Is OpenVPN secure in this way?

Question

I'm familiar with OpenVPN because my home router has a builtin OpenVPN server.
I would like to use OpenVPN all the time, but how do I deal with situations where I don't own the routers?

ex.: in a netcafe that I'm using to go through to reach the internet over OpenVPN

Can a router in a netcafe spoof an IP address when I connect with OpenVPN?

My home router has an OpenVPN server that can be only reached through a foo.dyndns.com domain address.

Does using the domain restriction fully protected me, or not?

Can someone setup a "bad" DNS server and a "bad" OpenVPN server in the netcafe so that the DNS response returns a bad IP address, so that I authenticate to the bad OpenVPN server, and have all my traffic sniffed?

e.x.: the "bad" netcafe router would allow all openvpn authentication to it's openvpn server?
Or the connection would not be established, because it's not really my OpenVPN server, just a "bad" one, that an attacker configured?

Answer 1

If you've setup OpenVPN correctly, you've configured the client with a SSL CA that the server certificate should be signed with. If you've kept the CA's private key private, no other OpenVPN server will be able to present a certificate that your client will accept.

Also, the other way around, you can configure your OpenVPN client to use an SSL certificate that was signed by the server, so the server knows to only accept clients it has signed certificates for.

So someone could still try to MitM you, but your OpenVPN client would present a warning or even fail completely (haven't tested it). In the worst case, it becomes a denial of service.