Hey everyone.
In need of VPN protection for WiFi's, hotels... when traveling.
What is the best portable VPN that I can start from my USB?
Where can I download such portable VPN?
Is there anything special needed in regards to running the portable vpn as opposed to
regular VPN's (anchorfree, packetix, ultravpn that I used before) that I use when I take my lap with me.
Thank you.
Visit the Community page
Join our forums
Subscribe to our email newsletter
Subscribe with RSS
Follow us on Facebook
Follow us on LinkedIn
Follow us on Twitter
Follow us on Mastodon
Follow us on BlueSky
first of all, most VPN systems would need to mess with the routing tables of the PC that you're at, which involves having administrator access, which you're unlikely to find much when travelling, so the idea may not work at all.
Secondly, though, what you are effectively doing, is plugging the completely unknown, potentially malware-infested PC that you sit down at directy into your corporate network, bypassing some or all of the firewalling that usually keeps it safe.
As the sysadmin here, there is no way I would allow my users to do that. If they need that level of access, they take their laptop with them.
Hi, the easiest and most secure way to access your company network is logmein (secure.logmein.com) and you can install logmein ignition as portable apps. This is like working via terminal server directly on your PC in the company. Connection is encrypted and secure. No need for an VPN.
Thank you for your answer.
I think I can get administrator access at most hotels I usually stay in.
I would prefer a simple portable VPN, that would work without messing with settings.
Just start and go thing.
The USB is only used for the duration of the trip, I can scan it with
antivirus, antimalware... later, so this is not a problem.
I came across this one:
http://sourceforge.net/projects/ovpnp/
Where can I find the latest version?
Would it be better if I use regular VPN such as shield, packetix, ultra... in combination with my portable apps on USB instead?
Whatever is good, is not bad.
My initial questions are still not answered. Anyone, please?
What is the best portable VPN that I can start from my USB?
Where can I download such portable VPN?
Whatever is good, is not bad.
I think that the reason noone has answered is that very few people do this, and they don't know of any downloads.
Also, I think you misunderstood what I was saying about a security issue. It isn't that your flash drive is plugged into an unknown and possibly infected computer, which you could then scan carefully. It is that you are effectively plugging that unknown and possibly infected computer straight into your base network, behind the firewall. In other words, if the hotel PC is infected with a worm, then you could be giving that worm a free shot at everything back in your office / home.
I will not be synchronizing while traveling with a flash drive.
I just want to be able to answer emails,
acess files and browse the web from my flash drive.
So the question still remains:
What is the best portable VPN that I can start from my USB?
Where can I download such portable VPN?
Are you saying that there are no portable VPN's at all?
Whatever is good, is not bad.
What a VPN does, is shortcut past all the firewalls and stuff to create a virtual network connection between the two endpoints. That means that you will be plugging the local PC, which you have no control over the security of, via the VPN into your network. If that PC is infected with worms and malware, you will be exposing the other computers on your network to attacks from an address that they will have been told to treat as local and trusted.
I personally do not know of any Portable VPN applications, and, even if I did, there is no way that I would ever use one or recommend its use to anyone else.
If you can access files on your back-at-base computer, then so can any piece of malware that happens to already be on the PC that you are sitting at.
For access to email, consider simply opening up the IMAP and SUBMISSION ports on your firewall, so you can contact your server directly.
For web browsing, you shouldn't need anything more than Firefox Portable.
this at my last company.
People who need real access to the company network, did get it, even on their fancy toy mobile phones, but this was done so, that only those particular devices (=computers) had the access, (testing even for mac in few ways to avoid mac faking etc.), not 'any computer' just with similar settings.
For those who wanted just mails, either the mails were copied directly to a reliable push mail service or simply copied to an external pop/imap account with at least ssl communication and here everybody could read mails, answer them and so on.
No way that somebody would just use settings and keyset and run the tunel from any terminal in the world.
