Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm familiar with OpenVPN because my home router has a builtin OpenVPN server.
I would like to use OpenVPN all the time, but how do I deal with situations where I don't own the routers?

ex.: in a netcafe that I'm using to go through to reach the internet over OpenVPN

Can a router in a netcafe spoof an IP address when I connect with OpenVPN?

My home router has an OpenVPN server that can be only reached through a foo.dyndns.com domain address.

Does using the domain restriction fully protected me, or not?

Can someone setup a "bad" DNS server and a "bad" OpenVPN server in the netcafe so that the DNS response returns a bad IP address, so that I authenticate to the bad OpenVPN server, and have all my traffic sniffed?

e.x.: the "bad" netcafe router would allow all openvpn authentication to it's openvpn server?
Or the connection would not be established, because it's not really my OpenVPN server, just a "bad" one, that an attacker configured?

share|improve this question
add comment

1 Answer

up vote 7 down vote accepted

If you've setup OpenVPN correctly, you've configured the client with a SSL CA that the server certificate should be signed with. If you've kept the CA's private key private, no other OpenVPN server will be able to present a certificate that your client will accept.

Also, the other way around, you can configure your OpenVPN client to use an SSL certificate that was signed by the server, so the server knows to only accept clients it has signed certificates for.

So someone could still try to MitM you, but your OpenVPN client would present a warning or even fail completely (haven't tested it). In the worst case, it becomes a denial of service.

share|improve this answer
    
"to only accept clients it has signed certificates for." - how to do this?? –  LanceBaynes Aug 22 '11 at 11:49
2  
Have a look at this: openvpn.net/index.php/open-source/documentation/howto.html#pki –  Christoffer Aug 22 '11 at 12:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.