by johndoe » Sat Oct 03, 2015 1:20 pm
virtualmike wrote:When the VPN runs on an end device (computer, smartphone, tablet, etc.), that device is then "virtually" on another network, and it no longer sees the other devices. It's really no longer a part of the LAN.
If the VPN runs on the router, then all devices are still on the LAN, and the entire LAN is virtually on another network. The devices on the LAN can talk to each other.
That's good to know, but wouldn't it cause security problems if all the devices on my LAN are part of the Sonic VPN network?
Normally when I use a router without a VPN, NAT acts as a firewall and protects me, but with a VPN, the NAT basically doesn't exist. Here's an example I thought might be similar. I'm quoting from a DSLReports FAQ (
https://www.dslreports.com/faq/9787):
AOL BYOA connects to your computer by creating a "tunnel" through the Internet. With AOL BYOA, tunneling uses your real IP address to connect you to AOL's network where you have a second IP address. Traffic using that second IP address is inside the tunnel.
With AOL, the far end of the tunnel is other AOL customers and the Internet, so it is untrusted. »
www.mynetwatchman.com/kb ··· ndex.htm
The solution is to use a software firewall. A software firewall will effectively filter the traffic after it leaves AOL's tunnel and before it gets into the rest of your computer. In some countries AOL9 Max includes the free option of installing the McAfee Firewall Express software firewall.
If the FAQ is correct, that AOL BYOA sounds like a VPN. Now I'm not an expert on security, so I don't really know how NAT mixes with VPNs, but based on what you said about my LAN being virtually a part of Sonic's VPN network, it sounds like there's a tunnel going through my router, and everything that goes through Sonic's end of that tunnel will get to my computer. So I have a couple questions about this:
1. If I don't use a software firewall, how do I prevent other Sonic VPN users and the rest of the Internet from pinging, port scanning, or accessing the devices connected to my LAN? When you're on a public Wifi, you can't rely on NAT to protect you from other Wifi users because they're all behind the router, just like you are. Isn't Sonic's VPN situation similar?
2. Can the tunnel be secured on Sonic's end with NAT? I'm thinking if Sonic's VPN used NAT, then it would prevent unauthorized traffic from entering the tunnel and getting to me. I did a port scan on my VPN IP address when I was connected to the old Cisco VPN, and no ports were open, but pings were being responded to. Is the situation different with the OpenVPN server?