What Jimbo tried to tell you, it does not matter what you are doing during the VPN connection to your home base. You are simply connecting the hotel and your company network together. It does not matter what you send over the VPN, but it might be more important what does the hotel computer send and receive during that session over the VPN from your home base network. During 15 mins, which you were connected and did just read one small text mail, the two networks can exchange virtually anything and you have no idea what it was. Remember, it is not your flash stick connecting to your base, it is the hotel in fact, even if the client software is placed on the flash.
In fact, much easier way: get rid of the firewall on your company, open all ports you need for your mails etc on the routers and you can reach the company directly without any VPN needed. The result is exactly the same. Your company network is open to public and you, and everybody else, can reach it without problems.
Anyway, it seems , that someone tried to make a thing you need with this openVPN, so just get it, install on your network, grab the portable client on your stick and try it.
However I would be surprised, if the admin of your network will be so keen on running this service on the network for you
Otto Sykora
Basel, Switzerland
So even if I just send and receive email and acess company website through a vpn it is already a problem?
Please let me know what would be the correct way to use portable apps on a flash drive securely. If VPN is not the right solution, what is?
What I mostly need when traveling is to use portable apps to acess company web site through firefox web browser and download and send emails through thunderbird securelly.
Thanks again.
Whatever is good, is not bad.
Accessing your company's website should be fine/safe with FireFox. Does your company support web access to their email system? That should be fine/safe also. Have you spoken to the company's IT dept as to what they suggest for accessing what you want to do?
Ed
I don't want anyone at hotels, Wifi's or the local isp or anyone else read my emails or see my online activities through the browser.To ensure that I always used my portable computer with some VPN ( usually some simple, easy to use hotspotshield, or open vpn or packetix, ultra vpn, loki, Thor)…
I need to run Outlook email and browse the web to access company web site as a minimum.
I don't understand why running a VPN is worse than not running it at all. Jimbo and Ottosykora booth seem to claim that.
Is there a way that I can use portable apps on my flash drive and still have the same security/anonimity that I have when I take my portable computer with me and use VPN?
Because, if there isn't portable apps have a major drawback.
Whatever is good, is not bad.
Neither Ottosykora or myself are saying that you will be less secure with a VPN. We are saying that using a VPN back to your company's network will endanger that entire network to attack.
Please understand, the reason that you cannot simply run outlook and have it work from wherever you are is that your office has a firewall specifically designed to block access from untrusted computers. What you are trying to do is to connect an untrusted computer over a VPN to the network, circumventing the firewall.
Now, there are very good reasons why your office network is set up that way, so the way you are trying to get past the firewall is a bad idea.
Yes, there is a huge fundamental difference. When you use portable apps, you are at the mercy of an untrusted computer. There could be any amount of malware installed on it, or even a hardware keylogger that would track every single move that you made, and be undetectable by any software scan. This will always be the case. Using someone else's computer is inherently insecure in comparison to managing and maintaining your own computer.
Some possible solutions for you
Unmonitored web browsing
Get a copy of ToR - there are various packages available here or linked to from here with bundle it with portable browsers.
This will allow you to use a web browser without the hotel staff being able to monitor what you are doing.
Outlook access
There are two ways to allow remote access to an Exchange server that are relatively less unsafe than allowing Outlook direct access to it. Both of them will need to be set up by your IT people who manage the server, and will need work done on your company firewall, so you will need to discuss them at length with your IT people to see if they are prepared to risk either option.
1) enable the Echange IMAP server, configure it to use SSL connections, and allow these through your firewall. This would allow you to use Thunderbird portable to send IMAP email over a secure and encrypted channel, meaning that nobody in the middle can read them.
or
2) enable Outlook Web Access on the exchange server, set it up to use SSL and allow an HTTPS session to the server through the firewall. This would allow you to use a webmail interface over SSL from any browser (including a portable one) to access the emails on the server.
One final thought for you though. You say that you don't want people in the hotel / cafe / wherever to read your emails. In that case, you shouldn't even plug your flash drive in, since the moment that you do, then they can copy every single file on it to read at their leisure.
The correct way to do what you are trying is to take your laptop with you. Then all you need is to connect to the internet, set up a VPN session (in this case from your own known-to-be-safe laptop) and channel all your web and email traffic over it.
