Early this year, CERN IT department announced the availability of a pilot CERN VPN service, which allows users to securely access CERN resources from outside the CERN network. Someone reached me based on my previous post about CERN SSH 2FA, and asked if I would be interested in trying out the CERN VPN. I was intrigued by the opportunity to test a new service that could potentially improve my remote access to CERN resources, so I agreed to give it a try.

I just want to mention thatwhen I wrote the previous post, I was not based at CERN but now most of my work is done at CERN, so I didn't have much need for a VPN. However, I thought it would be a good opportunity to try it out and see how it works.

The official name of the service is "CERN eduVPN" and it relies on the open-source eduVPN software, which is developed by the GÉANT Association funded by the European Commission. The CERN IT department has set up their own eduVPN server and we can use the eduVPN client to connect to it. The eduVPN client is available for Windows, macOS, Linux, iOS, and Android, so it is compatible with a wide range of devices.

To join the pilot program, it is very easy, you go to CERN Computing Resources portal and subscribe to the "EduVPN service". After subscribing, you will need to wait a couple of minutes. Then you can download the eduVPN client and install it on your device. Once you have the client installed, you choose the institution you want to connect to. You pick CERN and then you will be prompted to log in with your CERN credentials. After logging in, you will be connected to the CERN VPN and you can access CERN resources as if you were on the CERN network.

The direct benefit of using this service is that most of the time if you are in CERN network, you will need repeated 2FA authentication to access lxplus (and other ssh connections). Which you can also have outside the network using the VPN. So it is a good way to avoid the repeated 2FA authentication when you are outside the CERN network.

The only caveat is that although the eduVPN server supports split tunneling, it is not available for us. So all the traffic from our device will be routed through the CERN VPN when we are connected. This means that if you are using the VPN, all your internet traffic will go through CERN's network, which may have some performance implications.

However, in my experience, the performance has been quite good and I haven't noticed any significant slowdowns. Also I will not feel comfortable to have all my traffic routed through CERN's network outside the work, so I will only use the VPN when I need to access CERN resources and disconnect it when I am done.

One useful secondary use of using it is that it gives me different IP address that the one DHCP server assigns to my device when I'm connected directly to the CERN network. This is in particular useful for me because many times my university computing cluster blocks my access for some time (usually if I enter wrong password and it is very aggresive in blocking my access for a increasing time), and I can use the VPN to bypass the block and access the cluster

Overall, my experience with the CERN VPN has been positive. The setup process was straightforward and the performance has been good. It is a useful tool for securely accessing CERN resources from outside the CERN network, and I would recommend it to anyone who needs to access CERN resources remotely.