Don't Get Pwned on Public WiFi: Use Your Own VPN

https://www.tinfoilsecurity.com/blog/dont-get-pwned-on-public-wifi-use-your-own-vpn-tutorial-guide-how-to

by bensedat • 13 years ago

168 123 13 years ago

tinfoilsecurity.com

molecule• 13 years ago

subscribing to a VPN provider is typically easier, cheaper and provides more options than rolling your own on EC2

http://netforbeginners.about.com/od/readerpicks/tp/The-Best-...

bensedat6• 13 years ago

Definitely true that cheaper is definitely possible, but a DigitalOcean droplet or an EC2 micro can be pretty cheap and you don't have to worry about the other VPN clients as much.

joelhaasnoot3• 13 years ago

It is hell though - recently setup this on a droplet, but getting all the settings right and diagnosed on Ubuntu and some Ubuntu and Android clients was complicated. It never seems to work the first time...

chewable• 13 years ago

I install something called OpenVPN-AS on a DigitalOcean droplet and it works like a charm...the first time out. Here are step-by-step instructions: https://www.digitalocean.com/community/articles/how-to-insta....

krallin• 13 years ago

Or you can just dynamically launch an EC2 instance just when you need a VPN : )

jessaustin• 13 years ago

Can you do that securely without the VPN? b^)

alexchamberlain2• 13 years ago

How does it provide more options?

michaelt• 13 years ago

If you don't trust a public wifi hotspot with your cleartext traffic because of passive snooping, why would you trust a VPN provider with your cleartext traffic?

A lot of these torrent-anonymously consumer VPN services look pretty dodgy.

agwa3• 13 years ago

Use a non-dodgy VPN service, such as https://www.privatetunnel.com/ (run by the OpenVPN people) or https://privacy.cryptoseal.com/ (run by HN's rdl). You may be trusting them with your cleartext traffic, but that's really no different than trusting e.g. Comcast with your cleartext traffic when you're at home.

Scramblejams2• 13 years ago

Good writeup, but why does this piece recommend running the VPN over TCP? Tunneling TCP over TCP, which will be the end result, is known to provide terrible performance in the presence of even minor packet loss.

bensedat6• 13 years ago

Good point! I made the change when using the VPN at DefCon but haven't updated the post. I'll do that now.

Scramblejams2• 13 years ago

Cool. I was looking around a few weeks ago for a good howto on setting up an OpenVPN server, but didn't find anything straightforward enough for the time constraints I was under. Thanks for writing this up, it'll come in handy for me.

Wilya2• 13 years ago

I've seen many networks blocking udp entirely. An openvpn on a HTTP tcp port (article says 80, I would say 443 is better) is much less likely to be blocked (openvpn also knows how to go through an HTTP proxy).

agwa3• 13 years ago

Run two instances of OpenVPN - one TCP, one UDP. Always try the UDP one first. I've done performance comparisons and the difference is striking.

scotty79• 13 years ago

I wonder why this is so convoluted. NAT used to be like that but since long time it's just `apt-get install ipmasq`

chrismonsanto6• 13 years ago

I use a VPN for much of my private traffic. Here is where I differ from the article's recommendations, and why:

- I don't recommend rolling your own on EC2: pick a VPN with a good reputation and a policy of not retaining logs. See: http://torrentfreak.com/vpn-services-that-take-your-anonymit... (you don't have to use torrents to need a VPN, btw!!)

- I recommend using a Debian VM w/ OpenVPN for your private traffic. That way, 'am I using my VM?' is a quick test for whether your traffic is private or public.

- I can't stress this enough: _be sure to firewall your VM from any traffic not to your VPN provider_. If OpenVPN drops its connection, it will fallback to sending packets normally! At least if you firewall, your connection will just die, instead of potentially sending private traffic in the clear. The article doesn't mention this, and it should.

- Be sure not to log in to your usual services on your VPN, or there is a possibility that someone can connect your real traffic and your VPN traffic. I use LastPass with random passwords to manage all of my accounts, so I solve this problem by simply not installing LastPass on my VM, which makes logging in a very deliberate action on my VM.

IvyMike2• 13 years ago

I agree with the "don't roll your own" VPN suggestion--I personally signed up with Private Internet Access and haven't looked back since.

But I have a question about this: "be sure to firewall your VM from any traffic not to your VPN provider."

