Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #189163 > unrolled thread

[OT a bit] -- OpenVPN and mobile safety

Back to article view | Back to linux.debian.user

Contents

  [OT a bit] -- OpenVPN and mobile safety Mark Fletcher <mark27q1@gmail.com> - 2017-11-21 18:20 +0100
    Re: [OT a bit] -- OpenVPN and mobile safety Joe <joe@jretrading.com> - 2017-11-21 18:50 +0100
      Re: [OT a bit] -- OpenVPN and mobile safety Mark Fletcher <mark27q1@gmail.com> - 2017-11-26 16:40 +0100
        Re: [OT a bit] -- OpenVPN and mobile safety Joe <joe@jretrading.com> - 2017-11-26 17:20 +0100
          Re: [OT a bit] -- OpenVPN and mobile safety Mark Fletcher <mark27q1@gmail.com> - 2017-11-28 13:30 +0100
            Re: [OT a bit] -- OpenVPN and mobile safety Joe <joe@jretrading.com> - 2017-11-28 15:40 +0100
              Re: [OT a bit] -- OpenVPN and mobile safety Mark Fletcher <mark27q1@gmail.com> - 2017-11-29 00:00 +0100

#189163 — [OT a bit] -- OpenVPN and mobile safety

All

This is a little bit OT but has some roots in Debian. More than anything 
I am looking for pointers to where I should be looking for tutorials or 
other help, as I am pretty sure there is info out there on what I want 
to do but am not sure what to search for. Most of my searches so far 
have turned up info about connecting two networks using a VPN, which 
seems more difficult / complicated than what I am trying to do.

I travel a lot for business and some time ago I set up OpenVPN so I can 
access my home network, and in particular my main PC, while 
travelling.

I run OpenVPN on my network's firewall, which is a miniITX PC running 
LFS. The OpenVPN server is running in multi-client mode. When I will be 
travelling I open the relevant port on my firewall, add rules for the 
tundevice, fire up openVPN on the server and on my client PC. When I 
come home I shut it down, as I don't need the VPN normally.

There are 2 clients for this VPN -- one is my main home PC which is a 
Debian Stretch machine and is conected by wired ethernet to a Buffalo 
Airstation which also supplies my WiFi. The WAN port of the AirStation 
runs to my firewall. The other client is an Android tablet where I run 
OpenVPN for Android.

For months I have reliably been able to connect the Android tablet and 
thus have connectivity from the tablet to the Debian machine while 
travelling. My usual drill is connect via OpenVPN, ssh from the tablet 
into the box, fire up a tigervncserver session and then connect from the 
tablet using a VNC viewer, after which I can pretty much do anything as 
if I were sitting in front of my home machine. For example right now I 
am using that configuration to send this email using mutt running on my 
Debian PC, while I am using my tablet in a hotel room in Singapore.

What I'd like to do now is have the option to set things up so that the 
tablet has NO CHOICE but to do all its interaction with the internet 
over the VPN.

In other words, it should conect to local untrusted WiFi as normal, get 
an IP address from that network, and then when I fire up OpenVPN I want 
to arrange things such that all user / app attempts to access the 
internet are routed through the VPN, so they emerge onto the internet at 
large from my home network not from my tablet directly. And, crucially, 
any attempt to talk to the tablet that doesn't come through the VPN goes 
ignored.

Thus untrusted networks don't see my traffic, and my tablet is safe from 
attack from the local untrusted WiFi LAN.

I imagine I need to let some traffic go through the untrusted 
connection, eg DHCP etc to keep the local connection to the untrusted 
WiFi alive, but I want that to be the absolute minimum necessary.

Is this a matter of configuring OpenVPN right, and if so can anyone 
point me at a good tutorial? or do I need other software, in which case 
can anyone give me any pointers?

