I'm currently developing software which requires various remote sites to securely connect to our servers to access a basic webapp.
Up until now, I've been working on a client/server VPN setup - it's certainly very secure, but there's a lot of difficulty involved with windows/linux connections, routing among client computers, and the need for extra client servers/hardware etc.
I'm now thinking that allowing SSL web access with a username/password would be acceptable if it was strictly restricted to authorized IP ranges - I would assume this setup wouldn't be secure, with ip spoofing etc, but I can't find anyone warning against it.
My question is how secure would this be? Is it possible for someone to spoof the client IP and manage to connect anyway? How would this compare to a VPN?