Welcome to MSDN Blogs Sign in | Join | Help

Disable your wireless network card to speed up VPN'ing

As a follow-up to my tip on speeding up connecting via RAS and a SmartCard, I've been told that another trick you can do is to disable your wireless networking card before initiating the VPN connection. Wireless networking cards are a huge attack surface, and the VPN software spends a lot of time trying to secure it.

I don't have a wireless networking card on the machine I use at home to connect to the work network, so I haven't tried it, but who knows, maybe it'll work for you.

Published Wednesday, October 15, 2008 7:00 AM by oldnewthing
Filed under:

Comments

# re: Disable your wireless network card to speed up VPN'ing

Wednesday, October 15, 2008 4:09 PM by Tom

Sounds very vague. Perhaps you could get your source to elaborate?

My VPN software (OpenVPN) doesn't touch any wifi hardware when connecting, other than actually using the card to connect.

A disconnected wifi card surely has no greater attack surface than a disconnected wired NIC?

# re: Disable your wireless network card to speed up VPN'ing

Wednesday, October 15, 2008 5:02 PM by Christian

Yes, but OpenVPN is no "solution", it's just an excellent excellent tool/product.

Microsoft definitively uses such bogus software that checks whether your handbrake is on äh I mean, whether your virus scammer äh scanner is running and whether windows update is on, etc...

From a security perpective this is *always* rubbish because you easily can and should fool that software and waive it with an "all is okay" packet.

Sadly there is MUCH too less informationen about sending fake status reports to such "solutions".

Of course it's also a matter of policy or termination

(unless you don't disassemble your laptop or have the admin passwort and there is no virtualization or trusted computing involved)

# re: Disable your wireless network card to speed up VPN'ing

Wednesday, October 15, 2008 5:09 PM by Matthijs

Indeed, it sounds strange to me too. The VPN software might indeed have to jump through a dozen hoops to secure the wireless connection. But I really doubt it is continuously spending CPU time to ignore the wireless connection.

# re: Disable your wireless network card to speed up VPN'ing

Wednesday, October 15, 2008 5:17 PM by David W.

I'd love to know what it's "securing" too. Perhaps run procmon while connecting, and post a little comment here?

# re: Disable your wireless network card to speed up VPN'ing

Wednesday, October 15, 2008 7:02 PM by Gabe

What if I access the VPN with my wireless connection?

# re: Disable your wireless network card to speed up VPN'ing

Wednesday, October 15, 2008 8:24 PM by KJK::Hyperion

Tom: don't trust OpenVPN over wireless connections, a thousand times so if you are using redirect-gateway. If the wireless connection goes down and then back up, its "real" routes pushed by the DHCP server will override the OpenVPN routes. I discovered this the hard way

# re: Disable your wireless network card to speed up VPN'ing

Wednesday, October 15, 2008 11:21 PM by Dan

Hyperion: You can try the OpenVPN option that uses route.exe to set routes instead of using the normal API calls.  I think those are persistent...

# re: Disable your wireless network card to speed up VPN'ing

Friday, October 17, 2008 5:02 AM by Bikedude

Christian: I think I agree.

Yesterday I struggled with Vista's built in zip-support. It refused to unzip .js files, so I removed the script host association for those files. Then it refused to unzip files that had no extension... I was lost for words. I usually unzip using the command line, but this time I needed to avoid one directory in particular and the visual approach seemed easier.

Then I needed to send a .js file to a MSN contact and was told I had no virus scanner installed. WTF? I told it to use C:\nonsense.exe as its scanner, and the upload went well. However, that screwed up my downloads of course, since c:\nonsense.exe does not actually exist.

Pre-emptive Raymond snarky comment: Yes, I realise you are not to blame, wrong team and all... I still would like to point out that most security software is overkill and just an annoyance to advanced users.

New Comments to this post are disabled
 
Page view tracker