3 ms·

I already switched to using OpenVPN over an otherwise unencrypted Wi-Fi network a while back. Obviously the unencrypted network is entirely separate from the re

I already switched to using OpenVPN over an otherwise unencrypted Wi-Fi network a while back. Obviously the unencrypted network is entirely separate from the rest of the LAN and only the OpenVPN server is listening on it. Getting all my hardware to play nice with WPA was getting very fiddly, and it even seems a little faster doing the encryption entirely in software. Plus, I have more faith in the OpenVPN guys than the people who seem to be unable to release a new standard within a couple of years.

thwarted 18y ago
It's also a lot easier to segregate traffic this way. Once you're coming in via openvpn, the traffic is on a completely different interface and IP range, making automatic/transparent proxying a breeze and firewall/iptables setup really straight forward.
- pmjordan 18y ago
  Absolutely. It definitely beats going with your average access point's default of bridging wifi to your LAN, though it does make your wiring slightly more complicated. I use two separate VLANs actually, one for the unprotected wifi access points and one for the actual LAN traffic. You have to watch out that you use high-quality VLAN-capable switches, however, as some of the cheaper ones fall over and supply the world with your protected packets if you fill up their MAC address table with spoofed packets... which is of course easy to do via an unprotected access point. That kind of thing might stil DoS you with a good switch, but it shouldn't open up your network.
- thwarted 18y ago
  The other good thing about doing it this way is that you can get device _and_ user level authentication (by using client certificates and password authentication). No more lame MAC filtering on your wireless firewall to limit access. The access point becomes just a dumb ethernet <-> wireless bridge.

3 ms·

I already switched to using OpenVPN over an otherwise unencrypted Wi-Fi network a while back. Obviously the unencrypted network is entirely separate from the re

by pmjordan 18y ago

thwarted 18y ago
It's also a lot easier to segregate traffic this way. Once you're coming in via openvpn, the traffic is on a completely different interface and IP range, making automatic/transparent proxying a breeze and firewall/iptables setup really straight forward.
- pmjordan 18y ago
  Absolutely. It definitely beats going with your average access point's default of bridging wifi to your LAN, though it does make your wiring slightly more complicated. I use two separate VLANs actually, one for the unprotected wifi access points and one for the actual LAN traffic. You have to watch out that you use high-quality VLAN-capable switches, however, as some of the cheaper ones fall over and supply the world with your protected packets if you fill up their MAC address table with spoofed packets... which is of course easy to do via an unprotected access point. That kind of thing might stil DoS you with a good switch, but it shouldn't open up your network.
- thwarted 18y ago
  The other good thing about doing it this way is that you can get device _and_ user level authentication (by using client certificates and password authentication). No more lame MAC filtering on your wireless firewall to limit access. The access point becomes just a dumb ethernet <-> wireless bridge.