SO as a web gateway for VPN clients in the cloud?

[ben-sec]

Hello!

Did anybody setup a SO forward node at AWS as a kind of "web gateway" for mobile VPN clients (with a manager node on prem)? My goal is to monitor the Internet traffic of our VPN clients without sending all the traffic back to our local data centre. To complicated? Just brainstorming ...

Cheers, Ben

[ben-sec]

Hi everybody!

I never got feedback on this idea. Stupid idea? Any other thoughts on how to monitor the traffic of home office employees?

Cheers, Ben

[InfosecGoon]

If your VPN clients are connecting to a VPN gateway in AWS, this would be feasible -- just use virtual port mirroring to clone the traffic from the inside interface of the VPN device to the monitoring interface on an SO sensor. You'll be charged download fees to push the Zeek and Suricata data from the AWS sensor down to an on-prem manager, but that shouldn't be a significant amount of traffic.

Keep in mind if you haven't done an AWS deployment before that the traffic you're seeing will be encapsulated via VXLAN, so while the tools do support it, investigation and threat hunting on the data from AWS will have some wrinkles in it as you'll need to distinguish between the VXLAN tunnel IP of traffic and the internal "actual" IP.

Another option might be to look into what sort of telemetry you can get from the endpoint agents that you've deployed to these clients and whether that would be sufficient for your use case.

[ben-sec]

Thanks, that helped!