As most experienced users will have heard, using a Mac in a public untrusted Wi-Fi can be potentially harmful. A tool like Firesheep1 has made it very easy to intercept unencrypted communication.
Using a full tunnel VPN to encrypt all communication is as often mentioned as a magical solution to eavesdropping, but of course it's not that easy:
- Depending on the protocol and configuration of the VPN connection, the connection may drop easier. (e.g. TLS vs UDP)
- The VPN connection is not established instantly when you connect to a public network.
I think that the last two points matter a lot because whenever your network settings change the various applications immediately talk to their servers - I assume it's
configd that informs them, right?
i.e. Before the VPN tunnel is established, most (running) processes that require internet will communicate.
I see two components to being a good VPN user:
- Making sure things don't get sent in the clear before it's established.
- Making sure things don't get sent in the clear later if the VPN fails.
How can I use VPN on a Mac in a public network to restrict unencrypted traffic before the VPN starts up?