Thanks

Mark

[toc] | [next] | [standalone]

#189165

On Tue, 21 Nov 2017 22:35:24 +0900
Mark Fletcher <mark27q1@gmail.com> wrote:


> 
> What I'd like to do now is have the option to set things up so that
> the tablet has NO CHOICE but to do all its interaction with the
> internet over the VPN.
> 
> In other words, it should conect to local untrusted WiFi as normal,
> get an IP address from that network, and then when I fire up OpenVPN
> I want to arrange things such that all user / app attempts to access
> the internet are routed through the VPN, so they emerge onto the
> internet at large from my home network not from my tablet directly.
> And, crucially, any attempt to talk to the tablet that doesn't come
> through the VPN goes ignored.
> 
> Thus untrusted networks don't see my traffic, and my tablet is safe
> from attack from the local untrusted WiFi LAN.
> 
> I imagine I need to let some traffic go through the untrusted 
> connection, eg DHCP etc to keep the local connection to the untrusted 
> WiFi alive, but I want that to be the absolute minimum necessary.
> 
> Is this a matter of configuring OpenVPN right, and if so can anyone 
> point me at a good tutorial? or do I need other software, in which
> case can anyone give me any pointers?

Look at the --redirect-gateway startup option or (without leading --)
in the config file. The chances are that the default openvpn
configuration does this anyway, as there are two main uses for a VPN,
the remote access that you are using now, and the routing of all
traffic to a trusted network before it gets out unencrypted onto the
Internet. The latter use requires the gateway redirection.

Have a look at the routing table with and without the VPN open to
check. Also look at the server configuration, which should contain
'push "route..."' and 'push "redirect-gateway...."' lines.

See the heading:
"Routing all client traffic (including web-traffic) through the VPN"

in page
https://openvpn.net/index.php/open-source/documentation/howto.html

It would also help if you have control of the tablet firewall code.
I've no idea if this is possible on Android. I have multiple iptables
rulesets for my netbook, two of which allow DHCP, web and either ssh
or openvpn out of the wifi interface, and a controlled set over the tun,
with only established and related connections allowed back in. 

But the gateway redirect must be working for the right signals to get
to the right firewall rules. Without control of the firewall, the
redirect will still do most of what you want, but you would be able to
send packets to the local wifi network explicitly. The right firewall
rules would prevent this. If your existing firewall rules allow in only
related and established connections, that should prevent attack
attempts from the wifi network.

-- 
Joe

[toc] | [prev] | [next] | [standalone]

#189309

On Tue, Nov 21, 2017 at 05:46:23PM +0000, Joe wrote:
> On Tue, 21 Nov 2017 22:35:24 +0900
> 
> Look at the --redirect-gateway startup option or (without leading --)
> in the config file. The chances are that the default openvpn
> configuration does this anyway, as there are two main uses for a VPN,
> the remote access that you are using now, and the routing of all
> traffic to a trusted network before it gets out unencrypted onto the
> Internet. The latter use requires the gateway redirection.
> 
> Have a look at the routing table with and without the VPN open to
> check. Also look at the server configuration, which should contain
> 'push "route..."' and 'push "redirect-gateway...."' lines.
> 
> See the heading:
> "Routing all client traffic (including web-traffic) through the VPN"
> 
> in page
> https://openvpn.net/index.php/open-source/documentation/howto.html
> 

Yep, this looks like what I was after. This actually claims to redirect 
ALL traffic through the VPN, and hints that this can cause trouble with 
DHCP, which sounds like a bit of a problem to be frank. Would have 
thought that would break a lot of networks. But I suppose I might get 
away with it if the hotel / whatever untrusted WiFi doesn't reassign IP 
addresses a lot. I just might have to do something on my home network's 
firewall to stop it attempting to service locally DHCP requests coming 
through the TUN.

> It would also help if you have control of the tablet firewall code.
> I've no idea if this is possible on Android. I have multiple iptables
> rulesets for my netbook, two of which allow DHCP, web and either ssh
> or openvpn out of the wifi interface, and a controlled set over the tun,
> with only established and related connections allowed back in. 

