Score:0

MITM attacks inside VPN network?

fr flag

Is it possible to use any MITM attacks (including ssh-mitm) if I'm connected to a VPN? OpenVPN connects me via tun0 interface with some IP in 10.0.0.0/8 and gateway at some IP 10.0.0.0/8. I know that TUN is third layer, so ARP spoofing prorably won't work, but what about TAP layer?

cn flag
Sure is. VPN networks are notorious for security problems too.
Score:0
ru flag

If everything is set up correctly - proper cipher strengths, sufficient key/password lengths, uncompromised keys/passwords - there's no way for an attacker to alter tunnel contents while they are encrypted. A MITM attack can only happen after decryption in the destination network, or on your own computer (or on your network with site-to-site VPN).

Whether you use a TUN (L3) or TAP (L2) adapter doesn't matter as integrity is guaranteed.

ARP spoofing could also be attempted within your own network, but that's not a problem either. If anyone would spoof your gateway's IP address and tries to manipulate outer packets then mutual authentication ceases to work.

Nikita Kipriyanov avatar
za flag
ARP spoofing should work with VPN that emulates L2 and, in particular, it certainly **will** work with OpenVPN tap mode (without other precautions like APR static entries and so on).
Zac67 avatar
ru flag
@NikitaKipriyanov ARP spoofing *within* the VPN tunnel requires that the attacker has compromised the tunnel. *if everything is set up correctly* that's not possible.
Nikita Kipriyanov avatar
za flag
Then you have to define what is "correctly" quite tightly. Just simple formal logic, if the tunnel imitates Ethernet (e.g. has all the properties of Ethernet for the observing user) *and* if Ethernet permits ARP spoofing (it is, as we know), *then* there will be ARP spoofing possible in that tunnel. Therefore, true Ethernet tunnel (which OpenVPN tap mode is) must permit ARP spoofing inevitably.
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.