If you're not using your own laptop in this situation, then you are trading off security for convenience.
Thank you for the explanation.
This means I can only use flash drive on trusted computers abroad. It also means I will have to take my laptop with me most of times.
So to recap, if I run VPN from my laptop and portable apps firefox and/or thunderbird from flash drive everything is kosher.
I have one more question:
I seem to be having problems receiving and sending outgoing mail from thunderbird portable when VPN is up. What could be the problem?
When vpn is on I can not send or receive email.
It says:
"Connection to server timed out.
Sending of message failed.
The message could not be sent because the connection to SMTP server timed out."
I tried a couple different VPN's and so far only Ultra vpn sends the mail, but again it does not download it.
It is also slow.
Any suggestions on how to solve this problem and what VPN is best to use.
Whatever is good, is not bad.
try to increase time outs, the defoult settings are often too short. But it is a known problem when running over multiple conversion of something. It also depends on the settings of some firewalls. They are often set so that when something comes in not so clear what it is, the traffic is blocked.
Otto Sykora
Basel, Switzerland
I recently bought the IronKey (Secure USB stick) that comes with hardware encryption and embedded anonymous Firefox browser, virtual keyboard etc... Like weringpeter I do not want to take my laptop on every trip. I want to put everything on this stick- also a VPN client. The concerns mentioned in this thread against a portable VPN solution are hereby obsolete, right ? It is not a perfect solution like a trusted business laptop, but in my opinion a good compromise.
A VPN connects two networks. Think of it... like sex.
On one side, you have a nice, clean, healthy person. On the other side - Venereal Disease. You would use a condom, right?
Well a firewall, router, etc act as a condom for your network.
Using a VPN bypasses all of it. Your home network is the clean person, the Hotel, Cafe, etc has VD. By using a VPN, you're taking off the condom.
Enjoy your VD.
Nerdy Redneck
Iron key, as any other hardware encrypted devices is here to prevent someone reading the contents when he finds the stick on the street. It is encrypted well, so trying to stick it in some computer and read the contents is not possible.
When you use the iron key, that means you yourself read and write to it, that means you entered the password and the enc/decryption works, the ironkey is as safe as any other stick in the world. It is plain open to anybody, every software and every computer within any network can read and write to it the same way as you can. The security when in use is zero. If you can read your mails on the screen of the hotel computer, any software on that computer can do it too.
So if you use VPN with your ironkey, you are still connecting the whole hotel to your company network, they both are now one thing, no limits for everybody to read and write anything as declared in the local policies of the single server modules and workstations etc. It is not relevant if you use iron key or floppy disk or what ever in this case.
It has absolutely no relevance where the VPN software is stored, on the hotel computer or your ironkey, both are part of the hotel computer, the ironkey is just one of its drives at that moment.
The whole thing about the secure browser on those sticks is, they do not keep any history and such things, otherwise those are normal browsers as any others.
So the whole story is, VPN on stick is of no use, regardless how expensive the stick was. To use VPN from your ironkey is not a compromise, it is simply opening whole company network to other network (hotel etc) thus removing basic security measures set up at the home company network.
Otto Sykora
Basel, Switzerland
I think I finally get it now, the VD analogy helped.
Can any other way of birth control prevent from directly merging the two networks?
Is there a posibility of a portable firewall?! Or any other solution?
Im not the only one asking this questions... is this like the holy grail of portable computing?
P.s.
For the problem With timing out I will use:
Tools>Option>Advance Tab>Connection Timeout
What should I set the values to? I was thinking 300 ... 5 minutes?
Whatever is good, is not bad.
my one is often set to 2min
Using portable apps underway is simple and will mostly not produce any substantial security issues.
VPN connection will produce serious problems if it is used from the usb stick, it is not problem when used from your own secure laptop.
To browse securly, use some kind of encryption. Google for TOR browser. They have portable version too, simply firefox portable with encrypted and anonymized traffic.
For mail, well either you have webmail at your company, then use the TOR browser, or ask if there is SSL access to your mail account. Is there an external access to the mail account at all? If there is, it is just a setting of the server to communicate in SSL on the pop3 and smtp site.
If your company server does not support external access via normal SSL or plain communication, then set up forwarding to some standard external mail service supporting this. I am using the german service GMX (www.gmx.net) for those things. Costs nothing and all is included, SSL too.
Note that when you read the mail using mail client on the stick or what ever, still any malware on that particular computer can read your mails and what ever. A keylogger installed on such computer is able to log all you type etc still.
Otto Sykora
Basel, Switzerland
I have web mail at my company,but I am used to using programs like outlook, thunderbird...
If I use portable apps mail client (thunderbird or similar) running from my flash drive and VPN running from a secure no malware computer, will the comunication be secure/encrypted and will it live a footprint on that computer (bigger than normal portable apps footprint)?
Whatever is good, is not bad.
>If I use portable apps mail client (thunderbird or similar) running from my flash drive and VPN running from a secure no malware computer, will the comunication be secure/encrypted and will it live a footprint on that computer (bigger than normal portable apps footprint)?
Otto Sykora
Basel, Switzerland
Thanks again for sharing your knowledge and finding the solution.
What kind of footprint will the specific VPN software leave on each connected system? Just the fact that it was run or also the data that came through?
Which VPN do you find to be best ( Tor, Hotspot, Packetix, Open or something else) ?
Whatever is good, is not bad.
this word is use in different contexts, so I use it as what size is certain software setup using.
You mean probably what will be left after the use. Well certainly you have the software components itself of all the parts involved.
The traffic itself, this will be the same as if you use no vpn or similar, if you store it it will be here if not it is not here. The traffic you transport via such subsystem is not different from any other traffic, the handling of the traffic is exactly same.
So if you have a mail client and it downloads mails from some server, the mails are here.
There could be some logfiles created by the vpn subsystem, possibly.
I don't know if any 'portable' vpn subsystem might try not to use any registry etc, but somehow this is not so easy, since it will use drivers and needs installation of subsystems, so certainly if not done very perfect, files will be left in system folders and entries in registry. If done well, such things can be deinstalled upon exit, but it s not always so simple.
Certainly, after running any such system, no session keys or similar are stored anywhere regardless of what kind of software it is.
I am not using any of such vpn, we use zyxel software and hardware for setting up vpn tunnels with customers, this is much more reliable then any kind of pure software solutions. Takes some time to set all up, but then it works for years.
We use for few internal apps ipsec connection since the company server is windows server 2003 and has all components for such communication by default and is directly connectible from xp and later windows systems, as all current windows OS have all vpn components included for it. So if your server is windows based and you use portable windows computer, I have no idea why there is any need for some additional software for the vpn at all.
However for customer connections, we abolished the use of fat client vpn completely since it needs some interaction with the IT dept at customer site often. During setup of the customer site, we install once teamviewer and can then connect to the particular workstation for maintenance any time. This traffic is also encrypted, but is using 3rd party server for interconnection. But under normal circumstances, this is far good enough.
Tor is not a vpn as such, but in some ways it can reach similar results. Tor uses encrypted communication via number of intermediate servers , the aim is to anonymize traffic rather then full tunnel.It is fine for reading mails via web interface, but not of much use for other internet protocols.
Otto Sykora
Basel, Switzerland
I've seen you write a couple of times how Tor doesn't handle various protocols. As far as I know, anything that runs over TCP can run over Tor. Is there something I am missing?
but there appropriate clients would be needed to make things usable for average user.
Or do you have any idea how to use TOR for transmission of SMTP just so simple as contacting webservers on port 80?
This is what the current usage of TOR is kind of missing, proxy dealing with all and not just basic webservices. The proxies used intercept mainly websurfing , they don't care if you attempt to make ftp connection to somewhere at that moment by default.
Well they might be configured to do other things too, but not in the state you download them and use them.
Note that the extensions, for example the tor button for FF, will even try to take care of this and will attempt to disable certain functions of the FF during the tor session, so you are not tempted to transmit any data not passed via the tor network.
