5

It’s a best practice to use VPN when you connect to public Wi-Fi networks. However, in the scenarios I am aware of, you first connect to the network and only then—after connected—switch to VPN. In that case there is time-window when your traffic goes on an insecure connection and you are vulnerable.

My concern is many programs/services/processes running on a PC execute a housekeeping/update check/status check as soon as a network connection is available. And all those activities would be performed via an insecure connection if they are triggered before the switch to the VPN connection.

Is it possible to avoid this?

Improve this question
5
  • 2
    Yes it does: many programs/services/processes running on your pc execute housekeeping/update check/status check as soon as a network connection is available. And all those activities will be performed on insecure connection until you switch to VPN.
    – peterfoldi
    Apr 4, 2015 at 15:14
  • @peterfoldi: You beat me by 75 seconds!
    – G-Man Says 'Reinstate Monica'
    Aug 16, 2015 at 16:47
  • Use superuser.com/questions/262799/… to remove default route (route delete on 0.0.0.0), add route (route add) to VPN network going through default gateway so you allow VPN to establish. Let VPN connection give you default route to 0.0.0.0
    – ThatOneDude
    Aug 18, 2015 at 0:36
  • @ssnobody this sounds like a possible solution on Windows. And I guess something similar is possible on the other systems. The question is if this event is triggered soon enough after connection status change. I have a mac atm. I will try to "port" this to mac after the weekend. Do you want to make it an "answer" instead of a comment?
    – peterfoldi
    Aug 25, 2015 at 8:32
  • I think my comment would have to be fleshed out to be an answer. OS X version of Windows part over at superuser.com/questions/391799/… though if you'd like to undertake the task.
    – ThatOneDude
    Aug 25, 2015 at 14:54

2 Answers 2

Reset to default
1

How you do this specifically depends on what OS you use and what firewall you use. The general rule is to set your firewall to block connections by default so nothing can access the internet at all, then manually add the required rules for the VPN to work.

In Windows for example, the built-in firewall rules can be changed to default block on outbound on a per profile basis. If you do this on the Public profile, then nothing can access the internet. Then, create an allow rule for your VPN client software, so nothing can access the internet other than the VPn client. Finally, either assign the VPN to a private profile or add additional rules to allow outbound access through the VPN interface alone.

On Linux for example, it is very similar, setting the default outbound rule to 'DROP' in iptables, add a specific allow rule to your VPN server, and then adding a specific allow rule for all outbound traffic via the VPN adapter.

Improve this answer
0

It would take some time and effort on your part to do the set up, but if you are concerned enough about the security risk arising from automatic updates, then you can use your Firewall to block application access.

This post gives you the details on how to do this for Windows 7, but most firewalls have a similar concept where you can control the inflow and outflow to your computer.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .