Ask HN: How to mask location for a corporate VPN? | Hacker News Reader

Ask HN: How to mask location for a corporate VPN?

3 pointsnodelessness4 comments

I am working for a publicly traded company. I have been spending the past 9 months alone in my apartment in Europe and it's driving me crazy. Having been recently separated has aggravated the effects.

I am hoping to work from a SEA country for 2.5 months. My employer is publicly traded.

I have already asked my manager about it and while he himself is unconcerned, the HR Policy is that they are not able to allow more than two weeks of work from another country. Any more will entail that I go on vacation, unpaid leave or be terminated.

I am hoping to avoid the latter scenarios entirely. I have to do what I have to do to take care of my mental health. And my management and company has to do what they have to do to keep their hands clear of legal liability.

I am working out how I can work in another country

I have a Macbook Pro 15'' 2016 model. I have an USB-c extension port set that has a

Let's set aside the whole question around my visa in this new country. A friend of mine recently worked outside of a European country for couple of months and has already received an email from his employer's legal department. I am inclined to think this is a reality of working for a publicly traded company.

I am looking for a technical solution to create no record of the corporate VPN seeing that I am in the SEA country. How do I do that?

This is what I have so far:

I will use Wifi to connect a Windows mini-PC to whatever WiFi I have access to. I will then use that Wifi to tunnel my internet to the European country I live in. I will share the tunnelled internet via Ethernet and connect the Macbook Pro to that Ethernet and let the corporate tunnel through my tunneled internet. I will turn off WiFi entirely and make sure to never turn it on lest they discover ambient SSIDs and discover my location.

Is this approach fool proof? Do you have a better idea?

There are pocket-sized travel routers which have Wi-Fi & Ethernet ports and run OpenWRT.

You can run a VPN client on it, connecting to the outside world via Ethernet and then making an access point bridged with the Wi-Fi interface. The other side can be a VPN server (running on a similar router or any Linux PC) at your home as to appear as your typical residential connection. I wouldn't recommend using any commercial VPN provider as they could risk raising some security concerns. Given that you keep your home and internet connection, just use that. Get a cheap used laptop or Raspberry Pi as the VPN gateway if you don't have one already.

Any device connected to that Wi-Fi access point will appear as if it was on your local network (on the other side of the VPN tunnel); the only giveaway could be latency to local devices and potentially reduced MTU, but someone would have to be explicitly looking for this and running tools while remoted into your machine to detect that.

Note that modern laptops use Wi-Fi for their own location services and can detect their location based on the networks around them (the actual network names/BSSIDs, looked up in a DB as opposed to the IP given by the network), in which case you're probably better off keeping Wi-Fi off (or even physically disabling it by removing the wireless network card or sabotaging it in some way) and using Ethernet to connect to your travel router.

Regarding your approach, this is mostly fine but I'd suggest using Linux for this and lower-level tools such as StrongSwan and IPTables rather than a Windows PC and a commercial VPN client, just to avoid any potential undefined behavior where the VPN could disconnect and somehow your "fake" LAN interface gets bridged or NAT-ted to the "true" LAN interface instead of simply going dead.

>Do you have a better idea?

Not trying to fool your employer. If anything goes south, you'll probably get the boot.

spontaneously i came up with using a hardware based IP KVM device instead of moving the laptop physically.

Unless you have a direct fiber link between the two sites, the latency and large bandwidth requirement will make it unusable. Remember that unlike Remote Desktop protocols where advanced ones merely send draw commands, an IP KVM has no understanding of what’s being displayed and must send the entire image as a video stream.

Reply on news.ycombinator.com