982483 - new VPN set up no longer allows use as secure proxy to the internet

Status: RESOLVED FIXED

(Infrastructure & Operations :: Corporate VPN: Support requests, task)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Filing this bug per the instructions in the email:

Date: Tue, 11 Mar 2014 21:48:28 -0000
From: [e-mail]
To: [e-mail]
Subject: [Notification] Mozilla VPN now supports all offices - All VPN users
        please read

I switched my VPN setup from the old office VPN to the new Mozilla VPN, and one of the things I depend on the office VPN for is one of the things that https://mana.mozilla.org/wiki/pages/viewpage.action?pageId=30769829 documents cannot be done with the new VPN:

"The new OpenVPN does NOT provide:
 * A secure proxy to the internet (the VPN has no Internet access - and will not get Internet access)"

(And I tested it, and it indeed doesn't work.  In fact, I found that it didn't work before noticing that part of the documentation.)

Use of the VPN for this purpose is officially recommended by our own security guidelines, e.g., in:
https://mana.mozilla.org/wiki/display/SECURITY/Traveling+to+China
and I've frequently used it for this whenever I was concerned about the security of my internet connection when traveling.

Do we have an appropriate alternative to use for this purpose?

Comment 1

[Justin Dow [:jabba]]

For now, I'd recommend using the San Francisco office VPN, which is configured to allow tunneling to the internet. It is using the same config as the old office.mozilla.org/mv-vpn01 VPN, so use that existing VPN profile, but change the name to Mozilla-SFO1, and change the remote connection endpoint to "vpn.sfo1.mozilla.com" or "146.82.185.164".

Each office will likely retain a VPN server setup like this (allows connection to that office as well as to the internet), and the new Mountain View will have this service as well (vpn.mtv2.mozilla.com - but not set up yet). Note that these VPN endpoints will not provide SSH access or have the wide internal access that office.mozilla.org/mv-vpn01 had, but should cover the case where a tunneled internet connection is needed.

The new MozillaVPN is however the preferred method for accessing all internal resources in datacenters as well as offices, and these individual office VPNs are just specifically for geographical proximity to a given office as well as outbound internet access.

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

bug 1000911 is another version of this same bug.

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

The new External VPN was set up in bug 1269077.