How to keep secure while browsing on open wifi when SSL VPN is blocked?

Question

After a recent visit to a hotel I was surprised to discover that they blocked access to my OpenVPN server. I often use this as a way to secure my internet traffic when I am on public wireless. Besides using only SSL based websites, or tunneling over SSH what options do I have to ensure that no one can sniff my packets while they are being broadcast in plain text through the air?

Answer 1

If you can arrange this ahead of time (or get someone to do it for you), you could set up an SSL proxy (e.g. via stunnel), which would in effect be creating an SSL VPN.
Not so different from tunnelling over SSH, I guess, but it is another option.

Answer 2

I see, you did say "besides using only SSL websites". Nevertheless for many it's not such a bad option to content yourself with the thousands of SSL sites listed in the Firefox and Chrome extension HTTPS Everywhere until you get back to an access point that supports your VPN. Limitations include that eavesdroppers would be able to see which sites you visit and that the extension does not prevent sites from incorporating unsecured resources such as Wikimedia Commons pictures into the secured pages.

Answer 3

Just some thoughts:

• One important thing that people tend to forget: hotels are not evil, they are just careless.

• Blocking outgoing traffic is not a good security practice, it's just security through obscurity at best. Which can very easily be defeated. So instead of reducing the user experience and providing fake security, tell them to change their filtering policy.

• If they refuse or are too slow, add a redirection rule to redirect your traffic on port 80 to your VPN port. Or just change it's port to 80...

How to keep secure while browsing on open wifi when SSL VPN is blocked?

Actually it really depends on what you exactly want to achieve, what you really want to protect, etc. Using basic firefox plugins such as perspective/https everywhere, would provide a relatively secure browsing experience.

Since you have a VPN set up, it would be nice to use it, it's one step further and, if properly set up, can provide a fair level of anonymity and security. Refer to my previous point.

Answer 4

I would like to point out that if you browse "external" Web site then your packets will travel unencrypted at some point. Your VPN (or SSH or SSL proxy or whatever) only avoids that to happen in your immediate vicinity; it defeats attackers who are in the same hotel than you. But it does not defeat attackers in general. If you worry about eavesdroppers, then you should visit HTTPS sites only, regardless of WiFi, hotels and VPN.

---

Besides the other answers, you could also open a RDP session to a server on which you have an account. If you took care to set the server on port 443, then most firewalls will let that pass (RDP uses a specific transport layer which is distinct from a SSL/TLS connection, but few firewalls inspect data with enough attention to notice that). RDP 5.2 encapsulates a TLS session, so that's as secure as you can get. Web browsing through an exported desktop session can be a frustrating experience, but it is tolerable for text-based sites like, e.g., security.stackexchange.com (I am doing it right now).