Otto Sykora
Basel, Switzerland
best is the one the IT admin of your company network will install for you, respective will set up a user acces for you. This is what is needed first, then you can install the laptop part first.
Otto Sykora
Basel, Switzerland
is the one that my university uses, and it works well enough, but it isn't portablalized other than that you can use software installed to do it, or you can go through the web browser to run it.
Wish it was.
Don't be an uberPr∅. They are stinky.
In regards to all of the comments on this, I think the only way to get around using a Portable VPN client without compromising the home network is to do what I do, i.e. use a bootable linux on USB Stick, reboot the hotel machine, reset the bios so that it will boot from the USB and then VPN from there. That works fine. You create a vpn from an operating system you control via the USB key. I have successfully installed CentOS and Puppy Linux on a USB key and you can preconfigure it with your email, browser configs etc.
I am thinking that you could also perhaps make a "Portable" VMWare image that you could use in the same fashion.
A little more complicated but also doable I think although the latter I have never tried....would probably need a big USB key.
Chris L.
since it assumes that the hotel machine is set up stupid enough to be able to simply be rebooted from anything, then all the set up at the company server is prepared, that means the right ports open on the main router and firewall and the main server to allow such operation. Then you can control things on the server. To run your own local apps to be able to use the tunnel only proper setup needs to be done for the special user on the server as well.
Does your company really set up all such things for their employees?
I mean , I have just seen what work was needed to set up a tunnel for just using skype, the admin of big communication company spent almost a day to arrange for all those forwardings on all relevant servers , not so simple task.
Otto Sykora
Basel, Switzerland
You need a portable OPERATING SYSTEM.
The problem is that Portable Apps are just that - apps. You have to have an OS to run them on and that OS in a hotel, hospital, or other public kiosk, is not capable of being trusted.
When you run a VPN, you're inherently giving that OS, not your portable apps, access to the network at the other end of the VPN tunnel.
What you need is a Live CD (Xubuntu Linux is my favorite) that runs from USB. Then you can run your own OS on top of (or in lieu of, if you know what you're doing) the hotel's. Once you're in your own OS THEN you can fire up your VPN client and safeguard the data as it travels between your OS and the other end of the tunnel.
EDIT: Nevermind, somehow I missed that Chris had ALREADY mentioned this...
otto: Alot of hotels don't touch the BIOS - they secure at the OS level only, so booting from a USB is fairly easy to do. If the OP's company is using a pre-packaged solution (ie. Cisco concentrator with client) then there's nothing extra needed from the OP's or the company's standpoint - it wouldn't work any differently than installing the company-approved client on his company-issued laptop, it's just installed on a bootable USB instead of a HDD.
>If the OP's company is using a pre-packaged solution
Otto Sykora
Basel, Switzerland
where he mentioned he was already using VPN with his laptop?
If he's using VPN with his laptop then the "company" side of the equation already is functional and we already know that intervening firewalls/etc. likely aren't an issue.
you are new here so you dont know the OP yet
Otto Sykora
Basel, Switzerland
Hi Everyone
I realise that this thread is several months old now but I just wanted to say "thanks" to the main contributors for a really interesting and thought provoking discussion.
I had recently configured OpenVPN on a computer at home and was looking at the OpenVPN PortableApp to (hopefully) use on a write-protected pen drive. It seemed like the perfect solution for combining my need for secure remote access and my preference for not lugging a laptop around.
But, and it is a massive but, I hadn't considered the inherent risks of connecting the "donor PC" running PortableApps straight into my home network. Stupid me. You've potentially saved me from a big headache.
I like the idea of a bootable pen drive to run a trusted OS on a donor PC but it also seems flawed (locked down boot devices, hardware compatibility issues, risk of a hardware key logger).
So I'm going to settle on the following...
Carry a laptop around with me where this is practical and use OpenVPN to remote in from this trusted computer.
