Boss wants to use 3rd party vpn like nordvpn for users accessing email instead of our Sonicwall

VPN
1

We have sonicwall vpn for accessing work resources offsite. Its a pretty standard affair but my boss wants to have people who connect to Public Wifi (most commonly would be our salesmen) to have VPN. He wanted me to source another VPN solution like nord/express/ect stating that he doesn’t think we want them connecting to our vpn just for accessing email. So I have a few questions.

  1. How well does a 3rd party vpn play with a work vpn like a sonicwall vpn
  2. If its just security for when accessing email is 3rd party more secure or would sonicwall be more secure.
  3. Any vpn recommendations that work well on Apple phones, especially for very non-tech savvy users.

Edit: Thanks for the replies everyone. At this point im gonna look into implementing MFA on users as we have O365 and the infrastructure is already there for that.

2

I’m assuming you mean hosted email like Microsoft/Google as self-hosted email would already be accessible using the Sonicwall’s VPN.

Either way, this is one of the main use cases for SASE products.

Consumer VPNs have uses, but corporate remote access isn’t one of them.

3

Maybe I’m missing something here, but why do you need a VPN connection to access email? Shouldn’t that be globally accessible for your users?

4

This is complete nonsense. Your boss has seen too many youtube commercials for NordVpn, it seems.

5

If sniffing and manipulating traffic on a public hotspot is like shooting fish in a barrel, public VPN services are like factory sized fish trawlers.

6

How are they accessing email? Why are they still using an archaic method that doesn’t already encrypt the connection between the workstation and the email server?

7

Could you broaden your existing SonicWall VPN to be ‘always on’ for your users? Wherever they are they automatically on the VPN for everything they do?

You could use split-tunneling to specify certain bandwidth-hogging apps or online meeting apps (Zoom, Teams, etc) to go outside of the tunnel to save you bandwidth/from performance issues.

8

Ah, the Saw It In an Inflight Magazine boss

9

If you allow connections from a public VPN service (that anonymizes) how will you defend against bad actors using that same public VPN to hack into your email system?

Your boss is wrong and need it explained that this is what the corporate VPN is for.

10

NordVPN is marketed towards consumers who want to bypass country restrictions to access online content. It’s not a solution for securing company data. Additionally you don’t need to secure traffic between the client and exchange server. SSL already does that. Nobody is realistically hacking your exchange server because you’re specifically on public wifi.

11

Why not 3 VPN’s. That would be like 9 times as secure /s

12

I think I’m missing something: why can’t the users just use the Sonicwall VPN through Public Wifi?

13

These are not the VPNs you’re looking for…

14

Why not just install Tor Browser on everyone’s machines and call it a day? It’s super secure!

15

Is there a subreddit for when managers get ideas\go to con’s?

16

Are you experiencing issues that you are trying to solve?

A 3rd party VPN is an expense and doesn’t yield any benefit for talking to your mail server. In fact, it’s better your mail server knows where you are coming from and not from a Nord node somewhere.

17

Sounds like your boss got excited over a Nord VPN ad and is trying to find a problem where none exists.

You already have a Sonicwall VPN for security when accessing email in public spaces that employees should be able to use.

18

Those VPNs offer zero security benefit. they’re only useful for netflix and torrents

19

You can get a hosted business VPN, yes. Remote workers connect to the hosted VPN. You can set up tunnels between the hosted service and your offices if required so remote workers can connect to on-prem systems (be aware that implicitly trusting anything VPN-connected without further authentication is a risk), but traffic to the internet goes to the service providers systems and then onto the destination without loading your office connections.

It provides an extra layer of security that may not be strictly necessary, but I’ve seen insurers and certification that like to see everything VPN-encrypted. (Or at least, that if everything is VPN-encrypted then some other requirements get relaxed.)

You can do it SaaS with a VPN provider such as Nord, or you can do it IaaS on generic hosting such as Azure, whatever works best for you.

20

Those are IP obfuscation tools, not point to point encrypted tunnels.