Is there a good generic way to do this on Windows? I've looked around and it's never very clear. I think the PIA client has a "VPN kill switch" that should effectively do the same thing, but not all VPN providers have a client.

chrismonsanto6• 13 years ago

If you are using a VM like I suggested, you can do this inside the VM instead of messing around with Windows. See this post: https://news.ycombinator.com/item?id=6285837

Unfortunately I don't use Windows, so I don't know how to firewall from it.

cheeze• 13 years ago

Is PIA completely offshore?

voltagex_2• 13 years ago

Watch out for IPv6 on Windows. I have a PPTP VPN through StrongVPN and the IPv6 interface is unaffected. Unfortunately there doesn't seem to be a way to programmatically disable it.

sillysaurus2• 13 years ago

How do you firewall your connection from any traffic not to your VPN provider?

rfnslyr• 13 years ago

I'd kill for a solid in depth write up if someone is willing to put one together. I don't know anything about this kind of stuff but it's piqued my interest lately.

kefka• 13 years ago

On Windows, you can use WIPFW and make the appropriate rules.

Works like a charm, and hard as hell to detect using standard windows tools.

_rs• 13 years ago

On Mac I used this resource to block traffic with the exception of UDP and on the ppp0 interface: http://superuser.com/questions/468919/prevent-outgoing-traff...

chrismonsanto6• 13 years ago

On Linux, I use a shell script like this:

   servers=( ip1 ip2 ip3 ... )
   
   # Can fwd over internal network
   iptables -A OUTPUT -s 192.168.0.0/16 -d 192.168.0.0/16 -j ACCEPT

   # Can fwd over loopback
   iptables -A OUTPUT -o lo -j ACCEPT

   # Can fwd over the tunnel
   iptables -A OUTPUT -o tun0 -j ACCEPT

   # Can send packets to VPN
   for server in "${servers[@]}"; do
      echo "Installing rules for $server"
      iptables -A OUTPUT -d $server -j ACCEPT
   done

   # Otherwise drop
   iptables -A OUTPUT -j DROP

Use it with a package like iptables-persistent so you don't have to run this every time at boot.

pbhjpbhj• 13 years ago

If OpenVPN drops its connection, it will fallback to sending packets normally! //

This seems to be a bug in network setups - surely it's highly desirable to be able to control which route traffic takes and whether fallback to a different connection occurs or not.

chrismonsanto6• 13 years ago

On Debian 6, the default behavior is to do this. I remember searching high and low at the time to change the behavior, and couldn't figure out how.

If you Google around, a lot of other people seem to have trouble with this as well--there are a lot of tutorials for how to setup iptables to block OpenVPN fallback on dd-wrt and Tomato, for example.

I'd love to be proved wrong though!

Wilya2• 13 years ago

The problem is mostly that Openvpn is responsible for setting up the routes that forward all traffic through the tunnel when it starts, and to remove them when it's done. Openvpn only secures your traffic when it's running. When it somehow quits, you're on your own.

My experience is that when it merely loses the connection, Openvpn will try to reconnect, and in the meantime you have no internet. It won't fallback. But sometimes, when the problem is more serious, the openvpn daemon can quit and then it becomes dangerous.

borski6• 13 years ago

Just to clarify, you don't mean run a VM locally, do you? If your traffic is rolling over the same insecure WiFi, I would imagine your traffic could still be connected and possibly sniffed?

silentOpen• 13 years ago

Yes, a local VM with a remote VPN endpoint.

borski6• 13 years ago

Oh, I see - that makes sense, though why would you need a VM for it? Why not run it locally with a remote endpoint?

snowwrestler• 13 years ago

With respect to the last item, I just want to make a distinction between security and anonymity. I don't care if my bank knows I sometimes a VPN; I just want protection from bad actors who might MITM me.

agwa3• 13 years ago

Right. VPNs provide security. If you need anonymity, don't use a VPN - use Tor.

reinhardt3• 13 years ago

Thoughts on using a Tails VM (https://tails.boum.org/) or generally using Tor over the VPN?

yuvadam• 13 years ago

Do not run Tails on a VM if you have an option. VMs are not secure, and the host machine can _always_ monitor the virtual instances.

