10

I want to open my home network so I can connect to it via VPN to do things™ while not at home. This concerns me because I am potentially opening doors that I don't know about.

What tools can I use from home/remote to test if my firewall(s) hold up against a fairly standard range of penetration vectors without throwing chunks of money at some white hat hacking company?

I do trust my judgment in configuring the firewall(s) correctly, but I still want to make sure that at least the script kiddie next door won't come barging in as soon as I open the ports for a VPN.

  • 1
    Well, the script kiddie next door, that would be me (for you). But seriously, a somewhat sane router/VPN setup should be quite safe. I'm doing that. Note that there's country-based geo-IP rules on firewalls as a commodity feature nowadays, which of course won't hold back the script kid next door, but all the ones who aren't next door. So if you just forward one port on the router to the VPN server, and only allow traffic from a limited IP subset, and pre-share keys, the risk is pretty low. Really, apart from scary stuff the scale of Heartbleed, there's not much of an attack surface there. – Damon Feb 9 '15 at 18:52
  • Tool recommendations are explicitly off-topic on this site, as they are subjective and tend to change rapidly over time. See also our help center, especially security.stackexchange.com/help/on-topic. Perhaps you might like to edit the question to ask about what you can do to test your firewall configuration (or the steps you should take to protect yourself), instead of asking for tool recommendations? – D.W. Feb 9 '15 at 22:43
13

Well, open port does not necessary mean that anyone can enter. If you have an open port on a router/modem with nothing listening behind, then there is nothing to compromise.

Of course, this won't let you work from outside your home either. For this to happen, you have to put the VPN server and make it listen to this open port.

What are the vulnerabilities (most probably not exhaustive) :

  • a flaw in the router treatment of the IP packets. An intruder sends information with modified content that should have come to the VPN server computer, but instead it got send to a completely different machine (and/or port)
  • a flaw in the VPN server software. E.g. buffer overflow and such, which could allow someone to send forged packets to execute specific commands, or a failure in the password validation
  • a human flaw : you wrongfully configured your VPN server so he now accepts anonymous connection instead of rejecting them (for example), or you chose a stupidly-easy password as your credentials (admin/admin, florian/password12)
  • a flaw in the VPN's protocol, e.g. if poorly designed there could be a way to used wiretapping to recreate an authenticated connection to your VPN.

If you're not a security expert, there are basically no chance that you can find the vulnerabilities by yourself. So what you should do is follow the "best-practices":

  • use well-known software that uses well-known protocols. If there is a vulnerability, they will most likely be patched quickly and thus minimise the time-frame of your own network vulnerability
  • use good passwords
  • do not connect on your home network from computers you can't trust, there could be keyloggers for example
  • if you are not confident enough to set things up, perhaps you can find someone you trust to do it for you

If you want to test your own security, there are multiple tools dedicated to this (Nessus, metasploit, ...). They are not really "automated" way to assess the security of one's network, you need expertise to define the tests you want them to perform. There might however bundle some "classic" attack patterns.

  • Thanks for the input. I was thinking that this is the answer I would be getting. You are right that I am not a security expert, but I am interested in learning anything. I will look into the tools you mentioned, maybe I will find something that increases my feeling of security and will make sure to follow the best practices (which I am already doing, AFAIK). – F.P Feb 9 '15 at 16:11
  • One of the most important things you can do is make sure the router firmware is relatively new. Many older routers run old firmwares that contain known vulnerabilities. These routers do not upgrade themselves, nor do people usually check for upgrades. I wouldn't recommend it to the casual user, but you might like to try installing the latest DD-WRT ( dd-wrt.com/site/index ) on your router if you have not already. – James Mishra Feb 9 '15 at 20:42
  • 1
    "a human flaw : you wrongfully configured your VPN server to reject anonymous connection (for example)" Could you explain this in more detail? – Digital Chris Feb 9 '15 at 21:24
  • @DigitalChris I just took this as an example. If you do not understand the functionality provided by your device, you might end up thinking you did something when in fact you did nothing. I don't think there are even option to have anonymous connections setting on most VPN server software, that is just a random choice. – M'vy Feb 10 '15 at 8:50
  • @M'vy I was trying to point out and allow you to fix where I assume you meant to say " you wrongfully configured your VPN server to allow anonymous connection" – Digital Chris Feb 10 '15 at 14:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.