Route over the public interface or the VPN?

Question

I have a site-to-site VPN between two offices. Office A hosts a web service that Office B wants to access. The web service is accesible from the public internet (http://www.example.com) and on the internal network (http://webserver.domain.local).

Which interface's access going to be more efficient to use? Using the internal system looks quicker in a tracert because it's only two hops, but we all know that between the two VPN endpoints there's just as much routing going on as if I were using the public interface.

There's no pass-through authentication going on, so there's no advantage in NTLM or anything.

Answer 1

IMHO, the only reason you'd need to use a site-to-site VPN is if you want to protect your content from the outside world. The fact that your site is already publicaly accessible probably means you don't need the protection from a VPN. I would go the route of just hitting the public site directly. VPN incurs overhead (as Zypher mentioned) and putting your VPN through some form of benchmarking may overwhelm your VPN device and max out the CPU, which you may not want to do.

Answer 2

I would guess that the public internet would be slightly more efficient only because you are not incurring the encryption overhead with the vpn tunnel.

You could probably use Firebug to get a more quantitative analysis of load times between the two options.

I would also take into consideration whether people pass links to the service internally. If they do you want to choose one - public or private - host name and stick with it throughout.