Public WiFi VPN

I'm always paranoid around using public Wifi, and the closest thing that seems to protect me seems to by an Anonabox-but is there a way to build your own personal VPN?

Look up algoVPN

I was pretty interested building my own with a raspberry pie but didn't get much into it, I mentioned this to other people but they referred to just buy a vpn provider. I'm still in the fence though.

If you have a raspberry pi or any computer at home that'll support SSH it's pretty straight forward to set up a 'poor mans VPN'. Set up whatever computer you have as an SSH server, use port forwarding to allow you to access the server from outside your local network. Now what you can do is connect to this SSH server from wherever you are (e.g. on public wifi in subway) and tunnel your traffic though your SSH connection. You can use the following command to connect to the server and enable your tunnel: ssh -f -D 1234 me@<my_public_ip> -p <SSH_server_port> -N Once that's connected you just send your traffic through the socks proxy at 127.0.0.1:1234.

https://arstechnica.com/gadgets/2017/05/how-to-build-your-own-vpn-if-youre-rightfully-wary-of-commercial-options/

>>993 +1 streisand has some good options too both are easy to set up. Ansible pretty much justwerx

openvpn seems like the obvious choice. am i missing something here? setting up the PKI might take some time if you've never done it before, but the actual server config can be done in minutes. i think they've even got a windows port. >>1012 or this if you just want a proxy. i'd still recommend setting up a proper vpn though. wouldn't your time on the bus be more pleasant with secure, transparent access to every networked device you own?

One thing to be careful of when you build your own VPN is how it can reveal more information about you to websites you visit and online services you use. If you also register a domain or host your personal blog on the same VPS then your online activity just got much less anonymous and private. Even not, your hosting provider now knows who you are and all the stuff you do online and may not be as trustworthy as your ISP or not be bound by the same privacy laws. >wouldn't your time on the bus be more pleasant with secure, transparent access to every networked device you own? This is /sec/ not /i-think-technology-is-fun-plz-pwn-all-my-soykaf/. I think the security-vs-convenience equation biases the other way on a board like this.

>>1416 >If you also register a domain or host your personal blog on the same VPS then your online activity just got much less anonymous and private. This is something I've been thinking about alot. Isn't a possible solution to this problem to assign two or more IP addresses to the server/VPS? Then make the web services go through one IP and the OpenVPN server go through the other. Basically is there a way to determine if two IPs are assigned to the same server?

>>1417 maybe in very specialized cases you could deduce that from traceroutes and routing advertisements... but i wouldn't worry about it if you're just using a normal large scale vps provider. the bigger concern is probably keeping all your services completely partitioned without making any mistakes. if you don't want to pay for 2 IPs i imagine you could set up your VPN's default route to proxy through tor. if you're really paranoid, run the VPN server as a tor hidden service to hide the PC<->VPS session. has anyone here tried something like this?

>>1418 Tor exit nodes can sniff your traffic so blindly routing everything over Tor is not really a good idea. >un the VPN server as a tor hidden service to hide the PC<->VPS session Why not just run Tor and leave out the VPS in that case? Renting 2 different VPS accounts is the simplest solution in my opinion.

>>1419 This is correct. Tor->VPN, not VPN->tor

>>1419 >Tor exit nodes can sniff your traffic Your unencrypted traffic, aka http only.

>>1423 Depends how much you know about TLS I guess.

>>1419 >Why not just run Tor and leave out the VPS in that case? because a VPN is more than just a proxy. if OP wanted a proxy, he should have asked for one. >Renting 2 different VPS accounts is the simplest solution in my opinion. yeah, i agree

>>1431 Sure, if you're dumb and let yourself fall victim to TLS downgrade attacks.

>>1432 What >>1419 was saying was if you set your VPN default route to Tor because you don't want to pay for 2 IPs, and you connect to the VPN through a Tor hidden service to hide the PC<->VPS connection, then what do you need the VPN for?

>>1434 say you want to connect to a file server on your vpn, but don't want to expose it as a hidden service. you'd connect to the vpn over tor and then use the vpn routing to access the file server. i'm not saying this is the best solution, but it's something you can't achieve with tor alone.

>>1434 The VPN will prevent exit nodes from performaing mitm attacks, and will allow you to browse the Internet without all the "Tor is derezzed here" messages. In OP's use case, I think foregoing Tor for just a VPN is fine, or, if his Internet activity is the type that can be done via Tor (not visiting all the sites that ban exit nodes, or make it ridiculously hard to use their site from Tor), just using Tor. >>1421 The Tor project itself discourages people from Tor -> VPN chains, on the grounds that it makes Tor slightly less anonymous. It has to do with how the constant exit node changing Tor does prevents third parties from building a profile of you. They used to encourage VPN -> Tor, but looking at their website now, they've gone back on that stance: https://www.torproject.org/docs/faq.html.en#IsTorLikeAVPN

>>1436 You can make use of HiddenServiceAuthorizeClient so only you can connect to your hidden service, you can even make auth for your friends and they can see it as well.