Nux2• 13 years ago

I would say it's more secure to roll your own rather than using a "provider". You can never know what the provider is monitoring/logging.

chakalakasp3• 13 years ago

I guess I don't understand what you are doing. Then VPN is to create a secure link either between your computer and a trusted LAN or from your computer to a better, less-likely-to-be-sniffed exit point than open wifi. It's not to hide who you are from the destination server or from anyone observing the overall WAN traffic (as the NSA can do). People with resources can find out who you are with VPN. Saying one should use VPN for anonymity is a bit like saying that its fine to use 1234 as your password because you've never had a problem before and it keeps people out of your account just fine. The reality is that it seems secure right up until the moment that it isn't.

Anonymity is what something like Tor is made for, and depending on your level of paranoia even that may not be enough on its own.

slig2• 13 years ago

Anyone have experience setting up a VPN on a Raspberry Pi?

I'm guessing that it would cost less than $5/month on energy and I have one sitting on a drawer.

Also, I don't live in the US and proxying all my data through the US and back would introduce unwanted lag.

alexchamberlain2• 13 years ago

Grab a Kimsurfi dedicated machine in France! Only £3 a month.

slig2• 13 years ago

Well, I'm not in Europe and VPNs/Dedicated servers in my country are tad expensive.

vetinari• 13 years ago

I'm running my VPN (Strongswan) on a home/soho router (Netgear WNDR3700 with Openwrt).

So using Raspberry Pi is definitely an option.

bluedino2• 13 years ago

Going from your cable/DSL ISP to your house and then back to the ISP adds quite a bit of lag as well, compared to a server sitting in a DC somewhere.

I've made a beefy VM or even used a spare server at the office on a 100/10mb pipe and a $5 VPS is much more responsive. Especially noticeable with things like an IRC shell.

ja27• 13 years ago

I'm VPNed into a Raspberry Pi back at my house right now. Works fine. I just followed a tutorial or two but if I remember correctly, it wasn't much more than "apt-get install openvpn" and a few configuration steps. It's actually running on my XBMC Pi that's already always on and connected to a TV.

mhurron• 13 years ago

You know what would be great - The ability to do this automatically, especially on Android.

I would love to see the ability to specify 'safe' or 'trusted' WiFi networks and if you connect to a network other than these, the VPN gets initialized and used.

Setup on the phone is once and usage of the VPN happens automatically after that.

mef• 13 years ago

If you run a Linode, they have similar instructions for each of their Linux images:

https://library.linode.com/networking/openvpn/ubuntu-10.04-l...

spindritf2• 13 years ago

Ironically, Ghostery prevents the article from being displayed and there are nine trackers detected on that page.

taf2• 13 years ago

it's good information - did you think it was going to be free ;-)

bensedat6• 13 years ago

Oops, a lot of that looks to be coming from the article share links. Sorry!

pokoleo2• 13 years ago

Ironically, Ghostery is owned by Evidon who sells GhostRank data to businesses.

pyrocat• 13 years ago

Can you expand on this? I use Ghostery all the time. What exactly is being sold to businesses?

reinhardt3• 13 years ago

Just unblock "Linkedin Widgets" temporarily.

dotBen3• 13 years ago

For this audience, one would assume this isn't anything new.

The next level of 'detail'/risk to consider here is the fact that so many apps, and even browsers, will bind to the "on connection" event of connecting to a wifi hotspot - before you can initiate your VPN your twitter client* has already sent your authenticated token over the wire, etc.

I've tried to hack something together with iptables but that doesn't work either in airports/etc where there are splash screens to negotiate, etc.

( = yes, you could use a better client, but then the reason we need VPNs in the first place is that so many apps and sites don't use https)

Reply

mitchty• 13 years ago

A lame workaround would be to close all apps prior to putting your laptop to sleep, then engaging the vpn and only afterwards restarting the apps.

Shouldn't be too big of a deal now that tabs/sessions are mostly saved in chrome/firefox no? And well not like losing your twitter credentials is a big deal anyway. (i'm not a huge twitter fan btw :D)

Reply

michaelwww• 13 years ago

Somebody could probably sell me a solution that does all this automatically without distracting me from I'm supposed to be thinking about.

Reply

theandrewbailey• 13 years ago

I like to use an SSH SOCKS proxy to my home server. It didn't seem to be as much work to set up as this.

Reply

ef42• 13 years ago

If you're planning to run a VPN server on Amazon EC2, be forewarned that lots of sites are going to block you. For example, Yelp, Craigslist, the StackOverflow family, Hulu, and Bank of America.

Reply

skrebbel• 13 years ago

Any idea why they do that?

