vpn

IPSec Fail: Perfect Forward Secrecy, Where Art Thou?

Perfect Forward Secrecy (PFS) has garnered widespread publicity in recent months thanks to Snowden and the NSA. As a result, an increasing number of websites and email service providers have been pushing for PFS to provide better security to their users.

PFS protects previous key exchanges even if the current one is compromised.

Unfortunately the same cannot be said about current popular IPSec VPN clients. Neither of the ones I tested – all of them from recent distributions including Windows and OS X – offered PFS out of the box, meaning previous IPSec key exchanges could be decrypted by an attacker if the current one is compromised.

NSOC-2012

Continue reading →

Reconnect VPN upon resume from sleep (Windows)

Windows doesn’t automatically reconnect VPN connections when you resume from standby mode. Sometimes this can be annoying – for instance when you are using someone else’s Internet and want to make sure that your connection is always secured through the VPN. To fix this, I created a task that automatically connects to a predefined VPN whenever you resume Windows.

Continue reading →

strongSwan 5: How to create your own private VPN

Update 04/20/2014: Adjusted to take into account the modular configuration layout introduced in strongSwan 5.1.2. Tweaked cipher settings to provide perfect forward secrecy if supported by the client.

This article is a step by step guide on how to prepare strongSwan 5 to run your own private VPN, allowing you to stop snoopers from spying on your online activities, to bypass geo-restrictions, and to circumvent overzealous firewalls.

Continue reading →