vote up 9 vote down star
6

I recently moved into an apartment where the complex provides free unencrypted wifi. The speed is good for my purposes, but I'm not 100% comfortable with all my traffic being sent over the clear, given that I'll be living here for a while.

I'd like to set up a VPN so that I can surf on the internet and keep all my traffic confidential from any potential eavesdroppers in the neighborhood, or even the network admins. My main concern is confidentiality of the content I send and receive, but if it's not too big a hassle I'd like to keep metadata (like IPs and domains that I'm connecting to and what protocols/ports I'm using) confidential as well.

A friend of mine will let me set up a computer over at his house and letting me be the DMZ on his router. I have a spare laptop I don't use anymore; it's currently running Ubuntu but I can install pretty much any OS on it. I'm running Ubuntu 9.04 64-bit on my main computer (the client).

What do I need to install and configure on my spare computer at the friend's house? What would I need to install and configure on my main computer that I'll be using on an unsecure network? I was looking at OpenVPN but the documentation seemed a bit confusing to me.

flag
86% accept rate
2  
While my situation is somewhat uncommon, I'd imagine the concept could be extended to anyone who frequents coffee shops and the like. – Shane Sep 30 at 5:04
i think you're overthinking this. while it's true the WiFi connection is unencrypted, any encrypted traffic over it is secure (https, ssh, etc). consider if you had a wired connection, would you still be as concerned? i think being DMZ on your friend's router is more concerning, from a security standpoint. just MHO. – ~quack Oct 6 at 0:29
2  
Sure - my encrypted stuff is secure, like banking and email. But I don't know if I'm 100% comfortable with my unencrypted traffic (web searches, IM, sites visited, and pretty much all facebook/forums/superuser traffic) being viewable by my neighbors who know where I live. With wired traffic I can at least rest assured that eavesdropping requires a little more setup than turning on wifi monitor mode and Wireshark or something. – Shane Oct 6 at 17:27
1  
And there's always this: blackhat.com/presentations/bh-dc-09/Marlinspike/… -- VPN is definitely the way to go – emgee Oct 8 at 4:50
I want to do the same thing, so I can set up my phone to access open Wi-Fi nodes automatically wherever I go. – endolith Nov 2 at 15:11

5 Answers

vote up 4 vote down check

I had the same dilemma and I ended up just learning how to set up OpenVPN. It's actually quite simple once you dig in. You're right, the documentation can be a bit obtuse. Below is the howto I referred to when I set it up for the first time. Afterwards, I was able to set it up by hand without a howto on a CentOS server.

This one is for Debian, but it's pretty similar: http://howto.landure.fr/gnu-linux/debian-4-0-etch-en/install-and-setup-openvpn-on-debian-4-0-etch

link|flag
I found this to be the most helpful for my situation. Thanks. – Shane Oct 8 at 3:59
You're welcome. – emgee Oct 8 at 4:50
vote up 2 vote down

The setup you're describing seems to me as being over-complex and prone to problems.
Why don't you look at free VPN solutions such as Hotspot Shield or HTTP-Tunnel Client.

Here is some text from the later:

HTTP-Tunnel acts as a socks server, allowing you to use your Internet applications safely despite restrictive firewalls and/or you not be monitored at work, school, goverment and gives you a extra layer of protection against hackers, spyware, ID theft's with our encryption.

Help and guides for HTTP-Tunnel Client are here.
I also note that higher-speed connections are also available, but for monthly fee.

link|flag
I fiend the "Client" part in the second option a bit confusion, but you're right, according to the website: Low Bandwidth Service Features: Free option for moderate users / Sufficient for Instant Messaging programs (Trillian, ICQ, etc.) / Good for users who only need to access blocked web sites / No spam, pop-ups, or banners – Arjan van Bentem Sep 30 at 9:08
1  
I appreciate it. It's not going to work for me, since my client is a Linux computer, but it may be helpful for other people looking for something similar. I may just buckle down and figure out how to use OpenVPN. – Shane Oct 1 at 2:57
Funny, indeed both services seem to require you to install client software. Why? Still, a cheap VPN provider might work for you, especially as it does not use double bandwidth from your friend's internet connection. – Arjan van Bentem Oct 6 at 8:29
vote up 1 vote down

Maybe SSH port forwarding might be suitable? simpler software setup, works through both windows and linux clients, and such. However, you'll need to forward each port you use.

link|flag
vote up 1 vote down

I assume "I can install pretty much any OS on it" does not include Mac OS X. But for those who want to use their Mac as the VPN server:

Since Tiger (and maybe earlier), OS X has a VPN server built-in. But only the OS X Server editions provide the GUIs to manage that. See an article on PPTP/L2TP VPN Server on Mac OS X Leopard Client on how to manage this using (an old, free version 2.4b of) iVPN, including a note on how to have Windows XP clients connect to it if you're behind a NAT. It's very limited though: only a single username, and no certificate support for L2TP. Perfect for private use while you're at a Starbucks with another computer.

The old (free) 2.4b version might no longer work with Snow Leopard, so you may need to spend the £14.99 to get the most recent version, or do things manually (another guide). (iVPN 4.2 is said to have added support for Snow Leopard.)

link|flag
vote up 0 vote down

Dynamic SSH port forwarding will be suitable. For Windows there is a free SSH server called FreeSSHd. It can be configured tunnel only. And on the client side, you can connect to the server with dynamic port forwarding options. There is foxy-proxy add-on for Firefox which is extremely configurable, and WireCap for making everything on the system to use the SOCKS proxy.

link|flag

Your Answer

Get an OpenID
or
never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.