Reply

jlgreco• 13 years ago

I heard before that stackoverflow does it because of scrapers, or something like that.

Reply

jacquesm• 13 years ago

Anti-bot / anti-griefer measures.

Reply

borski6• 13 years ago

Because often, EC2 is used by spammers, botnets, and the like. Turns out when you make starting a box really simple, evildoers will use your service as well. Craigslist & Co. dislike EC2 in general, for that reason.

Reply

ef42• 13 years ago

In the case of things like Hulu, it's an attempt to enforce their geographic boundaries (so that Europeans don't buy cheap EC2 instances to watch America-only licensed content).

I assume most of the others are trying to block scrapers that copy all their content and republish it.

Reply

post_break3• 13 years ago

The easiest defense against a pineapple is to create a wifi network titled "Pineapple Connected ALERT ALERT" or something similar to that. No security, no keys, and set it to your highest priority of networks to connect to if you have automatic joining enabled.

As someone who has used these lovely devices to prank others it's a good idea to do so.

Reply

dotBen3• 13 years ago

I'm confused, does the Pineapple device create an additional SSID called this? Sorry, not familiar with the devices.

Reply

post_break3• 13 years ago

Your computer asks "Hey is ____ SSID available?" and pineapple says "Yep! That's me!" Now your computer connects to the pineapple.

Well if you set the "Pineapple detected" SSID in your computer as the top priority, you'll connect to that when the pineapple is around. You're just putting in a dummy network on your computer to warn you that you've just joined the network f*&%ville, and you're not the mayor.

Reply

borski6• 13 years ago

This is brilliant. We'll start recommending this, I think.

Reply

post_break3• 13 years ago

No problem, it's a hell of a lot easier (and safer) than trying to run a VPN through one of these things. I'm not saying a VPN is pointless, but think of how many services on your computer connect before you can hit that VPN button.

Reply

mapgrep2• 13 years ago

Does anyone know why this is better than a simple SOCKS proxy, which can be set up with one SSH command to your VPS and a quick visit to your system settings?

I use sheepsafe to pull these up automatically when I'm away from a trusted network https://github.com/nicksieger/sheepsafe

Reply

bensedat6• 13 years ago

This answer possibly explains some of the differences between the two: http://superuser.com/a/423615

Reply

mapgrep2• 13 years ago

Ah thanks. The TLDR seems to be "VPN can handle UDP and other non TCP connections, e.g. for YouTube".

Reply

dschep2• 13 years ago

Simpler, more vpn-like solution can be done via Sshuttle[0] or (albeit less simple afaict) with `ssh -w local_tun[:remote_tun]`

[0] https://github.com/apenwarr/sshuttle

Reply

bluedino2• 13 years ago

Your apps have to support SOCKS proxies for one.

Reply

beagle3• 13 years ago

Much more practical on Linux/OSX: https://github.com/apenwarr/sshuttle

No root/admin privileges required on your "VPN server" - just the ability to ssh. It solves the tcp-over-tcp issue. It just works.

It only does TCP (with a specific hack for DNS, but no general UDP or IP). But it works exceptionally well, and just needs an sshable account on the server.

Reply

newman3144• 13 years ago

While possible, using ssh on iOS as a tunnel is a giant pain and it times out after 10mins. PPTP is not an option and there is preciously little info out there about properly setting up roadwarrior IPSec in a relatively easy manner.

Reply

btgeekboy• 13 years ago

So then why not use OpenVPN?

Reply

nly2• 13 years ago

The article doesn't mention IPv6 where things can be a bit more tricky. The Android clients don't let you use TAP (layer 2 tunneling), so if you're going to be accessing your VPN from an Android device you'll have to configure IPv6 NAT, or hack around with scripts to add IPv6 addresses dynamically.

Reply

archagon• 13 years ago

If you're too cheap to shell out money for a VPN, proXPN has a limited free tier. I've been using it for banking while travelling and it works great!

Reply

newman3144• 13 years ago

I'm still looking for a good config for a raccoon roadwarrior config to a VM behind dd-wrt (as dd-wrt does not come with IPSec support).

Amazingly, there is very little information about this despite what would seem to be a pretty common desired config. Or maybe my google-fu just sucks.

At this point, I can get a tunnel established but it fails to correctly route after the tunnel is set up. Frustrating.

