Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

After a recent visit to a hotel I was surprised to discover that they blocked access to my OpenVPN server. I often use this as a way to secure my internet traffic when I am on public wireless. Besides using only SSL based websites, or tunneling over SSH what options do I have to ensure that no one can sniff my packets while they are being broadcast in plain text through the air?

share|improve this question
2  
Have you considered changing the port on your OpenVPN server to something non-standard? The solution would be to only use secured wireless. When one is not offered its a perfect case where a 3G/4G connection should be used. –  Ramhound Feb 28 '12 at 12:55
1  
Have u tried running your openvpn on 443 ? I think if they allow HTTPS, they should allow openvpn traffic on 443 too. –  Lucas Kauffman Feb 28 '12 at 13:33
1  
If tunneling over SSH is an option, thats a very good way to protect your session. Any reason you are looking for options other than that ? –  Shivam Feb 28 '12 at 16:02

4 Answers 4

up vote 7 down vote accepted

If you can arrange this ahead of time (or get someone to do it for you), you could set up an SSL proxy (e.g. via stunnel), which would in effect be creating an SSL VPN.
Not so different from tunnelling over SSH, I guess, but it is another option.

share|improve this answer

I see, you did say "besides using only SSL websites". Nevertheless for many it's not such a bad option to content yourself with the thousands of SSL sites listed in the Firefox and Chrome extension HTTPS Everywhere until you get back to an access point that supports your VPN. Limitations include that eavesdroppers would be able to see which sites you visit and that the extension does not prevent sites from incorporating unsecured resources such as Wikimedia Commons pictures into the secured pages.

share|improve this answer

Just some thoughts:

  • One important thing that people tend to forget: hotels are not evil, they are just careless.

  • Blocking outgoing traffic is not a good security practice, it's just security through obscurity at best. Which can very easily be defeated. So instead of reducing the user experience and providing fake security, tell them to change their filtering policy.

  • If they refuse or are too slow, add a redirection rule to redirect your traffic on port 80 to your VPN port. Or just change it's port to 80...

How to keep secure while browsing on open wifi when SSL VPN is blocked?

Actually it really depends on what you exactly want to achieve, what you really want to protect, etc. Using basic firefox plugins such as perspective/https everywhere, would provide a relatively secure browsing experience.

Since you have a VPN set up, it would be nice to use it, it's one step further and, if properly set up, can provide a fair level of anonymity and security. Refer to my previous point.

share|improve this answer

I would like to point out that if you browse "external" Web site then your packets will travel unencrypted at some point. Your VPN (or SSH or SSL proxy or whatever) only avoids that to happen in your immediate vicinity; it defeats attackers who are in the same hotel than you. But it does not defeat attackers in general. If you worry about eavesdroppers, then you should visit HTTPS sites only, regardless of WiFi, hotels and VPN.


Besides the other answers, you could also open a RDP session to a server on which you have an account. If you took care to set the server on port 443, then most firewalls will let that pass (RDP uses a specific transport layer which is distinct from a SSL/TLS connection, but few firewalls inspect data with enough attention to notice that). RDP 5.2 encapsulates a TLS session, so that's as secure as you can get. Web browsing through an exported desktop session can be a frustrating experience, but it is tolerable for text-based sites like, e.g., security.stackexchange.com (I am doing it right now).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.