After Decryption: Which Policy Sees Your VPN Traffic First

A VPN flow can be perfectly encrypted, perfectly authenticated, and still land somewhere nobody planned. The cable you plug in does not determine which rule processes the inner packet; the policy hook and the route do. Two designs that look identical on a rack diagram can therefore have completely different enforcement. Deciding between them starts with naming the control that sees the decrypted flow first.

Decide by the policy hook, not the port you plug into

Every VPN platform evaluates decrypted traffic at some point before it forwards it, and that point has a name in the configuration. On one platform it is a group policy filter, on another an interface policy or a zone pair, and on a routed appliance it may simply be the forward chain. The hook is what enforces the rule, while the switch port is only where the cable terminates. Finding the hook is the first decision, because everything else is placement relative to it.

Before looking at hardware, write the flow down: who the source is, where it is going, which protocol carries it and which service is allowed. Then find the control that enforces each of those four facts.

Two paths, two different enforcement stories

Two shapes are common, and each can be correct for a different requirement.

endpoint -> shared inside subnet -> server
endpoint -> dedicated transit -> policy firewall -> server subnet

The first shape can enforce everything it needs to at the gateway, provided the gateway policy is written for that destination and the server has no path around it. The second shape adds a boundary, but only if the routes and the policy actually make traffic traverse it. A server sitting on the same segment as the endpoint may never follow the imagined intermediate hop. The diagram shows intent, and the routing table shows what happens.

Verify with a route lookup rather than with the drawing. The interface a packet leaves by, and the next hop it selects, decide whether the second shape behaves as designed.

ip route get 10.30.7.20
sudo iptables -S FORWARD
sudo tcpdump -ni inside0 host 10.30.7.20

Separate topology from isolation

Sharing a subnet does not make a place untrusted, and a dedicated transit does not make it protected. What decides is the restriction actually applied, the forwarding that actually happens, and who administers each piece. Counting switches tells you nothing about any of the three. Decide from the policy and the route, then let the topology follow the decision.

Treat traffic populations separately as well. Remote-access pools, site-to-site prefixes and private-line networks can share one appliance and still need different rules, because their identities and their risk differ. A rule written for one population silently covers the others whenever they share an address plan.

Check failure and management for each placement

Every placement has a failure mode, and the useful question is what still works when a component stops. Several logical interfaces on a single dead appliance give you no independent recovery, and a downstream firewall sharing the same power feed or the same administrator is not a second boundary. Ask where the management path runs, because a console reachable only through the tunnel is not a recovery path at all; ssh [email protected] true from outside the tunnel is the cheapest way to prove the console does not depend on it. The group policy documentation for one platform places its filter on post-decrypted and pre-encrypted traffic, which is exactly the kind of named hook to look for in any product.

Write the failure story for each candidate beside the enforcement story. A placement that wins on inspection and loses on recovery is a trade, and it should be recorded as one rather than discovered during an incident.

Accept with an allowed flow and a denied one

With an approved test plan in hand, check three things from the real VPN source: an application that should work, a resource that should not, and the direction the reply comes back on. The denial is the evidence that the policy is engaged, while the allowed flow only proves a path exists.

Preserve the selected path and the policy result together, because a result without the path cannot be reproduced and a path without the result cannot be defended. That pair is far more useful for choosing an attachment point than any claim about which layer of switching is inherently safer.