My Experience with CERN eduVPN

Early this year, CERN IT department announced the availability of a pilot CERN VPN service, which allows users to securely access CERN resources from outside the CERN network. Someone reached me based on my previous post about CERN SSH 2FA, and asked if I would be interested in trying out the CERN VPN. I was intrigued by the opportunity to test a new service that could potentially improve my remote access to CERN resources, so I agreed to give it a try.

I just want to mention thatwhen I wrote the previous post, I was not based at CERN but now most of my work is done at CERN, so I didn't have much need for a VPN. However, I thought it would be a good opportunity to try it out and see how it works.

The official name of the service is " CERN eduVPN " and it relies on the open-source eduVPN software, which is developed by the GÉANT Association funded by the European Commission. The CERN IT department has set up their own eduVPN server and we can use the eduVPN client to connect to it. The eduVPN client is available for Windows, macOS, Linux, iOS, and Android, so it is compatible with a wide range of devices.

To join the pilot program, it is very easy, you go to CERN Computing Resources portal and subscribe to the "EduVPN service". After subscribing, you will need to wait a couple of minutes. Then you can download the eduVPN client and install it on your device. Once you have the client installed, you choose the institution you want to connect to. You pick CERN and then you will be prompted to log in with your CERN credentials. After logging in, you will be connected to the CERN VPN and you can access CERN resources as if you were on the CERN network.

The direct benefit of using this service is that most of the time if you are in CERN network, you will need repeated 2FA authentication to access lxplus (and other ssh connections). Which you can also have outside the network using the VPN. So it is a good way to avoid the repeated 2FA authentication when you are outsi…