I do something similar, with a router flashed with openwrt. If there's a physical router/ethernet port I can plug into great, if not I run one of the radios in client mode to connect to the wifi.

All traffic is secured with wireguard to my home router, and then goes through my ISP. The wireguard tunnel is wrapped in an error correcting tunnel; it makes a huge difference on the usability a lot of public APs.

I think these setups are fantastic. Here [1] I wrote about my IPSEC-setup on a portable private Wifi network based on a Protectli that I connected to someone's Wifi.

[1]: https://du.nkel.dev/blog/2021-11-19_pfsense_opnsense_ipsec_c...

Out of curiosity how do you deal with situations where the public wifi has one of those middle pages that you have to type in or click something (captive portal?) before the access point grants access?

Dnsmasq has a neat feature where you can populate ipsets/nftsets with responses to dns queries. So I have it populate a set with the IPs for sites like neverssl.com, and use a firewall rule to route requests to destinations in the set through wan without sending it through the VPN. Usually works.

One way is to change the MAC address of your laptop to that of the router, authenticate, and then connect the router (and change your laptop back)

Can you share more details on the setup of the error correcting tunnel? That sounds very interesting!

It's been a while since I set it up, but iirc I ended up going with https://github.com/wangyu-/UDPspeeder

Pretty sure I used the suggested config and it's been working flawlessly in the background.

Or something like that. With wireguard, it's just a matter of pointing the config at the local socket for the fec tunnel (or any other type of tunnel, there was a dicussion about making it look like TCP http traffic the other day), so it's pretty much plug and play.

Thank you! That’s very helpful to know. First time I’ve even heard of things like this but when using low quality networks I can see how this would be great!

Edit: I apologise I see you have answered this below.

What is your error correcting tunnel? Given that Wireguard is UDP and that any tunneled TCP that gets dropped should just be handled by TCP, why encapsulate Wireguard in something else? I certainly find Wireguard itself improves many Public Wifi networks, I've never thought to encapsulate it further.

> any tunneled TCP that gets dropped should just be handled by TCP, why encapsulate Wireguard in something else?

That's the thing, TCP doesn't really handle lossy connections well. A moderate lossy link might do udp traffic like video fine, but be practically unusable for TCP traffic.

I’ve never had issues with four phones and two laptops on Hilton wifi when we travel as a family.

Where I live, most of the mass rapid transit stations are underground, and connection is sometimes spotty. The country has launched a secure public Wi-Fi service. Users on smartphones can authenticate using EAP-SIM[1], or laptop users can use an app developed by the agency to authenticate with WPA2 Enterprise PEAP MSCHAPv2.

[1]: https://en.wikipedia.org/wiki/Extensible_Authentication_Prot...

The implementation here is rather annoying, because as soon as you enter the tunnel the wifi cuts off. But there's a 10-15 second latency where network connections just fail as the phone decides the AP is actually gone before it cuts over to LTE.

Then the whole process repeats again once you get to the next station.

Since LTE is usually reliable even in the tunnel, I usually remove the wifi connection. Granted it might help that I don't normally travel during peak hour, so the mobile network is usually fine for my needs.

It's made even more annoying by the fact that "Forgetting" the connection only works until the phone is rebooted, at which point the behaviour returns.

> It's made even more annoying by the fact that "Forgetting" the connection only works until the phone is rebooted, at which point the behaviour returns.

That seems odd. My phone doesn't connect to a network unless it's toggled to auto join, and certainly not post "forget". Can you not control this?

I'm not familiar with the networks in question, but I've run into a couple wifi networks connected to my lte carrier, and my unlocked phone pushes them hard. I imagine there's something coming from the SIM, and I could see the OS picking up SIM affiliated wifi networks on boot or sim insertion. Unless special care were taken, it makes sense that forgetting a network isn't remembered.

As far as I can tell, it's because the configuration comes from EAP-SIM (https://datatracker.ietf.org/doc/html/RFC4186) which gets refreshed on every reboot. This cannot be controlled - it will always regenerate when you restart the phone.

> These days, would you use any public WiFi?

