3

Here's the problematic I'm stuck with, in the next months I'm going to move in, in a little house in France. For the network connectivity the house owner decides to buy a single internet connection. So basically the ISP box is shared with 2 others people but is in my house, so if I decide to unplug it, I cut the connection for the others but anyway.

The first thing that comes to mind was that if I can sniff over the network the other can too, I solved the problem for other possible attacks like ARP cache poisoning etc...

So I come with an idea, but I'm not sure about it that's why I post here.

Here, a basic network diagram (PC 1 and PC 2 have only WIFI access since the box is in my house)

Network diagram

Let's see the second diagram :

enter image description here

This is the solution I come with, except if I managed to detect that one PC is in promiscuous mode (with nmap per example), I cannot really prevent the traffic sniffing inside my network.

Theoretically according to the second diagram, my PC sent unencrypted data to the router, the router encrypt them with IPSec or with OpenVPN tunnel then route them to my ISP Box, so if PC 1 or PC 2 sniff on the ISP Box they cannot read the datas since they are encrypted through the router, is that correct ?

Feel free to share with me other solution that could do the thing and correct my English :)

Improve this question
3
  • Do you have reason to believe your roommates will be well-versed in network security and additionally be assholes who want to eavesdrop on you?
    – Xiong Chiamiov
    Nov 18, 2016 at 20:14
  • Honestly, I really don't know but I'm studying IT Security and we can't be too careful.
    – C. Jizz
    Nov 19, 2016 at 17:34
  • You can be too careful: most people would probably consider it overkill to delete all your internet accounts, get plastic surgery, move to a secluded mountain and live in computer-less solitude the rest of your life, even if that's a great way to cut down on network security attacks.
    – Xiong Chiamiov
    Nov 20, 2016 at 17:31

2 Answers 2

Reset to default
2

Instead of setting up a VPN endpoint on your router, why not set up on somewhere in the internet? Get a cheapo Virtual Machine somewhere, and use that to run something that comes more or less ready-to-use with a VPN endpoint.

But: I'd argue (and that is very rarely the case) that if your router is correctly set up, you don't even have a problem:

Packets coming from your PC go to your router through a cable, and packets for your PC go through that same cable, in the other direction, if I understand your system correctly. The router has no reason to send any of the IP packets meant for you to the Wifi, and thus, the others don't even get to see those packets.

If you're sharing a Wifi with them (ie. your PC is connecting using wifi, like PC1 and PC2), and you've got WPA enterprise, then you get a secure session- and machine-specific encryption key, and the packets sniffed off the air will not be decryptable by the other members of your Wifi. (This doesn't apply to WEP, which is absolutely obsolete, anyway, and not really to WPA-PSK, for which it's possible for any authorized user of your Wifi to derive your secret wifi transmission key by observing a couple of your packets)

Improve this answer
4
  • Setting up a VPN to a location on the internet is the more secure option. This is true because unless you are the only one with physical access to the ISP box, you cannot stop someone from making that box insecure at some future time. Although using an internet VPN relies on the dependability of the VPN provider, it is not accessible to manipulation by your roommates like the security of the ISP's box would be. A sniffer on the cable between the ISP box/gateway and the ISP would be foiled by a VPN to the internet, but not by a VPN to the gateway.
    – Mark Ripley
    Nov 19, 2016 at 8:48
  • @Marcus Müller To answer to your first question, if I set up a VPN somewhere in the internet the packet will first transit through my ISP Box to reach the VPN tunnel so if someone sniff on it they can read my packets. However, what you mention about WPA Enterprise seems fit my expectations.
    – C. Jizz
    Nov 19, 2016 at 17:33
  • No, they can't. The point of a VPN is that it is encrypted
    – Marcus Müller
    Nov 19, 2016 at 17:35
  • You're studying IT security and don't know that a VPN is encrypted to mitigate eavesdropping? Study harder!
    – Marcus Müller
    Nov 19, 2016 at 17:38
1

It seems that you are looking for LAN Isolation. Basically isolating one LAN port from another is what it does.

Your ISP Box can have such option.

If you don't have "LAN Isolation", you might have "VLAN", but once you have VLAN, you will have "Network Policy" where you can secure VLANs. When using VLANs, each client is on dedicated Virtual LAN (own subnet), so therefore various attacks wont work. Only VLAN isn't enough, you would need to apply some policy to prevent all possible attacks. If there isn't VLAN, there should be "LAN Isolation" which is one-button simplified version.

Encrypting traffic from home router to router (as on your diagram) would work but it's quite complex and might not work as intended, especially if various models of routers are used.

Improve this answer
1
  • Yeah, I thought about VLANs too but since I don't know what options the box provides I try to anticipate a bit. So theoretically, if I put all my devices inside a VLAN that I create; that I apply the correct rules and I put my neighbors into a separate VLAN, they couldn't (if they try) sniff the data sent by my VLAN through the box to Internet and coming back to my VLAN ?
    – C. Jizz
    Nov 18, 2016 at 14:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .