VPN

What are you attempting to achieve in using a VPN connection? Are you connecting to a Corporate/Business network - or trying to use a commercial VPN operator to improve privacy over public WiFi networks? Something else?

Insofar as public WiFi hotspots are concerned, where your internet traffic can be both monitored and potentially manipulated by bad/malicious actors present on the WiFi network, use of a properly configured reputable VPN service is certainly recommended by knowledgable Infosec Professionals.

Enterprise applications may use VPN technologies to securely connect remote users to corporate systems - security benefit being derived through the entire path being protected. Commercial VPNs, as used by private individuals, do not offer protection over the entire path as the encrypted tunnel terminates at the VPN Gateway from which your traffic is routed over the internet to its destination(s). Properly configured commercial VPN services do, however, provide useful mitigation against very specific threats. In using these services, It is important to understand the risks against which a commercial VPN can provide useful protection - and those that it can not. A commercial VPN cannot provide total protection against all monitoring of your internet traffic - as the end-to-end path is not protected by the VPN in its entirety.

Consider that a high proportion of your traffic (such as browser traffic) already benefits from encryption (e.g., TLS) without use of a VPN - but some protocols (such as DNS) are entirely “in-clear” and can be intercepted and manipulated. Header and routing information are also unencrypted - and is available to anyone that is able to monitor your local network connection. Where utilised, VPN encapsulation ensures that all your traffic, including unencrypted data, is contained within the VPN tunnel away from prying eyes and threat actors.

One of the arguments against the use of commercial VPN is that all your traffic is routed via the VPN provider”s VPN Gateway. This of course is completely true - however, in many cases presents no greater risk to you, or your privacy, than routing all your internet traffic via your ISP or mobile phone operator.

If you are connecting to an Enterprise/Business VPN, your IT Security Administrators will provide the required settings - and instruction upon how to set-up the VPN.

If instead you propose to use a commercial VPN Operator, you will likely use their own VPN App - or will use settings recommended by the operator. When using a commercial VPN, completely avoid free services - as these are unsafe. Choose one of the reputable “subscription” VPN Operators - as these should fully fund their service from fees - and not through monitoring/mining your exposed data or unwanted advertising.