These days I treat my home network the same as a public network. Too many "smart" devices to be worth trusting, so the devices I care about are locked down the same as they would be if I connected them directly to the internet - and sometimes I do. Frankly I have more trust that I can keep my phone or laptop up to date than any consumer-grade router (do you know which version of linux it's running? How often do you even get updates?)

Putting IoT devices on your guest network is a very common home security/privacy thing to do. They very often snoop when they can, and your router shuts that down on the guest network.

I want my router to allow my IOT devices to send out mDNS beacons, and for other devices to connect to them, but otherwise they're restricted and logged.

This is an order of magnitude more complex than I trust a home router to do, though...

Even on my UniFi gear its still a bit of a faff every time a manufacturer does it slightly differently (and still raises my suspicions when controlling google home devices doesn't work / not receiving mDNS broadcasts etc).

Beyond mDNS "snooping", has there been reporting of non-compromised IoT inappropriately listening on networks?

To be clear, I agree that putting IoT devices on a separate VLAN is a good idea but I do that because they're black boxes, not because they're malicious.

Well when you're setting up your Roomba in the roomba app, the amazon alexa app unprompted sends a notification to allow Alexa to control it. Only way could be the Echo is listening and hears the Roomba broadcast packets.

If they're on the guest network, how do you control them? Over Bluetooth?

There are two categories of devices worth considering:

- Those controllable (only) through the manufacturer's server and requiring an Internet connection: put them on the guest network that only has a (NATed) route to the Internet and nothing else (ideally, of course, don't buy them);

- Those controllable over LAN and not requiring an Internet connection: put them on a jail network that has a route to the main network and is firewalled away from the Internet (and perhaps from initiating connections to the main network as well).

Absolutely - Never trust the wire, whatever wire it is.

Yes, I pretty often use WiFi in airports overseas, because roaming data rates are not fun (or data does not work), and whatever slice of free access the airport WiFi allows is usually enough to check mail and connecting flights, chat a bit over IM, upload a few photos, sometimes even review a PR or push a PR.

Hotel WiFi is usually so-so, even paid, but still much better than 10 years ago.

In India you need a local phone number just to use wifi. I think this is a law

Why not use an Indian VoIP number or eSIM?

Can it be obtained remotely, before you arrive and show your papers?

You need to show ID to get a phone number, even a temporary one, in India.

I get free international roaming nowadays, but 5 years ago I was in China and accidentally plugged my phone in to my laptop to charge.

Laptop started syncing something that had been blocked all week (Dropbox maybe), and the SMS flooded in.

The connection was so fast that within a minute or two I got the following message:

From Vodafone: So far you've used 83MB of data today in our Rest of World Zone, and spent £255. It'll cost £15 for each additional 5MB you use. We'll next let you know when you've spent £495 today but, if you'd prefer us not to, please contact your account administrator. Sent OCT 15 @10:45 UK

* * *

You can filter out broadcast, multicast and other kind of link local nastyness. Also a single tunnel obscures traffic if one’s super secretive.

This is the way. Also good for those hotels/conference centers that give you a small number of “allowable” devices — when you have kids with multiple devices, maybe a game console, etc plus maybe an appletv you quickly run out. Instead the router authenticates and that’s that.

I terminate my VPN at one of my own machines mainly for (marginal) security but conveniently this lets me stream the same stuff as home since the services can’t tell the exit is a VPN

Yes, I would. I use Wireguard client with kill switch. If I don't have a Wireguard connection, nothing works. The only caveat is the Wireguard server runs on my home connection. If down, 'my internet is down'. If slow, 'my internet is slow'. But actually it appears to be pretty reliable. Another downside is all the traffic is tunneled through my home IPv4 and I might not want other people to know such. But that too seems to be an edge case. Against a possibly hostile or hacked WLAN network which I decide to use, it works fine, though I generally use it over mobile (which I've configured to only use LTE / 5G NR, not lower as these are easier to MITM and I don't want a downgrade attack although in theory in such a case, too, Wireguard client w/killswitch would protect).

Yes but I use Tailscale and route through my exit node