For situations where I don't have a laptop with me I could fall back on a web-based remote access solution. I'm not comfortable with the idea of remote access via a third party but with at least one company offering a two-factor authentication option (username and password plus one time code emailed to my phone) it seems to be the best available compromise. The issues of malware (especially keyloggers) on the donor PC still seems a risk so I wouldn't use it for entering anything sensitive. But at least there shouldn't be the same conduit available for nasties to attack my home network.
Thanks again
Notlob.
when using those tools 'twisting' the connection on the providers server.
With my previous work, we ended up installing teamviwer on all computers we could have to work with, even some client in a bank etc. I was first somehow reluctant to use such tools, but then got all the reports from german computer safety gov agency, they seem to cleared it and did not find any holes in the system. The only uncertainty is in fact the handling at the 'twisting' server, where we can ask does the operator of the server have way to copy down what is going over the server?
And we have to see the big advantages of such system: simple installation, no complex setup of the router/firewall etc.
OK it is limited somehow therefore, but all such services work often plug and play fro everyone. Some charge for the service other not, they often use simple operating systems encryption tools, nothing extra, no extra software burden on the system.
OK, we can start having doubt abt ssl encryption implemented in operating systems, but then we reach super military security level where special operating systems are needed anyway.
Banks use separate key transmission too, but rather as precaution if some idiot will agree to any key being accepted as valid, even the one obviously from ManInTheMiddle.
For all normal use, ssl traffic for email i s OK, for browsing too, so what we want more.
I mean, when I have to get emails from some files at home on the complicated way of securely contacting the home store, I would have to take care first that those mails did not travel all over the world in plain text first, which to great extend those mails did, as mail servers do not use any kind of encryption between them in general.
Otto Sykora
Basel, Switzerland
I first got the idea by stumbling across SurfEasy's Secure Broser USB (links forthcoming), but the apathy in the midsr of violation with so many brilliant people I love set me - a super creative type, painter, poet, for YEARS teased as a "techno-tard". On a Mission now. I'm making my own version of SurfEasy's thing, custom credit card USBs I design and load with what I consider most important. I am stubborn and poor, otherwise I would never be struggling like this...I would biy a handful of these:
https://www.bestvpn.com/surfeasy-vpn-review/
And/or make a TAILS or even more, MOFO linux live boots, and pau. Here's MOFO:
https://mofolinux.com
I'm using much of the same, (trying to), but adding to it. Rohos Mini Drive has been AWESOME. Safekeys, OTFE, file shredder, and I can even figure my way around it. And the Invizbox Go is a splurge on a few people as well, then some Opendime bitcoin sticks, (I'd love to get everyone here to wake up and see how much we would benefit from heavily adopting btc - tourism and all..and again, were I wealthy, I would love to get everyone a BitLox, my fave Hardware Wallet, hands down.
All these later, it's still not entirely straightforward- unless you pay for it to be. But there ARE options...for those who have more liquidity of income (not starving artists), and tech ability (not starving artists, lol). I just saw this thread, and appreciate the insight I gained from all who joined in. Back to nearing my right-brained head against the wall working this out....
At least the credit card USB I designed looks awesome, if I may say so.
Cheers!
Hi,
I know this is an old thread.. but the anwser to your question can be found on
http://www.portablevpn.nl
Best regards,
Emiel Wieldraaijer
Will you develop a version of potablevpn for potableapps?
if you mean the above mentioned portablevpn , then this is payware, you have to buy it, so it is unlikely to be available here.
Now it also depends on what you want do with vpn. If you just want have some simple connection to your home pc, then you can use teamviewer which has kind of vpn (not direct, 'twisting' over the teamviewer server) included.
Otto Sykora
Basel, Switzerland
I am probably 12 years too late and nobody will see this but if you download opera portable, that has a built in search vpn which'll encrypt your searches only on Opera without admin permissions. Another option could be a portable TOR browser, which is like a VPN but ramped up but only for searches (used mostly for dark web, so stay safe). If you want to encrypt all your network traffic, can't help you there sorry.
sure someone reads it still
just the topic is old and based on misunderstandings what a VPN is
Otto Sykora
Basel, Switzerland