>>1439 didn't know about that. thanks for the info.

>>1439 Wow, didn't know about that. That's fuarrrking cool. Thanks. >>1431 There was an interesting write up a couple of years ago that counted the percentage of exit nodes that attempted SSL stripping or that tried to use invalid certificates. The percentage was ridiculously low.

>>1449 Found the paper (I think): https://www.cs.kau.se/philwint/spoiled_onions/techreport.pdf tl;dr - Of the ~1000 exit nodes, only 25 were found to be malicious/misconfigured, so only 2.5%. That's higher than I remember, and not negligible by any means. I wonder what the chance of a falling victim to a mitm attack at any given public wifi spot is?

ssh on your VPS use -d 8080 to tunnel your http traffic through it. problem solved, now let's go get some prostitutes

>>1379 I can vouch for openvpn, easy enough to set the server up if you have a gander on the wired. I use it on my laptop with both arch and windows no problem.

>>1436 >don't want to "expose" it as a hidden service That's literally non-problem. There are much more possible hidden domain names than ipv4 addresses, 6x10^21 vs 4 billion exactly. So you are unlikely to be portscanned, and no, the address is not public unless someone is aware of it because Tor network doesn't have traditional DNS system with whois database. This scheme is really brilliant, your server has less chances to be DoSed if it faces public on the other side, and 0 if it is behind proper NAT and only acts as a hidden service private network. You don't need to worry about malicious exit nodes or dynamic dns provider or even tunnel encryption in some weird cases, since Tor hidden service connection is end-to-end encrypted itself. Might as well try doing that with i2p, but client router windup might feel too long compared to tor.

>>1527 Enumerating hidden services (without bruteforce) is possible but you are correct that this is not intentional. https://donncha.is/2013/05/trawling-tor-hidden-services/

I've got a problem with using VPN on public WiFi. That is, I can't connect. I've tried using my local community college's WiFi, my neighborhood library's WiFi, and my local mall's WiFi with my VPN service, but it never connects. I have no problem connecting to Tor at these places, so I suppose they are specifically blocking VPN traffic. How do I get around that? I always read on security-mided sites to "always use a VPN on public WiFi", but I can never do it. Halp!

Try using shadowsocks next time.

>>1585 You could try hosting an intermediary system yourself, say, from your house. Connections to that would probably go through.

You can set something up with SSH very easily and cheaply. See: >>1012 If this isn't a good fit for your need or desire you can purchase VPN access. Some providers will allow you to pay anonymously using crypto-currency or even something like a gift card. I encourage you to research various providers thoroughly before deciding on them. I can say I've had positive experiences with Private Internet Access, but of course your mileage may vary.

>>1450 Much less. Wifi (xfinitywifi/cox) have automatic guest network services. And wifi is much more ubiquitous. Tor relay's have to be explicitly set up and its a narrow adoption use. So I assume active mitm is much lower.

>>1012 this a good and will work for pretty much everything at first If you have that, I think the only real "step up" worth it is going to an IKEv2 server, which is harder to set up

>>993 >It uses the most secure defaults available >[NIST] P-256 yeah right

>home vpn server >vpn server on a vps with single address >Tor with Guard node Use any of things above if you want your location to be tracked by government agencies that put taps on ISP networks and/or datacenters where aforementioned things are hosted. VPNs were never supposed to be used for anonymity or as remote proxy with added encryption link. VPN is just a secure way of accessing remote private(local) network.

ACTUAL ANSWER Setup openvpn on port 53, the DNS port. Most public WiFi has 53 open so DNS can work and they can redirect you to their paywall. Simply connect to your VPN via this port and you'll bypass it

>>4140 >Most public WiFi has 53 open so DNS can work and they can redirect you to their paywall. In that case all you need to do is change your dns server to a 3rd party like 8.8.8.8 who wont redirect you to the paywall and not bother with a vpn. Whoever setup the network is unlikely to be that incompetent though. More likely you can't just connect to anything on port 53 but they do allow arbitrary dns lookups if you treat the gateway as your dns server (like dhcp told you to when you connected to the network). In this case there are tools like Iodine that allow you to tunnel ip over dns. The challenge then becomes getting hosting and a domain name anonymously so you don't dox yourself every time you use it to illegally circumvent a paywall.

>>4140 Next step: set up a DNS tunnel like iodine to sneak on wifi networks that only have DNS allowed before captive portal (they shouldn't do it in ideal situation tho)

>>989 https://github.com/Angristan/OpenVPN-install simple af, noobs

If you use Talis the Tor guard node changes each time. That was a long time ago, the might have changed it by now.

http://www.pivpn.io/ easiest way to set up OpenVPN. pi not required. make sure to verify that your DNS isn't leaking. had this issue but it was a simple fix on the client side.

>>4438 Ive used this and its very nice. Also, other easy solutions: use tor use ssh tunnels