Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

The FBI issued a warning regarding hotel Wi-Fi access points, and any other public access point.

I'd like to make sure my apple device always uses a VPN when using Wi-Fi. That way even if an attacker were to see my data, they would only see an encrypted jumble of bits. Note that this hack can also be applied to HTTPS connections.

How do I ensure that OSX automatically uses a VPN when using Wi-Fi?

share|improve this question

marked as duplicate by bmike osx Jan 28 at 18:59

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1  
    
Are you asking how to automatically start a VPN session when you connect to a wifi access point? You should clarify this. – zwerdlds Apr 26 '13 at 15:21
    
It would be interesting to see progress on the part where the <At least if "goes over the VPN" is something that iptables can see> part of the proposed solution is lacking in details. – bmike Oct 8 '13 at 13:14

You can not ensure all traffic is protected. You also can't easily block traffic while waiting for VPN to connect, authenticate and secure without having two OS running:

VPN requires an open Wi-Fi connection to be built before it can reach out over that open/hostile/insecure Wi-Fi connection to secure a limited portion of the traffic leaving your Mac.

In other words, you have asked how to only drive on a freeway from your garage without using the driveway or surface streets. Once you're on the freeway, you can stay on it and not get off, but you need the streets to get there in the first place. Worse, VPN only obscures the windows of your car so things that are packed inside have some more expectation of privacy from casual observers.

On a practical level, you can set your Wi-Fi to never save a joined network or meticulously set then to never Auto-Join so you have control over each and every untrusted Wi-Fi connection and can ensure no apps are broadcasting before the VPN tunnel is established.

share|improve this answer
3  
I believe the OP is asking how to automatically connect to a VPN after joining a (public) wifi. – Gerry Oct 4 '12 at 15:28
    
@Gerry Let's see - you can always try editing the question into shape to sharpen it (or answer based on that assumption) - Part of this process is the community shaping things. I thought it was a "i know what I want and it's X" but I could easily be wrong or mistaken. – bmike Oct 4 '12 at 15:31
1  
→ bmike: very nice image! During my last waiting time in an airport I observed what was going before I was even connected to anything. That was a real traffic jam of broadcast attacks (automatic) on the netbios range of ports. A tcpdump showed me a real nightmare, and I could only guess the number of (unaware) sniffers on all the PC around me. I support your clear explanation that there is an insecure world between the Wi-Fi connection and the VPN building. – daniel Azuelos Oct 8 '13 at 6:40

I created a script and launch agent that will automatically connect to a VPN connection when it cannot ping a specific address. It could probably be modified in a way that looks at wifi network whitelist and connects to the VPN if the current wifi is not in that list. As it is right now the vpn will always try to connect if it cannot hit an address that is on the vpn network.

The agent calls a shell script every 30 seconds and tries to ping an IP address that is static on the vpn network. If it cannot ping that IP it enables your vpn connection.

If you did this through an Apple Script App, the app icon will always be in your dock. I prefer to have this running automatically in the background.

Clone the project below and follow the directions in the readme. The end result is an installer package that will place a launch agent plist file in /Library/LaunchAgents/ and a shell script in /Library/Application Support/melonsmasher/.

Be sure to edit the shell script(auto-vpn) with your VPN connection name and an IP address that is on the VPN network. You can change the run interval in the plist file(com.melonsmasher.autovpn.plist).

https://github.com/MelonSmasher/OSX-AutoVPN

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.