Is it safe to provide others with a VPN server at home?

Question

I'm trying to set up a VPN server on a Raspberry Pi at home to help some friends who live in a country where internet is severely filtered. So far I have found OpenVPN and PiVPN for this pourpose. However, I'm worried because I do not know these friends very well:

• What are the risks? For example can they access my home network (e.g. shared files)?
• What if they use my home network for illegal activities which are illegal in my country?
• Is there any way to do this without these concerns?

The goal is to provide some people with secure unfiltered internet connection. So out of the box solutions which do not hinder my own safety are also appreciated.

Answer 1

You can do it mostly safely with combination of technologies. You will be able to mitigate most of the issues except the illegal activities one. Their outbound traffic will be originating from your home IP address and therefore any illegal actions will point back to you. For the rest of the issues:

• Protecting your home network. You will want to put them on separate VLAN/subnet which has no access to your home network. You can easily do that with many routers, especially if you have OpenWRT, DDWRT installed on your router. Usually how this works is, you connect the PI to one specific port on your router(or you can make guest WLAN if your router supports it) and then in the software you specify that this port is separate LAN which has no connection to the rest of the ports/WIFI, only to the internet. If the router supports guest/multi WLAN you can create one and connect the PI to that WLAN and it will be separated from the rest of the network. If you simply connect the RaspberryPI to your network they will have access to all your internal LAN devices and computers.
• Bandwidth limiting. You might want to limit the bandwidth they can use, so that they wont slowdown/saturate your network. This can also be done on your home router but again it depends on the OS/firmware you have there.
• Setup a firewall on the RaspberryPI or your router which will allow them to only use services you think are safe, for example 80(HTTP) 443(HTTPS). Blocking outgoing connections to port 25 for example will prevent them to send spam directly. It is safe to block everything and only open ports they specifically ask for. This will prevent them do ports scans, bruteforceing services and etc.
• You will need to setup some port forwarding so that the Raspberry can be accessed from outside your home lan.
• Do more deep check on these friends. Trying to help is a noble endeavor but in this day and age the amount of scam/spam/fishing/malware is troublesome and has become profitable business. Even if they don't have bad intentions, their devices might be infected with virus/rat/malware which can spread to your network if you don't take the necessary precautions.

Unfortunately this is not a short topic and I'm not gonna be able to cover all the aspects in detail. You'll have to do some reading and research by yourself. Good luck :)

Answer 2

The risks you mention are real.

For example can they access my home network (e.g. shared files)?

This depends on your setup. If possible you should put the VPN endpoint into a separate zone (i.e. a physically or at least logically separated network) where only access to the internet is allowed from this zone. This physical/logical separation of the machine from your local network is the recommended option.

If your router does not provide this option you might try to add appropriate firewall rules add the VPN endpoint (i.e. the RasPi) itself, in the hope that an attacker will not be able to compromise the machine and change the firewall rules.

The third option is to act like your home network is a public network where anybody has access, i.e. secure all of your devices against attacks from inside the local network. This is probably the hardest thing to do properly.

What if they use my home network for illegal activities which are illegal in my country?

If you are offering unlimited or insufficiently controlled access for others you might be liable. Just imagine that somebody sends a bomb threat through the connection you provide or publishes child porn. This is not only true for the case of a public VPN gateway but also if you create a public hotspot or let others use your network while they are in your home.

If you are personally liable for such things depends on the local law. But even with laws where you are not personally liable if others do illegal stuff in your local network you will at least get into lots of trouble in order to proof that you are personally innocent.

At least in case of creating public hotspots there are some providers which will take this risk from you in that they offer to route the potentially malicious traffic through their own infrastructure, i.e. essentially they are the VPN endpoint and not you. Of course, taking over this risk for you is usually not free.

What are the risks?

There are some more risks:

• You share your bandwidth with others which might affect your own access to the internet
• Since opinions might be expressed by using your network which are not liked by everybody the affected parties might try to shutdown the originating VPN. This will probably affect also your local internet access and maybe even you personally. Such shutdown attempts might be for example technical (i.e. DoS or trying to infect you with malware), legal (trying to force your ISP to disconnect you) but also kind of criminal (harassment, black mailing...).

Is there any way to do this without these concerns?

You might mitigate some risks. Others, like the liability, cannot be reduced much. You have to ask yourself how much do you trust your friends and if the remaining risk are worth it.