**SafeSearch; Microcomputer with Obfuscated VPN Server for Securing Network**
\*\*Double blind review, please do not include authors information in this version \*\*
Received Date: \*date
Accepted Date: \*date
Published Date: \*date
**HIGHLIGHTS**
- Obfuscated VPN Server was developed in Raspberry Pi 3 using OpenVPN protocol and obfuscated technique.
- Used open-source software and low-cost VPN Server implementation to secure the network
- VPN Traffic successfully be disguised to bypass web filtering and deep packet inspection
- Network Assessment Penetration Testing prove that the SafeSearch VPN Server provide the ability in improving the level of security in the network.
ABSTRACT
*In networking, a VPN also known as Virtual Private Network could be described as a private network that uses public network to tunnel the connection from the user end until it reaches the VPN server. VPN allows user to create a secure connection to another network over the public internet. VPNs can be used to shield users browsing activity and encrypts data transmitted over the network to prevent sniffing attack. Nowadays, user can either pay a premium price for a good VPN service or risk their privacy using free browser-based VPN. Thus, SafeSearch is developed to address these issues in mind. With SafeSearch, users will not need to fork over their hard-earned money for premium VPN subscription services or expose themselves to targeted advertising when utilizing free browser-based VPN. OpenVPN protocol was used to create the VPN server on a microcomputer called Raspberry Pi. The software used was mostly open-source except for the VPN client. Obfuscation technique is used to hide VPN traffic by disguising it as just another normal internet traffic to against Deep Packet Inspection when passing through firewall. After the VPN server was established, tests are carried out to evaluate the functionality and reliability of the VPN server in “real-world” environment. The tests that have been conducted were network restriction penetration assessment, network performance and user acceptance test. Penetration assessment result shows that SafeSearch was capable to bypass web filtering and deep packet inspection. Network performance during SafeSearch connection has slightly latency and bandwidth degraded but not much affected. The outcome of the user acceptance test was positive as substantial amount of participant are confident that SafeSearch can secure their connection and protect their privacy when browsing the web. To conclude, both objectives in this project were fully achieved and the scope given was followed thoroughly.*
*Keywords: Virtual Private Network; Obfuscation VPN; OpenVPN; Raspberry Pi; Microcomputer, security*
# INTRODUCTION (Arial 12)
A Virtual Private Network (VPN) is a secure connection that normally adding the security layer and increase the privacy in private and public networks, like Wi-Fi Hotspots and the public Internet. VPN are most often used by organizations to protect their sensitive data (Whatismyip, 2021). VPN can increase network security because the user's initial IP address is replaced with the one the VPN provided. By greenlighting this project, users will be able to connect to their VPN anywhere anytime on any public Wi-Fi.
Nowadays, information theft is rampant globally. According to Legezo, the statistics from Kaspersky Security Network (2016) found that approximately 24.7% of Wi-Fi hotspots in the world do not use any encryption at all. Basically, perpetrators equipped with a 2.4Ghz antenna capable of sending and receiving data can easily intercept and store user traffic. This unencrypted traffic can reveal user passwords and other essential data. Norton Cybersecurity Insights announced that 594 million people around the world were victims of cybercrime as of their 2014 report which is conducted every 5 years. The report also indicates that 21% of Americans are getting their email hacked and 12% having their financial data stolen after shopping online (Moore, 2015). Although 68.02% of Wi-Fi hotspot uses WPA2 which is better in terms of security, they are still vulnerable to brute-force and dictionary attacks. Recently, WPA2 encryption has a severe flaw that lets attackers perform Key Reinstallation Attack (KRACK) to break the encryption (Vanhoef & Piessens, 2017).
In addition to solve this problem, VPN is used when browsing on public Wi-Fi. VPN services such as NordVPN and TunnelBear are very secured but comes with monthly cost. On the other hand, there exist free VPN services, but users cannot change the port. This is a serious problem because most workplaces will only allow port https (443) and http (80). Above all, these kind of VPN’s does not use obfuscation technology rendering them useless against Deep Packet Inspection when passing through firewall. Obfuscation technology is used to hide VPN traffic by disguising it as just another normal internet traffic. SafeSearch is a project that encompasses a small Raspberry pi microcomputer installed with OpenVPN that is setup at home internet. This will allow users access to their own VPN Server which will effectively eliminate the steep monthly cost they need to pay for a viable VPN service.
