie. somebody they trusted explained it to them) and they lifted the silly restriction.

0

If the VPN is initiated from your machine, I do not see how having a different connection is any safer. Obviously it could stop man in the middle attacks / interception of VPN credentials if there is only one machine connected to the router/modem, however these are rare and I can't imagine it being a issue for many.

0

Another one of my coworkes says what they did is called the cable company and requested a "static IP address" for the work computer so as to satisfy requirements. I'm thinking that this will not really matter, security wise. I'm just wandering if they will know that I'm on a router instead of straight thru a modem.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .