How does HTML5 compare in vpn security compared to ipsec or SSL?

When used with certificates, L2TP/IPsec is as secure as IPsec and the SSL VPN depending on how they're each configured.  Pure IPsec and SSL VPN can have the strongest security.  The HTML5 method should be at least as good as L2TP/IPsec using certificates.

The problem with HTML5 is that it's very resource intensive.  If you want to have more than a single, simultaneous user, you will want to use more powerful hardware.

In general, I like the SSL VPN method best.

Cheers - Bob

Ok thank you.. bummer HTML5 VPN is freakin' slick. Why do they have all these cool features and say "Oh but don't use it"... Ha..

I like to use the HTML5 VPN for outside consultants that manage a single resource and don't need general network access.  They don't have to install anything and they don't get a copy of any of the client's certs.

Cheers - Bob

What I was thinking was giving 3 users remote desktop access when out of the office. I bet this wouldn't cause too much overhead.

That depends on the hardware that UTM runs on.  In this case, I would prefer SSL VPN remote access with two-factor authentication over HTML5.  Let us know what you wind up doing.

Cheers - Bob

To elaborate on the technology aspects of your question:

HTML5 VPN and SSL VPN rely on the same technology, which was developed for web-based encryption:   SSL/TLS.   SSL was the original implementation developed by Netscape.   They turned the concept over to the IETF Standards group, which revised the specification and called it TLS.   The sequence of releases, from new to old, is SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1, TLS 1.2, and TLS 1.3.

When a client and server connect, they negotiate the best available configuration, based on what they are able and willing to use.   At this time, nobody should be using anything older than TLS 1.0, but there is a tremendous push to get everyone using TLS 1.2 or the very new TLS 1.3

IPSEC VPN uses a different technology framework than TLS.   I don't know how to compare the two, so I will defer to Bob Alfson's assessment that IPSEC has some theorietical advantages.

Both TLS and IPSEC involves multiple interchangeable components.  The protocol, such as TLS, controls how to say "Hello".   An asynchronous encryption method is used to bootstrap a connection.  But asynchronous encryption is high overhead, so it is only used temporarily to negotiate a synchronous encryption method.   An authentication method is also negotiated, because it least one end, possibly both, need to verify that they are talking to the intended communication partner.   A checksum method is needed for both ends to know if a packet has been manipulated in transit.   Finally a Perfect Forwarding Secrecy method is used to ensure that a bad guy cannot decrypt the whole conversation by cracking the contents of one packet.  Each of these components are plugged together to make a communication session.  In recent years, white-hat researchers and faster processors have found problems with many of the components, so an optimal encryption session depends on having support, at both ends of the connection, for the newest components.

Encryption is designed to keep the bad guys from eavesdropping on your traffic.   This is a good thing, but I actually think the likelihood of this happening is pretty low.

An easier approach is for the bad guys to guess their way into your systems with password guessing attacks.   That is why two-factor authentication becomes critical.   If your users are at fixed locations, site-to-site VPN becomes a way of solving this problem, because the remote IP is the only location from which password-guessing attacks can be attempted.   I have also used IP-based restrictions with WAF to provide equivalent protection to my internet-facing websites, without creating a site-to-site VPN.   For users that are not at fixed locations, One-Time-Passwords (free) and DUO Security (free for 10 users, monthly fee otherwise) is another alternative.   PCI DSS (credit card) regulations call for 2-factor security on all remote access.  Even if you are exempt from PCI DSS,  which is unlikely, two-factor authentication is a practical necessity.   We operate a honeytrap which is catching password-guessing attacks on a nearly daily basis.