Need a working VPN for public WIFI

[LIsLinuxIsSogood]

What possible solutions are there for a working security implementation that covers me from the traditional or otherwise types of attacks that can happen on public wifi networks?

I do a lot of my work from these places (i.e. coffee shops, and libraries) so I was previously not concerned because I didn't think the threat was present for others to want to hack the information on my laptop. I've reconsidered.

In case it helps to have my intended security consequences for protection these are the ones I am most concerned about:
1) Security from malware and destructive access to my system
2) Also ease of use and I want something that works out of the box and works all the time (something that doesn't have as many "gaps" or holes in terms of protection)
3) Cheap solution shouldn't cost more than a few dollars to implement (per month or whatever).,,but if it works much better than I will consider bending the amount upwards to between $0-10 monthly.

I currently use a way of hiding my IP but I don't think that is the same as the type of VPN I need for security among other hosts on a network. Please will someone point me in the right direction for the easy to follow instructions. Thanks.

[szatox]

[khayyam]

[LIsLinuxIsSogood]

Thanks khay, this was exactly what I was looking to know more about. I will read your description of the DNS crypt solution carefully and give it a hack before trying back with more scenarios (for the MiTM attack sit'ns that could be of great enough concern to do something against and defend)

[NeddySeagoon]

LIsLinuxIsSogood,

None of this says that you do not need a VPN too.

Public wifi tends to have all users sharing the same WiFi key. That mean all users can see all wifi traffic.
That's a verybadthing. A VPN provides a secure tunnel over the shared Wifi. Thats all.
You need to trust the other end of the VPN tunnel, since they decrypt your traffic and forward it.
See for yourself, try wireshark when you are out and about - don't get caught though.

Provided you always use end to end encryption anyway and you are 100% sure of that, a VPN adds nothing.
The measures khayyam suggested are good on their own.
After all, a layer of encryption you don't need is just extra overhead. It all depends on your paranoia level.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

[khayyam]

[Hu]

To elaborate a bit on khayyam's comment about HTTPS Everywhere, if you choose not to use a VPN, but you are concerned about your content being accessible to other Wifi users, you should establish active measures to inhibit non-encrypted traffic. For browsers, HTTPS Everywhere can be a good choice. You could also use iptables to ban outbound connections on ports associated with non-secure protocols. That way, you get a hard failure (and optionally an audit message) if something tries to use an insecure connection, even if no other user attacks or intercepts it.

[LIsLinuxIsSogood]

Ok, I think I will use a bit of everyone's advice. Specifically though, Hu because I haven't used iptables would there be a good tutorial on the way to use it as you are suggesting to. The DNS MiTM attack idea seems very advanced, and it will probably be a good way to start down a path that will just maybe need to be a job that is patched together by these several tools. That much I think I sort of knew ahead of time, although I was hoping in this case for some solution (magic maybe) that would work out of the box similar to the way some of the basic PC components work out of the box, but this time for Security. Like a chastity belt for my computer. JK

MiTM/DNS
HTTPS Everywhere
iptables


Does this seem like a fairly good list to start off with in terms of the public wifi issue?

EDIT: Oh an I forgot to mention Wireshark too, maybe or else a VPN, ha ha ha

[NeddySeagoon]

LIsLinuxIsSogood,

I gave up on using iptables directly. It made my head hurt but I have a four interface network.
I use shorewall to set up iptables.

Its like the difference in writing hex (iptables) or assembler (shorewall) to program your PC.
There are other pretty iptables rule compilers too.

Don't forget that you need separate firewalls for IPv4 and IPv6. There is no point is locking down IPv4 and leaving IPv6 wide open.
You can turn off IPv6 in the kernel if you want to. That's simpler and just as effective.

I'm just careful with my netbook. I'll follow khayyams advice there too.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

[Hu]

I learned iptables direct from its manual pages. I don't know of any tutorials for it that I can recommend.

[khayyam]