Travel Router

[blaq]

Hi guys, I remember Steve mentioning ages ago off handedly that he set up a travel router for someone who was travelling, but it was many years ago anyway.

What would be the latest recommendation? I wanna connect to an untrusted network via wifi while staying behind my own NAT firewall. OpenVPN/Tailscale integration would be a bonus. Or should I just go with a pfSense and wireless adapter?

 

[cschuber]

pfSense would provide you with the best and most configurable protection.

NAT wasn't designed with blocking packets in mind, though it does by the very nature of the beast.

I would think your Windows firewall should provide adequate blocking. When I take my FreeBSD laptops away from home I rely on the O/S packet filter -- FreeBSD has pf (basis for pfSense), ipfw (the original FreeBSD firewall) and ipfilter (which I've used for ~ 20 years and what pf was designed to replace -- long OpenBSD story behind this which I'm not about to repeat here unless you know the circumstances and personalities involved, and then it makes sense).

When I take my $JOB laptop (Windows 11) places, I and my employer rely on the Windows firewall. And as a firewall developer (I work on ipfilter), IMO It does a decent job. (We recently switched from the McAfee to the Defender f/w,)

Using a NAT router as a security device in the field is unnecessary, Unless of course you need a WiFi repeater.

The firewalls built into the kernel, if configured properly, are sufficient and in most cases better than a NAT router.

 

[PHolder]

pfSense is overkill from a usability perspective for this use case I think. My recommendation is to get one of the reasonably priced routers in the gl.inet lineup https://store-us.gl-inet.com/collections/travel-routers They are also sold on Amazon, among other places. You can usually find a fair price on a hard case for one too, which is handy to have room to store an extra cable, etc. I have the Beryl AX (GL-MT3000) and recommend it wholeheartedly. They run a version of OpenWRT, and have a UI to help you do the obvious things (like proxy wireless to wireless, or wired to wireless, or wireless to wired, etc.)

 

[blaq]

pfSense would provide you with the best and most configurable protection.

NAT wasn't designed with blocking packets in mind, though it does by the very nature of the beast.

I would think your Windows firewall should provide adequate blocking. When I take my FreeBSD laptops away from home I rely on the O/S packet filter -- FreeBSD has pf (basis for pfSense), ipfw (the original FreeBSD firewall) and ipfilter (which I've used for ~ 20 years and what pf was designed to replace -- long OpenBSD story behind this which I'm not about to repeat here unless you know the circumstances and personalities involved, and then it makes sense).

When I take my $JOB laptop (Windows 11) places, I and my employer rely on the Windows firewall. And as a firewall developer (I work on ipfilter), IMO It does a decent job. (We recently switched from the McAfee to the Defender f/w,)

Using a NAT router as a security device in the field is unnecessary, Unless of course you need a WiFi repeater.

The firewalls built into the kernel, if configured properly, are sufficient and in most cases better than a NAT router.

The reason why I wanted something like a travel router was:
1) Software firewalls are always susceptible to software flaws, as covered multiple times in the podcast. The notion of packets being "dropped" simply because they can't be routed before reaching the computer seems more secure than the idea that the packet is parsed then dropped after it's already reached the computer.
2) Ease of use- I can mirror my home WiFi on the Travel Router and have all the devices auto-connect.

pfSense is overkill from a usability perspective for this use case I think. My recommendation is to get one of the reasonably priced routers in the gl.inet lineup https://store-us.gl-inet.com/collections/travel-routers They are also sold on Amazon, among other places. You can usually find a fair price on a hard case for one too, which is handy to have room to store an extra cable, etc. I have the Beryl AX (GL-MT3000) and recommend it wholeheartedly. They run a version of OpenWRT, and have a UI to help you do the obvious things (like proxy wireless to wireless, or wired to wireless, or wireless to wired, etc.)

Thanks, that looks like a great solution. Seems they offer both the Slate AX and Beryl AX where the Slate is abit more expensive with a few more features like a memory card and 1 more RJ45 port? Other than that can't seem to see much difference to justify the ~$100 difference.

 

[cschuber]

The reason why I wanted something like a travel router was:
1) Software firewalls are always susceptible to software flaws, as covered multiple times in the podcast. The notion of packets being "dropped" simply because they can't be routed before reaching the computer seems more secure than the idea that the packet is parsed then dropped after it's already reached the computer.

And what does the the work of packet filtering in a hardware firewall? Would it not be software?

Case in point: the VxWorks based routers Steve spoke about in a SecurityNow episode a couple of years go.

Would you say something like this would be more secure than the netfilter + Linux installed in it? (Remember, firmware is just software by a different name.)

At least with a software based firewall you will receive updates for a very long time. Whereas you'd be lucky to get one or maybe two updates from a hardware vendor before the deprecate and desupport their product forcing you to purchase a newer model.

2) Ease of use- I can mirror my home WiFi on the Travel Router and have all the devices auto-connect.

With this you have a point. How many devices do you take when you travel BTW?

 

[PHolder]

How many devices do you take when you travel BTW?

Probably more than you think. For me, it would be my phone, my tablet, sometimes a laptop, my Chromecast (for use on the crap in room TV) and the corresponding devices of my travelling companion(s).

 

[blaq]

With this you have a point. How many devices do you take when you travel BTW?

Always more than you think. Usually 1-2 laptops, 1-2 phones, 1 tablet 1 Kindle, plus whatever the family brings (usually at least a phone and a tablet each).

Happy to report that I've been using the Beryl AX and it's been good. Not quite kitchen sink level like a ddwrt or pfSense but does everything I need and then some.

 

[gleclaire]

Anyone try the ExpressVPN offering?

Aircove Routers for Home & Away | ExpressVPN

Explore the Aircove range of home and portable VPN routers. Instantly bring ExpressVPN security to all your devices.

www.expressvpn.com

 

[ZiggyStar]

I just use the hot spot on my phone and the built-in firewall on my Mac, + LittleSnitch
I keep Bluetooth on the phone and the laptop turned OFF all the time as well.
(and the WiFi on the phone is always off unless I am actively using the hot spot for my laptop)

So, I basically never do ANY public WiFi, as it's way too easy to spoof/hack (remember the WiFi Pineapple? These still sell very well)

 

[gleclaire]

I just use the hot spot on my phone and the built-in firewall on my Mac, + LittleSnitch
I keep Bluetooth on the phone and the laptop turned OFF all the time as well.
(and the WiFi on the phone is always off unless I am actively using the hot spot for my laptop)

So, I basically never do ANY public WiFi, as it's way too easy to spoof/hack (remember the WiFi Pineapple? These still sell very well)

Similar to what I do today. I use ExpressVPN on my devices. I will plug my phone into my MacBook to use as a hotspot.

 

[mafiltenborg]

Like other people on here i use a gl-inet travel router (Shadow 16M). Like you I aim for one-stop-setup for all my devices. The Shadow 16M sports a nice Openvpn client that accept the config file generated by my Turris router at home, instantly taking be 'back home' no matter where I am.
It also sports a Wireguard Client (more speed). And it's ridiculously small, making it the perfect choice for limited-luggage-travelling.