Encrypted navigation

ofillion

Hello

I'm new into VPN and have a security question which is probably easy to answer for people here.

So, here it is. I have an intranet application at home for which the local address is http://"mylocalip"/applicationame/. I can also access this application from outsite with my public IP but the problem is that my office tech did not install any certificate to navigate in https.

My questions are : If I connect to my server from outside with openvpn and access my webapplication on the address http://"mylocalip"/applicationname/, are all the datas will be encrypted ?

Is it equivalent to access the app with https://"publicip"/applicationname/ ??

Is it also secure if I connect from a hotspot, ex: a hotel connection ? Does people from the hotel can intercept my datas or is it really encrypted from the server until my machine ?

Thank you very much !

ofillion

Nobody knows about this simple question ??

ofillion wroteHello

I'm new into VPN and have a security question which is probably easy to answer for people here.

So, here it is. I have an intranet application at home for which the local address is http://"mylocalip"/applicationame/. I can also access this application from outsite with my public IP but the problem is that my office tech did not install any certificate to navigate in https.

My questions are : If I connect to my server from outside with openvpn and access my webapplication on the address http://"mylocalip"/applicationname/, are all the datas will be encrypted ?

Is it equivalent to access the app with https://"publicip"/applicationname/ ??

Is it also secure if I connect from a hotspot, ex: a hotel connection ? Does people from the hotel can intercept my datas or is it really encrypted from the server until my machine ?

Thank you very much !

raptorjp

If you are accessing a remote intranet via OpenVPN tunnel then the traffic is encrypted (ssl). If someone got inside your secure tunnel somehow, then they could potentially see the non-encrypted http traffic. Https within the tunnel would be double encryption.

I do the same for my intranet application (uses http and https). If I am connecting via my vpn tunnel, I am not that worried about whether I connect using https to my intranet.

I usually connect via http://"my openvpn ip"/app because I am using openvpn as a tunnel. If I was bridging then it would be more like http://"my_remote_server_lan_ip"/app

ofillion

Thank you very much raptorjp for taking time to answer.

That's what I thought but I wanted to be sure !

raptorjp

No problem. By default openvpn will only create a secure tunnel which you can connect to your intranet. Although, I don't think you were necessarily asking this, but if you wish to encrypt all your internet browsing and not just the connection to your server (e.g., a hotel or hotspot) then you can set your configuration to send all your communications through the tunnel as well. For example, do online banking from a coffee shop using the extra security of the tunnel.

ofillion

yes this is a matter to me. I wiil travel next week and want to make sure that my browsing cannot be decrypted by the hotel (hotspot). how should i configure to send all commucication through the tunnel ?

raptorjp

I actually haven't ever set this up myself yet, but you can take a look at push "redirect-gateway def1" in the howto page http://openvpn.net/index.php/open-source/documentation/howto.html

If you can't get it to work right off the bat by next week, what I would do is just remote desktop back to my home workstation and use the browser on the remote session and it essentially does the same thing. I connect my remote desktop session through my vpn so it is secure. I have firewalled my remote desktop so that only my vpn subnet can access it and I only have to port forward one port (my vpn port). Depending on your connection it may be slow sometimes, but it makes me feel good to know that someone can't easily snoop on me. It also provides the ability to visits some sites that the hotel may block which is a bonus. If I am not doing anything serious (e.g., googling or wikipedia) they can snoop all they want - it isn't usually worth the hassle tunneling everything through a vpn.

One potential gotcha is if they really restrict the ports that you can use (e.g., http/https). If you are not also running a webserver on 80 and 443 you can always port forward them to your openvpn server so that you can circumvent even the most restrictive situations. In reality, I have only come across these situations at major universities rather than hotels and coffee shops. I typically have to utilize a proxy server to circumvent these scenarios. I also would change your openvpn subnet and the subnet on your home lan to something other than the default (e.g., 192.168.1.0/24) because I have run into issues with that.

ofillion

Thanks again raptorjp for your explanations. The VNC was my second option. I will take a look at "redirect-gateway" but my problem is that I do not have the rights to modify the server config files.

Anyway, I known that from the hotel, my brownsing on the net goes though the hotel connection but here is my last question :

As my local application ex: http://10.11.12.1/myapp is not available when i'm not connected to VPN, is that browsing goes through the internet connection of the hotel or only through my tunnel ??

raptorjp

Yeah, if you can't control the server config, then you cannot tunnel all the traffic through it as it is a server parameter and setup. Browsing through a VNC running through a tunnel would be a workaround.

I think I understand your last question? :? If you have the server setup to tunnel all the traffic, then all internet browsing while connected through the vpn will go through the tunnel as well as your intranet app.

If you only create a tunnel without the redirect gateway, you have to explicitly send information through the tunnel (e.g., 10.11.12.0/24) for it to be secure (ssl encryption). So if you browse google, it has a different ip and the information is not routed through the tunnel and therefore is not encrypted (unless you connect via https). Since you are at the hotel, the tunnel still goes through their equipment, but the information is encrypted.