0

I have an openVPN client on my personal Ubuntu laptop in order to connect to two specific company web servers thru ssh.

Can the SysAdmin who manages the VPN server track my non related internet traffic?

This is the client config:

client
dev [OMITTED]
proto udp
port 1194
remote [OMITTED]
nobind
pull
persist-key
persist-tun
ca [inline]
cert [inline]
key [inline]
remote-cert-tls server
tls-auth [inline] 1
auth SHA512
cipher AES-256-CBC
verb 0
route-method exe
route-delay 2
auth-user-pass foo.txt
comp-lzo

From what I can understand he cannot but I would really like to be sure this is not a possibility.

EDIT: If so, what can I change in the configuration to only route the traffic to those 2 servers thru the VPN.

(Also, does putting the servers behind a VPN make any sense when access is already done with ssh? This could maybe be on another question!?)

Thanks!

6
  • The VPN server administrator can track whatever passes through the VPN links. If you don't want that, don't use the VPN for Internet access. Mar 27, 2020 at 18:01
  • I wish I wouldn't, like I said this is only to access two company servers and was the only option the sysadmin gave me. Mar 27, 2020 at 18:21
  • 1
    Can you add your routing table after a successful OpenVPN connection (ip route or ip route show dev tunX, where tunX is your tunnel virtual interface, probably tun0). An OpenVPN client can ignore the routes that the server sends to it. Mar 27, 2020 at 18:29
  • default via 192.168.1.254 dev wlp5s0 proto dhcp metric 600 linkdown 10.20.25.0/24 dev tun_xx-de proto kernel scope link src 10.20.25.210 10.20.25.0/24 via 10.20.25.1 dev tun_xx-de metric 1 169.254.0.0/16 dev wlp5s0 scope link metric 1000 linkdown 192.168.1.0/24 dev wlp5s0 proto kernel scope link src 192.168.1.75 metric 600 linkdown Mar 27, 2020 at 18:55
  • 1
    The routes to send to the client are defined in the server config. You can read what the server sends you in the OpenVPN log files or see its effects on the routing table. In your case only the 10.20.25.0/24 network is routed through the VPN connection, the rest of the traffic uses your normal connection (so can be tracked only by your ISP). Mar 27, 2020 at 19:13

1 Answer 1

1

Based on the information (particularly the routing information in the comment) the VPN provider currently only can monitor data going to 10.20.25.* - which is not general Internet traffic. Thus they can't currently monitor your traffic generally.

You might want to be aware that technically they may be able to change the routing across the VPN to direct all traffic through it. This can (theoretically) be done by there server without any changes on your side.

If you don't trust them not to do this, modern versions of openvpn allow you to limit the routes they can publish (ive not used this myself though). See https://unix.stackexchange.com/questions/16500/how-to-refuse-routes-that-are-pushed-by-openvpn-server

Not the answer you're looking for? Browse other questions tagged .