If one is using a VPN from the local machine, how much can a hacker on the local networks router inspect, modify or hijack the packets?

  • 2
    If authenticate that you are in fact connected to the VPN that you intend to connect to (e.g. by verifying the VPN's certificate) then there is nothing that an adversary controlling your router (or your ISP, for that matter) can do to listen-in or tamper with your connection. It's akin to how https protects you from the same threat, as long as you authenticate the site's certificate.
    – mti2935
    Jul 16 at 20:56
  • I've clarified the question in that you mean a VPN running on the local machine - and not a VPN running on the router itself (which lots of routers offer). Hope that the clarification really describes what you were asking. Jul 16 at 21:10

1 Answer 1


That depends on your own VPN configuration. For example, the OpenVPN documentation warns that Man-in-the-Middle attacks are possible, if the certificate is not verified.

When configuring OpenVPN (or any similar VPN software) that way, you essentially tell it "Connect to this server and trust whoever answers on the other side". If an attacker has hijacked your router, it's very well possible that the attacker directs you to an attacker-controlled VPN server, which in turn gives them access to all your connection data.

If, however, your VPN connection is set up to verify that the certificate belongs to who you expect it to be, either through PKI or TOFU, then your VPN software should give you a warning that either no certificate is present, or that the presented certificate does not match what is expected.

In this case, VPNs are not more or less secure than a HTTPS connection made to any HTTPS server (such as https://stackexchange.com). You will receive a warning that no secure connection could be made and you should abort the connection attempt. This will, essentially, leave you stranded without any connection, until you get the attacker off your router.

  • I'm using Proton VPN right now. Is it using certification, so no MITM are possible?
    – Farthas
    Jul 16 at 21:36
  • @Farthas Correct, provided 2 things are true: 1.) The certificate check is mandatory and an incorrect verification will trigger an error. 2.) You do not tell the application to ignore the error.
    – Frosty
    Jul 16 at 21:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.