Yes, this part would be necessary to stop the tablet responding to 
requests coming from the untrusted WiFi network, except maybe necessary 
things from the access point itself, eg DHCP... Anything coming from 
anyone else on the untrusted WiFI LAN I'd want to regard with extreme 
prejudice...

I don't know if Android has iptables, but I will dig around to see what 
it does have.

> 
> But the gateway redirect must be working for the right signals to get
> to the right firewall rules. Without control of the firewall, the
> redirect will still do most of what you want, but you would be able to
> send packets to the local wifi network explicitly. 

I'm less worried about the tablet being able to send to the untrusted 
WiFi than I am about the untrusted WiFi being able to send to the 
tablet. ie if some service I'm unaware of (it's stuffed with Samsung 
bloatware after all) is listening on the device, I don't want it talking 
to strangers as it were...

Thanks for your reply, sorry I took a while to respond but I was 
travelling for business.

Mark

[toc] | [prev] | [next] | [standalone]

#189312

On Mon, 27 Nov 2017 00:33:02 +0900
Mark Fletcher <mark27q1@gmail.com> wrote:

> On Tue, Nov 21, 2017 at 05:46:23PM +0000, Joe wrote:
> > On Tue, 21 Nov 2017 22:35:24 +0900
> > 
> > Look at the --redirect-gateway startup option or (without leading
> > --) in the config file. The chances are that the default openvpn
> > configuration does this anyway, as there are two main uses for a
> > VPN, the remote access that you are using now, and the routing of
> > all traffic to a trusted network before it gets out unencrypted
> > onto the Internet. The latter use requires the gateway redirection.
> > 
> > Have a look at the routing table with and without the VPN open to
> > check. Also look at the server configuration, which should contain
> > 'push "route..."' and 'push "redirect-gateway...."' lines.
> > 
> > See the heading:
> > "Routing all client traffic (including web-traffic) through the VPN"
> > 
> > in page
> > https://openvpn.net/index.php/open-source/documentation/howto.html
> >   
> 
> Yep, this looks like what I was after. This actually claims to
> redirect ALL traffic through the VPN, and hints that this can cause
> trouble with DHCP, which sounds like a bit of a problem to be frank.
> Would have thought that would break a lot of networks. But I suppose
> I might get away with it if the hotel / whatever untrusted WiFi
> doesn't reassign IP addresses a lot. I just might have to do
> something on my home network's firewall to stop it attempting to
> service locally DHCP requests coming through the TUN.

'Send everything through the VPN' means everything which would be sent
to the default gateway, which does *not* include traffic destined for
the local network. After all, the VPN packets still have to be sent out
of the wifi interface...

Your link to the local wifi network has set up routing whereby anything
sent explicitly to *that* *network* will pass directly through the wifi
interface and not through the VPN. That will take care of any local
DHCP issues.

> 
> > It would also help if you have control of the tablet firewall code.
> > I've no idea if this is possible on Android. I have multiple
> > iptables rulesets for my netbook, two of which allow DHCP, web and
> > either ssh or openvpn out of the wifi interface, and a controlled
> > set over the tun, with only established and related connections
> > allowed back in.   
> 
> Yes, this part would be necessary to stop the tablet responding to 
> requests coming from the untrusted WiFi network, except maybe
> necessary things from the access point itself, eg DHCP... Anything
> coming from anyone else on the untrusted WiFI LAN I'd want to regard
> with extreme prejudice...
> 
> I don't know if Android has iptables, but I will dig around to see
> what it does have.
> 
> > 
> > But the gateway redirect must be working for the right signals to
> > get to the right firewall rules. Without control of the firewall,
> > the redirect will still do most of what you want, but you would be
> > able to send packets to the local wifi network explicitly.   
> 
> I'm less worried about the tablet being able to send to the untrusted 
> WiFi than I am about the untrusted WiFi being able to send to the 
> tablet. ie if some service I'm unaware of (it's stuffed with Samsung 
> bloatware after all) is listening on the device, I don't want it
> talking to strangers as it were...
> 

If the tablet has firewalling at all, it should prevent uninvited
access from everywhere. The tablet itself is free to contact outside
servers and the firewall should then permit replies. If there is no
firewalling by default, you will need to do something about it, and I
can't help you there, I know nothing about Android.

