How should I use VPN on a Mac to prevent compromise before the VPN starts? As most experienced users will have heard, using a Mac in a public untrusted Wi-Fi can be potentially harmful. A tool like Firesheep1 has made it very easy to intercept unencrypted communication.

Using a full tunnel VPN to encrypt all communication is as often mentioned as a magical solution to eavesdropping, but of course it's not that easy:


Depending on the protocol and configuration of the VPN connection, the connection may drop easier. (e.g. TLS vs UDP)
The VPN connection is not established instantly when you connect to a public network.


I think that the last two points matter a lot because whenever your network settings change the various applications immediately talk to their servers - I assume it's configd that informs them, right?


  i.e. Before the VPN tunnel is established, most (running) processes that require
  internet will communicate.


I see two components to being a good VPN user:


Making sure things don't get sent in the clear before it's established.
Making sure things don't get sent in the clear later if the VPN fails.


How can I use VPN on a Mac in a public network to restrict unencrypted traffic before the VPN starts up?
Here is an approach totally outside of the MacOS X GUI.
Hence this approach of the problem won't interfere with any network
or VPN setting.

Let's say I want to use an IPSEC VPN (based on the use of 500/udp == isakmp &amp; 50/ip == esp).

Create an ipfw configuration file just allowing the required protocols to build the VPN:

/usr/bin/sudo cat &lt;&lt;____eof &gt;/etc/ipfw.vpn.rules
# VPN trafic contention
#
# DHCP
add 00100 permit udp from any to any src-port bootpc dst-port bootps
# DNS
add 01000 permit udp from me to any dst-port domain
add 01010 permit udp from any to me dst-port domain
# isakmp
add 01050 permit udp from me to any dst-port isakmp
add 01060 permit udp from any to me dst-port isakmp
# esp
add 01100 permit esp from me to any
add 01110 permit esp from any to me
# all other ip go to the central black hole
add 20000 deny ip from any to any
____eof


Check that its syntax is OK:

/usr/bin/sudo /sbin/ipfw -n /etc/ipfw.vpn.rules


Install it in the kernel:

/usr/bin/sudo /sbin/ipfw /etc/ipfw.vpn.rules


Check that your OS can reboot, and get its IP address through the
usual DHCP. Check that most of the IP protocols are blocked:

ping www.google.com


Of course, if you want to use a VPN on top of SSL, you will have to
adapt this configuration file (isakmp + esp → https).