Drunkard's Walk Forums

So, not inspired by but coinciding with the discussion involving WiFi security over in Politics, I've acquired a netbook and have started looking into seriously securing the communications, both for use at home and for use elsewhere. So, that pretty much means a VPN.

I have an OpenVPN server set up on a system I have running PuppyLinux, with configuration that's supposed to make all the traffic go through the VPN. With *that* going, the client couldn't get to the internet at all, actually a good sign. Then I got the firewall set up with rules I'm pretty sure are supposed to cause the PuppyLinux machine to do NAT for the client system. Now I can get to the internet from the client.

The problem is, I'm still not absolutely certain that the wireless communication is all going through the vpn encryption. I was under the impression that when the gateway redirection was working, traceroute was supposed to show a path that goes through the vpn server somewhere, and it isn't. Based on a forum post from someone else trying to do a similar setup, I tried installing Wireshark on both the client and the server. Which showed me that *something* is definately going on. When I go to a website on the client, there's activity on the server machine, and on the client it shows all sorts of stuff involving SSL exchanges that doesn't happen normally. But that post suggested that all the traffic leaving the wireless interface on the client should be in the form of UDP packets, since I have it configured for UDP. It shows a lot more stuff. But I'm not sure that this isn't it also showing the traffic to the virtual interface formed by the VPN software. I'd have expected *that* to appear when I have it set to capture on the virtual interface, but when I do that... it shows absolutely nothing. Since I don't actually know what I'm *doing* with this program, maybe I don't have the right configuration for what I'm looking for.

So, basically. Anyone have any idea how I can tell for certain that my traffic is getting encrypted the way it's supposed to be?

-Morgan.

I haven't worked extensively with OpenVPN, fair warning.  But the first place I'd start trying to verify things would be with the client machine.  IIRC, OpenVPN uses its own network adapter for all traffic, which should be the one the bits are flowing through if everything's working correctly.
I suspect your client machine is using some *nix flavor, so I can't say for sure how exactly to do this, but, what I'd do is disable the non-OpenVPN adapter(s) on the system as a first step and see if I can still get to the internet.  If so, then it's a pretty good sign things are working.
Another thing to check is your routing tables on the client machine.  If they're set up to direct everything through the OpenVPN-defined interface, again, you should be able to rest easy.
As for the non-UDP traffic... I think it might turn out to be connection-related traffic, specific to maintaining the VPN but not actual content, if that makes sense.  I'm on unfamiliar ground there -- my VPN setup uses Cisco software and is Windows-based to boot, so, yeah.

--sofaspud
--"Listening to your kid is the audio equivalent of a Salvador Dali painting, Spud." --OpMegs

Actually, the client is running Windows 7. Just the server is *nix.

It's become kind of a moot point now, since I haven't been able to replicate the iptables ruleset that allowed the client to get out in the first place. ^_^;;; I suspect that I'm missing some part of the equation; I was putting together bits from multiple tutorials already. Still, it looked like at that point the client system had a working route to the internet, but the server wasn't actually forwarding the packets. Haven't had a chance to experiment with it and see where things are breaking down.

Disabling the wireless interface would also take out the VPN, since that's what the client uses to talk to the server machine. So no good there.

-Morgan.