What control of the firewall would allow is for you to specify only
the outgoing contacts you approve of. While the VPN is open, you may
want to limit the protocols sent along it, and you may also want to
limit what can be sent to the local wifi network, firewall control
would allow both.

Note that most (maybe all) free wifi systems will want you to provide
some authentication before you are connected to the Net, generally
through a web page. In some systems, you may have a need to access the
web page after the VPN is up, so it is probably advisable to allow web
access to the wifi network as well as DHCP and OpenVPN.

-- 
Joe

[toc] | [prev] | [next] | [standalone]

#189358

On Sun, Nov 26, 2017 at 04:18:12PM +0000, Joe wrote:
> On Mon, 27 Nov 2017 00:33:02 +0900
> Mark Fletcher <mark27q1@gmail.com> wrote:
> 
> > On Tue, Nov 21, 2017 at 05:46:23PM +0000, Joe wrote:

> 'Send everything through the VPN' means everything which would be sent
> to the default gateway, which does *not* include traffic destined for
> the local network. After all, the VPN packets still have to be sent out
> of the wifi interface...
> 
> Your link to the local wifi network has set up routing whereby anything
> sent explicitly to *that* *network* will pass directly through the wifi
> interface and not through the VPN. That will take care of any local
> DHCP issues.

Hmmm. That also makes sense, but then why did the section of the docos 
you pointed me at tell me to expect problems with DHCP when using this 
function?

Well, I guess there is one way to find out -- try it! ;)

In the meantime, I have discovered that Android indeed has iptables, so 
I just need an iptables binary which I am in the process of sourcing to 
communicate with the iptables in the kernel. The iptables executable 
program isn't installed by default, but the kernel support for iptables 
is.

> 
> Note that most (maybe all) free wifi systems will want you to provide
> some authentication before you are connected to the Net, generally
> through a web page. In some systems, you may have a need to access the
> web page after the VPN is up, so it is probably advisable to allow web
> access to the wifi network as well as DHCP and OpenVPN.
> 
That would defeat some of the purpose -- allowing the tablet 
(specifically bloatware) to access the local network would (continue to) 
expose me to gawd alone knows what on unknown and untrusted networks. 
Obviously the network outside my home LAN is no more trusted than a 
hotel / coffee shop / airport WiFi is, but bad actors are known to 
loiter on such public networks waiting for idiots like me to come along, 
and I'm interested in seeing to what extent I can dodge them.

Thanks a lot for your advice -- it is starting to feel like I have 
everything I need to achieve my goal here.

Mark

[toc] | [prev] | [next] | [standalone]

#189362

On Tue, 28 Nov 2017 21:28:55 +0900
Mark Fletcher <mark27q1@gmail.com> wrote:

> On Sun, Nov 26, 2017 at 04:18:12PM +0000, Joe wrote:

> > 
> > Note that most (maybe all) free wifi systems will want you to
> > provide some authentication before you are connected to the Net,
> > generally through a web page. In some systems, you may have a need
> > to access the web page after the VPN is up, so it is probably
> > advisable to allow web access to the wifi network as well as DHCP
> > and OpenVPN. 
> That would defeat some of the purpose -- allowing the tablet 
> (specifically bloatware) to access the local network would (continue
> to) expose me to gawd alone knows what on unknown and untrusted
> networks. Obviously the network outside my home LAN is no more
> trusted than a hotel / coffee shop / airport WiFi is, but bad actors
> are known to loiter on such public networks waiting for idiots like
> me to come along, and I'm interested in seeing to what extent I can
> dodge them.

