Whether train station or airport, hotel, café or shopping centre – where many people are on the move, wireless Internet access is increasingly available. For smartphone, tablet and laptop users, a free WLAN hotspot is undoubtedly a welcome opportunity to protect the monthly data limit of their mobile phone contract. But be careful: using public WLAN access involves significantly more risks than surfing via mobile phone.
Those who do not want to do without the convenience of public WLAN hotspots can minimize such risks by using a Virtual Private Network (VPN). This is because a VPN transmits all data via the Internet in encrypted form. This puts a stop to possible spying attempts by other participants in the public WLAN. It can also be used to unblock websites. For example netflix will block you if you are outside of your resident country.
VPNs should not, however, be confused with the encrypted HTTPS (Hypertext Transfer Protocol Secure): This protocol ensures the integrity and confidentiality of communication between a specific web server and your web browser on the World Wide Web. A VPN, on the other hand, encrypts data communication between two endpoints – for example, between your end device and a VPN server. Consequently, a VPN can protect your information even if you are not using a browser, but a smartphone app, for example. In addition, a VPN can encrypt all your Internet traffic so that your communication cannot be read or changed without further ado.
VPN use is recommended not least if you want to access your home network via WLAN hotspot – for example personal documents, private photos or your music collection. VPNs for smart home applications can also be a secure alternative to control via the cloud: Those who control their intelligent household appliances, networked doors, roller shutters or heating thermostats directly via their own home network router without having to go through a cloud can avoid the risk of such smart home data being used by manufacturers, cloud operators or unauthorized third parties to create a profile of their private habits. In addition, a VPN renders the direct accessibility of your household appliances from the Internet via shared ports or UPnP unnecessary, which protects against third party access attempts. However, since some smart home devices require access to the manufacturer’s cloud to function correctly, you should make sure when you buy a product that the intelligent household devices do not need to be accessible from the Internet.
What exactly is a VPN?
A VPN is a virtual network: unlike conventional networks such as your home network, the various end devices are not physically connected directly to each other or to a central router, for example via a network cable or WLAN connection.
A VPN usually uses the connection paths in the public Internet, whereby in the private environment a connection is usually established from a terminal device – for example your smartphone – to a VPN server. The VPN server internally assigns a new IP address to your terminal device. When surfing, the external IP address of the VPN server is visible instead of the original IP address of your device on the visited web pages. At the same time, all data transmitted between the end device and the VPN server is encrypted from the rest of the Internet.
The encrypted data lines in the VPN tunnel lines are colloquially referred to as tunnel lines because the encryption digs a tap-proof tunnel through the unprotected Internet – for example from your smartphone at a WLAN hotspot to your home network router or from your home PC to an external VPN server. At the entrance to the tunnel, all the information is clearly displayed, packed in encrypted data packets and unpacked or decrypted at the end of the tunnel. Thus they are on the opposite side again in their original form. The required key exchange takes place automatically when the connection is established. A great advantage of VPN is that data worthy of protection can be securely exchanged with a local network from any location – even in other countries or on another continent – via a tunnel line. However, there are also countries in which the use of VPNs is prohibited.
VPN client: Remote access can also be useful at home
There are many good reasons for setting up secure remote access to a home network. For example, less experienced users can get quick help from friends or relatives with an affinity for technology in this way – for example, when configuring their router or installing new software. This enables them to connect to the appropriate end device from home via a secure VPN connection and make the necessary settings there without having to be on-site.
Another example is network storage with an integrated web server: Such systems, also known as network attached storage (NAS), allow stored movies, music and photos to be conveniently transferred to various end devices such as tablets or smartphones. However, the functionality of many NAS web servers is only fully available if the router is configured in such a way that all incoming requests are forwarded to a specific destination port of the NAS device. This so-called port forwarding in turn requires that every port that is to be accessible from the public Internet is enabled in the router and redirected to the relevant IP address. The problem is that these ports can also be accessed by third parties via the Internet. This is what a potential attacker could exploit to penetrate your home network and infect the devices there with a malicious program.
In general, the BSI recommends using port shares very sparingly. Only release a port if you can actually estimate its technical impact. If in doubt, consult a professional friend or acquaintance or contact a service provider if necessary. Especially when using NAS web servers and similar applications, it is best to completely avoid risky port shares. You can either use a VPN-enabled NAS device or set up a VPN on your home network router. Because all access from the untrusted Internet takes place via encrypted VPN connections, your network remains protected against criminal access from outside the Internet.
On the road: VPN overcomes geo-blocking
A VPN connection can be very useful during a holiday abroad – for example, if you want to watch an article from the media library of a television station. Outside the country’s borders, the streaming of many German media offerings is suppressed for licensing reasons. This so-called geo-blocking works by blocking all IP addresses that are not assigned to the Federal Republic of Germany. Such an IP block does not work with VPN software on your tablet or notebook: As soon as your VPN connection is established via a VPN server located in Germany, your smartphone or tablet automatically receives an IP address that is not blocked here in Germany, even abroad. The geo-blockade is thus eliminated.
Within the European Union, however, geo-blocking is becoming less and less important: since the first quarter of 2018, new regulations have been in force to promote the EU-wide portability of digital services. In other words: Anyone who has paid for films, sports reports, music, e-books or games in their home country should not have to do without them in other EU countries, at least for a limited period. Outside the European Union there are still no signs of a relaxation of geo-blocking.
Please note that VPNs are forbidden in some countries when planning long-distance journeys, and that their thoughtless use could bring you into conflict with local law. VPN bans exist especially in countries with Internet censorship, such as China.
VPN connects locations
In professional life, VPN often serves to securely connect home office workstations or to enable field staff to access central applications and databases in the company on the move – keyword mobile working. For mobile devices used for business purposes, company-specific security guidelines usually apply, whereby one of the aims is to prevent criminals from gaining access to sensitive data in the company network by stealing a device, for example. Another VPN application area involves the virtual merging of two geographically separate site networks – which is of interest not only to commercial enterprises, but also to universities, governmental administrative institutions and non-governmental organizations, for example. In addition to encrypting data transmission, the site connection can also be secured by a specially hardened VPN gateway to ensure even greater protection against cyber attacks.