Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a site-to-site VPN between two offices. Office A hosts a web service that Office B wants to access. The web service is accesible from the public internet ( and on the internal network (http://webserver.domain.local).

Which interface's access going to be more efficient to use? Using the internal system looks quicker in a tracert because it's only two hops, but we all know that between the two VPN endpoints there's just as much routing going on as if I were using the public interface.

There's no pass-through authentication going on, so there's no advantage in NTLM or anything.

share|improve this question
Have you considered just running apachebench or some other tool to measure the difference? – Zoredache Aug 16 '10 at 6:02
@Zore - nope. I was in a hurry so I came and asked here. I guess I could just take your advice and do my job, but hey... – Mark Henderson Aug 16 '10 at 6:12
is the site any form of sensitive information or is the server running with old patches for compatibility? if not, i would just use public internet – Jimsmithkka Aug 16 '10 at 9:00
up vote 3 down vote accepted

I would guess that the public internet would be slightly more efficient only because you are not incurring the encryption overhead with the vpn tunnel.

You could probably use Firebug to get a more quantitative analysis of load times between the two options.

I would also take into consideration whether people pass links to the service internally. If they do you want to choose one - public or private - host name and stick with it throughout.

share|improve this answer
Hostname in use is irrelevant - I'm just hooking up a web-service descriptor. But good point re encryption. I've checked the load times and they're negligably different, but as Zoredache commented I'd be much better off putting a few thousand concurrent requests through to extrapolate the difference. – Mark Henderson Aug 16 '10 at 6:14

IMHO, the only reason you'd need to use a site-to-site VPN is if you want to protect your content from the outside world. The fact that your site is already publicaly accessible probably means you don't need the protection from a VPN. I would go the route of just hitting the public site directly. VPN incurs overhead (as Zypher mentioned) and putting your VPN through some form of benchmarking may overwhelm your VPN device and max out the CPU, which you may not want to do.

share|improve this answer
The service is HTTPS anyway, so it's still protected. Thanks :) – Mark Henderson Aug 16 '10 at 21:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.