But in a network of that kind, you have no choice: you *must* connect
to the authentication web server, in order to be granted access to the
rest of the Net. If you try to connect to anything else, you will be
redirected to that server. If that server has been hacked and malware
installed, tough, there's no way to avoid it, it's one of the risks of
using free wifi.

Allowing web access *out* through the wifi interface is not optional
before the VPN is up, and will only allow the tablet to initiate a
connection to a web server in that local network after the VPN is up. It
will not allow anything there to initiate inbound connections at any
time, nor outbound web connections to anywhere else, they will get
routed through the VPN. If you have something installed which can make a
connection to another web server in that local network without action
on your part, you've already been hacked, and there's nothing left to
worry about...

-- 
Joe

[toc] | [prev] | [next] | [standalone]

#189384

On Tue, Nov 28, 2017 at 02:31:16PM +0000, Joe wrote:
> On Tue, 28 Nov 2017 21:28:55 +0900
> Mark Fletcher <mark27q1@gmail.com> wrote:
> 
> > On Sun, Nov 26, 2017 at 04:18:12PM +0000, Joe wrote:
> 
> > > 
> > > Note that most (maybe all) free wifi systems will want you to
> > > provide some authentication before you are connected to the Net,
> > > generally through a web page. In some systems, you may have a need
> > > to access the web page after the VPN is up, so it is probably
> > > advisable to allow web access to the wifi network as well as DHCP
> > > and OpenVPN. 
> > That would defeat some of the purpose -- allowing the tablet 
> > (specifically bloatware) to access the local network would (continue
> > to) expose me to gawd alone knows what on unknown and untrusted
> > networks. Obviously the network outside my home LAN is no more
> > trusted than a hotel / coffee shop / airport WiFi is, but bad actors
> > are known to loiter on such public networks waiting for idiots like
> > me to come along, and I'm interested in seeing to what extent I can
> > dodge them.
> 
> But in a network of that kind, you have no choice: you *must* connect
> to the authentication web server, in order to be granted access to the
> rest of the Net. If you try to connect to anything else, you will be
> redirected to that server. If that server has been hacked and malware
> installed, tough, there's no way to avoid it, it's one of the risks of
> using free wifi.

Yes that is true. Perhaps I wasn't clear. At the beginning of this we 
were talking about the state of things after the VPN is up. We weren't 
talking about what happens before the VPN is up.

> 
> Allowing web access *out* through the wifi interface is not optional
> before the VPN is up, and will only allow the tablet to initiate a
> connection to a web server in that local network after the VPN is up. 

Again true, but not what we were talking about, or at least not what I 
thought we were talking about. I'm imagining the firewall in the default 
state at boot, and using a hook script or something to configure the 
firewall as part of connecting to the VPN. I'm dimly aware that is 
possible although on my home LAN I configure the firewall to open the 
VPN port on the server and then manually start the VPN server, and the 
desktop VPN client is on a trusted LAN anyway so its firewall settings 
don't in practice come into it. It is the tablet that is out in the 
wild, hence the focus of this discussion on the tablet.

I realise the realities you point out above leave holes in the tablet's 
protection, but as I believe you are saying there isn't much I can do 
about that except minimise the time the tablet is on and connected to an 
untrusted WiFi without the VPN being on and the firewall in a sensible 
state.

> It
> will not allow anything there to initiate inbound connections at any
> time, nor outbound web connections to anywhere else, they will get
> routed through the VPN. If you have something installed which can make a
> connection to another web server in that local network without action
> on your part, you've already been hacked, and there's nothing left to
> worry about...

I wouldn't imagine the firewall by default is blocking anything. I'll 
need to set it up to do so. Even on Debian that is the case. And the 
point of this sub-thread of the conversation, which unfortunately has 
been lost due to snipping by both of us, was what would happen if I 
could use the redirect-gateway capability of OpenVPN but _couldn't_ 
control the firewall, which fortunately has turned out not to be the 
situation...

Anyway appreciate your engagement on this, and I think I've got what I 
need to set this up now. Thanks!

Mark

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web