1

Background

Hardware: Dell Inspiron 15 Gaming 7577-92774 with recent BIOS (16-Aug-2018)

Operating System: Windows 10 Pro, version 1803 (Build 17134.285)

Antivirus / Firewall: ESET Smart Security Premium

VPN Provider: Not that I don't trust you, I don't trust anyone, therefore I won't disclose this information

VPN Client: I use their Windows client which proved to work flawlessly

VPN Firewall: They offer their own firewall protection and I have it enabled


Question

Being connected to a trusted VPN, do I still need personal firewall, and if so, why?

By trusted, I mean I relatively trust the VPN provider, no matter that it is highly opinion-based.

Please stick to the question at hand.

  • Is it a full tunnel VPN? i.e. can you computer only talk to the VPN, nothing else? If so, then with the VPN doing firewall, and you trusting the VPN, running a local firewall won't add any security. I'd still do it because the cost is low, but it's not required. By the way, you say you don't trust anyone, but you do trust the VPN provder? – paj28 Sep 13 '18 at 12:55
  • @paj28 If I told you I distrust the provider too, then the question would be irrelevant. Yes, it is a full tunnel VPN. – LinuxSecurityFreak Sep 13 '18 at 13:19
  • Let me guess, PIA? If so, you should probably not trust them. And I fail to see the OPSEC problems with disclosing the VPN provider you use if you open up a new, throwaway account. Not to mention, VPNs are not meant for anonymity, and using them for such is a dangerous idea. – forest Sep 14 '18 at 2:04
1

The 'trusted VPN' client cannot be given full autonomy unless you have reviewed the source code yourself. However, a VPN client with a kill switch is a must if you intend to not use a firewall. This kill switch should either upon disconnect, disable the chosen networking interfaces (those which can access the Internet), or change/enforce firewall policies, so that when the VPN client is active no outbound traffic is allowed, except via their preapproved IP addresses (those which the VPN provider controls), this will then prevent packet and 'true' IP address leakage upon disconnect.

While the VPN client's kill switch via firewall policies will work differently on Windows than on Linux, which uses iptable. Instead, on Windows, often the VPN client will enforce the policies when active via their own firewall. If this occurs, instead of enforcing these firewall policies via Windows Firewall, it causes packet and 'true' IP address leakage if the VPN client is to ever crash.

I can only foresee a firewall and VPN being used together to mitigate packet leakage, do not interpret this as 'I do not need a firewall' as other applications may require one. The above point about the VPN client crashing and the kill switch failing is the main reason I use Linux in this regard. But, this is not required. Instead, you may enforce the firewall policies manually within Windows Firewall. First, create a virtual interface, you will share Internet access to this interface and connect your VPN here. Virtual Interface DMZ

Second, Setup firewall policies for the virtual interface to ensure only the VPN's induction nodes are allowed, in the event of no VPN connection, the firewall will not allow any outbound traffic. Third, enforce firewall policies denying all inbound and outbound traffic except the virtual interface, for the interface with Internet access.

See, Creating a virtual NIC that connects to the same network as physical NIC for the technical configuration.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.