Hacker News Reader

Comment by tristor | Hacker News Reader

There are numerous ways to defeat a VPN on a client device, this is why I prefer to put a router that terminates VPN tunnels with no other available routes between my clients and the Internet when I feel the need for a VPN. You can trivially set up one of these "travel routers" and carry it with you everywhere, which is exactly what I do.

View on HN

I highly encourage dedicated VPN routers at home with each router having it's own wifi network as a way to connect to VPNs. It's easier to connect and more reliable than locally running VPN software on each device imho.

Eg. I have a router sharing wifi for 'work' with a permanently maintained vpn connection to the workplace intranet. Another sharing wifi as 'Australia' that I connect to whenever I want to watch TV from Australia with a VPN to an Australian server and lastly the standard home Internet wifi.

It's super easy to do if you have a couple of old wifi routers and even cheap home ones seem to have some VPN support these days. A big advantage, aside from centralizing the VPN setup so you don't screw it up is that it's trivial to connect any device to the VPN. Just join the relevant wifi address! Boom I'm now in a VPN to Australia from any device without messing around setting up that device specifically because I connected to the 'Australia' wifi.

I do this with multiple old routers but I actually think there's probably a market for a single home router that vpns to multiple locations in the world with a different wifi network for each of those just for the sake of easily having your TV/Roku/iPad appearing to be from somewhere else trivially.

Is there a simple DIY? Is it as simple as running a custom router firmware or software on a small mini PC? Last I looked into this a couple years ago, it basically wasn't possible to chain multiple VPN providers on the same machine, even using VPNs, but maybe I'm misremembering. You could of course just use the built-in VPN connection of your router, but that lacks all the benefits of updated software/firewall, and I want my family to be able to watch Netflix, browse the web without running a CAPTCHAthon, etc.

https://kiljan.org/2021/12/14/vpn-as-wan-for-guest-network-o... is a great start for how to set up a WiFi network with an always-on VPN

The attack is only possible when you have untrusted devices on your local LAN. If you’re already bringing your own gateway with a VPN on it then I’m guessing untrusted LAN devices aren’t much of a concern. But if you did have something untrusted on your LAN and you’re using DHCP, then that untrusted device could snoop your unencrypted* traffic with this trick, albeit it couldn’t find your real IP since your gateway is concealing that.

The attack seems most feasible in a coffee shop wifi situation, where you’re unlikely to be bringing your own router.

*by “unencrypted traffic” I mean traffic that’s not encapsulated for transport to your VPN provider. Most everything is HTTPS nowadays so the contents of that traffic would still be encrypted of course.

Why would you be unlikely to bring your own router in a coffee-shop situation? My travel router fits in a small pouch with its power adapter and together is no larger than a couple of decks of cards. If I have my laptop, then I have my backpack, which means I have my travel router.

Hah, well I have a travel router as well I use for things like hotels, but I wouldn't really want to bring it to a coffeeshop because the setup process is a bit onerous. I need to get the travel router to connect to whatever the coffeshop's wifi is and then get through its captive portal. The last part can be tricky in my experience though it's certainly doable.

Personally I wouldn't bother with the hassle and would instead just rely on an on-device VPN which I now would need to ensure is protected from this type of attack.

If you could list some hardware and software, it would save us the effort ...

I currently carry a GL-Inet MT-3000 with me.

I'd imagine most travel routers are still vulnerable to this.

How? Serious question.

This uses DHCP Options to set routes, which is an optional behavior on the client (but on by default), I have it disabled. I also don’t allow setting DNS via DHCP or anything but giving me an IP and gateway. Clients behind the device are unimpacted, the device itself is configured in a way which eliminates this vulnerability.

Reply on news.ycombinator.com