2

I would like to use the most efficient and safest method of securing my wireless traffic in an "open" setting such as free WiFi in a coffee shop. What's more efficient and more secure: a SOCKS proxy (I currently use, shown below) or a IPSec VPN connection?

I have a Smoothwall Firewall/Router set up at home on cable modem with SSH server running. (Smoothwall also supports a single IPSec VPN instance.) I've been using an SSH connection to the Smoothwall box passing all local Ubuntu Linux traffic through a SOCKS proxy in Firefox to the SSH server at home. Here's the console command I use:
ssh -D 5678 -p 222 non_root_user@_a_DynamicDNS_DNS-name

This takes all local traffic over the 5678 port and sends to the 222 port on the SSH server on Smoothwall. I'm essentially passing all my traffic encrypted through the local open WiFi router, back to my Smoothwall box at home, getting to the Internet sites I want, and then re-encrypted on the return leg to the coffee shop. I've had friends sniff this traffic and it tests as encrypted.

I understand the concept of a VPN but have never set on up. I guess I don't really understand if I would benefit from using a VPN as opposed to the SSH connection I'm using now. Yes, there would be times that it would be nice to access home PCs and printer while remote - I've tried free version of LogMeIn and that's worked for PC access.

Any thoughts or words of wisdom?

2 Answers 2

1

If all you want to do is secure web browsing, the setup you describe should work fine. However, your solution just secures HTTP traffic. A VPN would setup a secure network pipe between your laptop and your home office. In theory you could run any protocol on this pipe, including SMTP, POP3, IMAP, SMB, NFS, etc. As long as this traffic was routed through the VPN, it would be secure.

1
  • Patrick - sorry for the long delay in responding to your answer as well. Yeah the SOCKS setup is pretty simple and works, but you're absolutely right about only being for the HTTP traffic. the VPN would be a much better solution for all protocols, not just HTTP.
    – Beely
    Aug 17, 2011 at 21:38
2

Use openvpn. You can do a pre-shared config and it will be an easy setup. There is a client and server component for windows and linux.

This is great even in corporate environments, where they might block outbound ssh traffic. You can run your openvpn over port 80 and most unsophisticated networks would never know what you're up to.

The main advantage also would be that you don't have to monkey with proxy settings on your browsers everytime you go the ssh route.

A cool advantage also is that with some tweaking you can even have your DNS requests going to your home machine, keeping that quiet. Otherwise, in the ssh scenario you might be leaking requests to the local coffee shop dns server.

3
  • Agreed. I have been using it for 2 years now - linux and windows clients work very good. Be sure to use the GUI client if you use windows.
    – laurent
    Aug 14, 2010 at 21:22
  • Matt, Thanks so much for the great, thoughtful response - I think openVPN sounds like the way to go! I'll check to see that Smoothwall supports openVPN - I'd be surprised if it didn't! Again, thanks! -*-Bill
    – Beely
    Aug 16, 2010 at 18:53
  • Laurent - sorry for the long delay in responding to your answer! Good to hear that the openVPN works well for you too - my wife has a Windows-based netbook and I could see how openVPN would affect her access/speed/responsiveness.
    – Beely
    Aug 17, 2011 at 21:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .