6

iOS version 5 and newer has a setting for VPNs to "Send All Traffic" over that VPN. I think that sending all data to a trusted VPN target would ensure privacy of all communication sent over that WiFi link, and also prevent disclosure of HTTP cookies.

  • How effective or reliable is that setting in protecting a user's traffic over wifi?

I'm concerned not only about all data being captured and redirected over VPN, but also denying everything including DNS lookups (or limit them) prior to the VPN even being established.

My intuition tells me that since a VPN host name needs to be resolved over DNS, there are exceptions to the checkbox "Send ALL Data".

  • What applications, APIs, or services are exempt from the "Send All Data" setting in VPN?

  • Can the DNS name be spoofed for hosts that are expected to be protected over the VPN profile?

Improve this question
9
  • 1
    This question appears to be off-topic because it is about the documentation of a feature in a commercial software. It's better asked to the software authors or on special forums for that software.
    – Adi
    Commented Sep 19, 2013 at 17:28
  • 3
    I'm asking here because of the prevalence of iOS and the proven and widespread risk that Wifi based attacks. In addition this is useful to IT Shops. Per scope of the FAQ "IT Security Stack Exchange is for Information Security professionals to discuss protecting assets from threats and vulnerabilities." makes this on topic in my mind. @Adnan
    – makerofthings7
    Commented Sep 19, 2013 at 17:39
  • 1
    Asking how and whether VPN protects "assets from threats and vulnerabilities" is completely legitimate and on-topic. Asking how a very specific option "Send All Traffic to VPN" in an operating system (iOS in this case) is off-topic. To make things even more off-topic, you're asking about a largely undocumented behaviour, especially the part about which APIs and applications bypass that option. Just because the question has security implications, doesn't make it on topic.
    – Adi
    Commented Sep 19, 2013 at 17:51
  • @Adnan A question about an undocumented buffer overflow isn't fundamentally different from a security feature that doesn't do what's expected. So you're saying that any product specific configuration, or feature is off topic? Or that any poorly defined API with a buffer overflow is off topic? I've seen the community respond positively to these types of question in the past, and think it's best that everyone get on the same page on what is and isn't on topic
    – makerofthings7
    Commented Sep 19, 2013 at 18:23
  • You are, intentionally or unintentionally, trying to twist the guidelines to make this question appear legitimate. This is a feature by a software vendor, and you're asking us how the vendor intended for it to work. VPN usually means all the traffic are routed. Does Apple give special applications some special access to bypass the VPN? Who knows! Maybe they do. That's why you have to ask them. We're not going to reverse-engineer iOS for you.
    – Adi
    Commented Sep 20, 2013 at 12:31

2 Answers 2

Reset to default
3

Assuming the VPN is setup securely, this gives good protection against WiFi attacks.

You're right that any traffic needed to setup the VPN will go directly on the WiFi. DNS spoofing could happen during VPN setup. Depending on the exact setup of your VPN, the VPN may have protection against this (by server certificate or shared secret) - or it may not.

As I understand it, once the VPN is setup, and "Send All Traffic to VPN" is enabled then DNS queries go over the VPN. So you are safe from DNS spoofing on the WiFi network (although potentially, someone on the same VPN could spoof you). Note: I have not actually tested this with Wireshark, although that would be an interesting exercise.

Improve this answer
1

This functionality is what they call Split-tunneling. When "Send All Traffic to VPN" is enabled, this allows your local network traffic to not be routed across the VPN. The idea for this is to prevent your locally routed network from being sent across the VPN.

Long story short, if you enable this, all your traffic will be encrypted by the VPN tunnel. Local traffic will go across your VPN.

If it's disabled, and you are browsing the internet, it can go across the WiFi locally, or the VPN, depending on the routing supplied by the VPN.

Improve this answer
4
  • I think your second sentence is negating your last.
    – Brian Adkins
    Commented Sep 19, 2013 at 18:14
  • 1
    no. Leaving this off means split-tunneling is enabled. This means that local traffic stays local, and other traffic goes VPN. if you enable it, ALL traffic, including local, goes across the VPN.
    – Mike Mackintosh
    Commented Sep 19, 2013 at 18:27
  • How does this answer the question?!
    – Adi
    Commented Sep 19, 2013 at 19:36
  • by understanding what traffic is traversing what path you can figure out the amount of security said path has... of course the initial DNS lookup and VPN setup will always be outside the tunnel
    – Mike Mackintosh
    Commented Sep 19, 2013 at 21:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .