4

Is this possible, and how?

Here's the scenario:

  1. Public Web Server hosts basic content for general public.

  2. Private server inside a VPN hosts special subscriber content and services.

    The two servers may not be on the same hardware.

  3. Subscribers have a device with appropriate VPN software with appropriate certificates, logins, etc. For this discussion, let's postulate Android tablet with StrongSwan, but it is really more than just that.

  4. Upon seeking subscriber content, the subscriber opens StrongSwan and initiates the VPN, at which point the Android is off the Internet and on the private network for narrow, special purposes.

The system I describe, more or less, is presently up and running, but Step 4 is presently an inconvenient manual step which the subscriber must initiate.

I would like to automate this step, allow the Internet surfing Android user to click a link on the public page, and have the VPN initiated automatically and control passed to the "inside the VPN" services. At termination of the subscription-based application, the VPN would be taken down and normal Internet access resumes.

Placing code on the web page is one thing. Initiating the VPN on the Android client is less clear to me. The system should also, ideally, detect when the user does not have the appropriate certificates, etc., and send the user to a sign-up page to subscribe to the services.

Am I asking for the moon? Or is this something easily done of which I am simply ignorant?

  • 1
    Without thinking too hard about this, it sounds like you should consider an Android app... – TTT Nov 13 '15 at 22:55
  • Agreed, it does seem like the client-based action would need to be under the control of an app. I was thinking of a Chrome plugin that would respond to the server's command to engage the VPN, and initiate StrongSwan. But does anything like that exist? Not as far as I see, but I was hoping someone else saw further than I. – Nathan Nov 15 '15 at 0:06
1

TLS provides effective confidentiality and integrity for communications. Unless you must prevent TCP/IP header information leaking, an IPSec or similar VPN is likely overkill. Even then the TCP/IP headers in packets for the IPSec tunnel from the Android device's public IP to your services VPN endpoint public IP would still be visible so TLS is still likely better.

If you want users to have anonymity in the presence of hostile snoopers or totalitarian censorship regimes then you may need something like FreeNet or the CE|NO GUI built on it.

  • 1
    Thanks, but that really doesn't help so much. The IPsec VPN is a given, already existing. I am looking for a way to make the movement of the client in and out of the VPN painless and transparent, not advice on how or why not to bother, or alternative VPN technologies. As I said above, my current thought process is to implement something like i describe as a Chrome extension, but am unclear as to whether that is the best solution or indeed indeed whether it is a viable solution. Sounds as if this is new ground. – Nathan Nov 16 '15 at 20:10
  • @Nathan IPSec lives in the network stack and needs to alter routing in the OS to function. This is complicated to achieve from an app and possibly forbidden. The Chrome extension would require pretty broad rights on the end points and that seems like a very inverted risk and effort model for your customers compared to TLS where the effort and risk live with you, the service provider. You may have no choice, but really investigate that in light of the facts with your leadership and see what they think. – Alain O'Dea Nov 16 '15 at 20:21
  • 1
    @AlainO'Dea In your comment, 2nd sentence, you said "...complicated to achieve from an app and possibly forbidden". Did you really mean app or perhaps you meant browser? – TTT Nov 16 '15 at 20:49
  • 1
    @AlainO'Dea IPsec VPN apps already exist for Android. I don't see why they would be any different (implementation-wise) than what is needed for OP's case, except that it would auto-engage/disengage to a specified tunnel as needed. – TTT Nov 16 '15 at 21:15
  • 1
    @TTT that's true. This isn't really an information security question anymore at that point. Then it's an Android integration and automation question ;) – Alain O'Dea Nov 16 '15 at 21:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.