Reply

smtddr• 13 years ago

https://github.com/apenwarr/sshuttle

Easy solution and system-wide, if your OS supports it and you can ssh to a trusted server. My personal plan-B tool when a simple ssh -D and firefox's socks-proxy isn't enough.

(BTW, why doesn't Chrome have socks-proxy like Firefox yet?)

Reply

ihaveaq• 13 years ago

I have a Chromebook (whose security is limited to HTTPs Everywhere, which doesn't lock much at all). How do I set up a VPN for it?

Reply

bensedat6• 13 years ago

Looks like Chromebooks may support it right out of the box: https://support.google.com/chromeos/answer/1282338

Reply

thomc• 13 years ago

But their OpenVPN support is awful and limited, unless you enable developer mode and set it up manually. Prevents Chromebooks from using VPN in our office.

Reply

rmrfrmrf• 13 years ago

If you have a decent internet connection at home with reliable uptime, you can also just set up a VPN at home and connect that way. My router comes with OpenVPN on it, so I don't even need to have extra hardware running.

Reply

Nux2• 13 years ago

I too use (open)vpn for 99% of my traffic because terrorism etc.

I can't recommend it enough, the damn thing is super stable and secure, works via NAT via NAT via NAT etc and super flexible (push routes, push dns, proxy and other settings), works in routed mode, bridged mode and so on.

I recommend you get a server or a VPS somewhere "nearby" and install openvpn software on that.

I can't trust VPN providers that they do not monitor or log my traffic and neither should you.

Reply

gurbelmann• 13 years ago

Of course, you have a problem when the owner of the wifi explicitly prevents anonymisation services.

For example, when I was at Birmingham airport, I couldn't connect to my VPN because they blocked domains of well-known VPN providers and even hijacked all my DNS requests so I couldn't circumvent so easily it.

I guess running your own local DNS server which has your typical requests cached would solve this problem though.

Reply

borski6• 13 years ago

Well, if you're running your own on, say, an EC2 or Rackspace or DigitalOcean droplet, they likely won't have it blocked.

Reply

davepeck2• 13 years ago

Hi folks. I'm one of the three guys who runs Cloak (https://www.getcloak.com/).

Cloak is a super simple VPN where both the back-end service and front-end apps are tightly integrated. (We think of it as the "Dropbox of VPNs" in the sense that, like Dropbox, it's so easy to use.)

Basically, it's the VPN service+applications I wanted for myself when I started looking around and couldn't find anything (1) easy enough and (2) non-sketchy. Right now Cloak supports OS X (10.7+) and iOS (6+). We've been around for a while and I know there are a number of happy customers here on HN.

In any case, please let me know if you have any questions, and please do give it a spin. Cheers!

(EDIT for clarity, and because X of Y descriptions are not always loved.)

Reply

computer2• 13 years ago

The "Dropbox of VPNs"? What does that even mean?

Reply

davepeck2• 13 years ago

We think Dropbox is great because it's so easy to use and "just works". We designed Cloak with that thought in mind.

Reply

newman3144• 13 years ago

I see that Cloak uses racoon under the hood for iOS in what I assume to be a roadwarrior config.

Do you mind sharing an appropriately scrubbed config so that I can compare to see what I'm doing wrong in my setup? There seems to be a dearth of viable configs out there and this would be immensely helpful. Thanks in advance.

FWIW, this is what I have so far. http://superuser.com/questions/553193/how-do-i-configure-dd-...

Reply

Wicher• 13 years ago

I like Tinc VPN (http://www.tinc-vpn.org/). It's multiplatform and open source, just as OpenVPN is, but I prefer it for its simplicity and its mesh feature. It doesn't try to do too much (which means you'll have to set up routes yourself).

See http://www.tinc-vpn.org/documentation-1.1/tinc_4.html#How-co... to get an idea of the mesh feature.

Reply

car54whereareu• 13 years ago

Once your vpn is established do you post to HN, inject SQL, download torrents, or is there something else exciting to do? I'm not in a fraternity (or sorority) so that's out.

Reply

chakalakasp3• 13 years ago

BTW, for what it's worth, the (very inexpensive) Synology NAS models out there will all act as an openvpn server. It requires a hit of tweaking to get it to work they way you'd expect, but it's nothing beyond what the typical reader here can do.

Reply

john61• 13 years ago

I am using a NoMachine NX remote session to a my server through ssh for this purpose.

Reply

Don't Get Pwned on Public WiFi: Use Your Own VPN

Related Stories