# LITERATURE REVIEW
**Virtual Private Network**
VPN is service that provide secure web access by privately routing your connection through a VPN server and hiding the client’s online actions. The VPN software will encrypt the data, even before an Internet Service Provider (ISP) or the public Wi-Fi provider sees it. The data then goes to the VPN, and from the VPN server to the client’s online destination. The online destination sees the client’s data as coming from the VPN server and its location, and not from the original source which is the location of the client itself (Mardisalu, 2020; Whatismyip, 2021). VPN protocols define how the service handles data transmission over a VPN. The most common protocols are Point-To-Point Tunnelling Protocol (PPTP), Layer 2 Tunnelling Protocol (L2TP), Secure Socket Tunnelling Protocol (SSTP), Internet Key Exchange, Version 2 (IKEV2), and OpenVPN (Jaha, 2015). OpenVPN takes what’s best in the above protocols and does away with most of the flaws. It is based on SSL/TLS protocol, and it is an open-source project, which means that it is constantly being improved by hundreds of developers. It secures the connection by using keys that are known only by the two participating parties on either end of the transmission. Overall, OpenVPN is the most versatile and secure protocol out there (Mardisalu, 2020).
**VPN Obfuscation Technique**
Obfuscation is a technique used in ‘Stealth VPN’ which is simply a VPN server or protocol that can disguise VPN traffic as regular web traffic, even when subjected to deep packet inspection by the network administrator or firewall (Bodis, 2017). A stealth VPN is designed to be hard to detect by firewalls and applications intended to block VPN traffic. VPN-blocking firewalls are common in countries that restrict or censor access to the internet.
The way Stealth VPN works is it starts with a regular OpenVPN encrypted data. A typical OpenVPN data packet consists of two parts which is the header that contains packet identification and routing information. The other part which is the payload contains encrypted portion of the data packet, which will be forwarded by the VPN server to the correct web address. The stealth VPN then uses Obfuscation technique to remove all meta data from the packet header that identifies the data as belonging to a VPN protocol. Since the source packet has been obfuscated, the final step is for the stealth VPN to cloak it as regular HTTPS encrypted web traffic. The OpenVPN data packet is wrapped inside a 2nd layer encryption, using SSL or TLS protocol which is the same encryption used by HTTPS. The data is then assigned to port 443 also knows an HTTPS. With these two steps, the data packet is virtually indistinguishable from regular https data and is nearly impossible to block.
**Related Works**
Taib, A. M., et al., (2020) implementing VPN with Pi-Hole and Intrusion Prevention System (IPS) using Raspberry Pi to secure the network. The researchers named the project VPiSec which the system has been developed using OpenVPN protocol and Pi-Hole application to block any known tracking Domain Name System (DNS) and advertising domain. This project also implementing Intrusion Prevention System (IPS) to prevent the brute force attack. The network performance has no significant difference while the users connected to the VPN.
Taib, A. M., et al., (2020) developed an integrated tool that implementing OpenVPN protocol, DNS blocker and Intrusion Detection System (IDS) known as NetGuard. The researchers using Raspberry Pi to develop the system. OpenVPN used as the protocol to provide the security and encryption for the network traffic while DNS blocker prevent from unwanted advertisement. In the paper, the researcher provides the data that show the numbers of respondents satisfied with the network performance and security during their connections using this system.
Pooja, Akansha & Anurag (2018) developed their project Secure VPN Server Deployed on Raspberry Pi. The authors conducted a research on public Wi-Fi security. From their research, it is concluded that users who used public Wi-Fi risk their privacy being intruded by unauthorized individual. In accordance with the problem stated above, the researchers came up with the idea to implement a VPN Server into the Raspberry Pi. The project established the connection between VPN Server on Raspberry Pi and VPN client to provide multiple layers of protections. Once VPN session has been established, the researchers implement VPN authentication mechanism by incorporate three layers of verification. Finally, the project aims for portability, the whole project is deployed on a Raspberry Pi environment. This enables the system to become extremely portable, reusable and user friendly.
# METHODOLOGY
This research methodology has several phases which include analysis requirements, design and implementation, testing, and result analysis phase. During Requirement Analysis, all required hardware and software for the project were determined. Table 1 and Table 2 show details of the hardware and software requirements.
**Table 1:** Hardware Requirements
| No. | Item | Description |
| --- | -------------------- | --------------------------------------------------------------------------------------------------------------- |
| 1 | Raspberry Pi 3 B+ | Act as a VPN server. Used to implement all the networking features required for this project |
| 2 | CAT 6 Ethernet Cable | Provides a stable internet connection to the Raspberry Pi |
| 3 | Micro SD card | Used as a storage device on the Raspberry Pi |
| 4 | Laptop | Used to configure routers and Raspberry Pi. Also used to connect to the VPN when it is operational |
| 5 | Router | Used for networking purposes such as DDNS and packet forwarding. Connects the VPN server to the world wide web. |
**Table 2:** Software Requirements
| No. | Item | Description |
| --- | --------------------- | ---------------------------------------------------------- |
| 1 | PuTTy | SSH client interfacing software |
| 2 | VNC Server and Client | Remote access software |
| 3 | OpenVPN | Open-source VPN protocol |
| 4 | Obfuscation Proxy | Disguise traffic to bypass firewall |
| 5 | Raspbian | The operating system used on the Raspberry Pi |
| 7 | Viscosity | An OpenVPN client for users to connect to their VPN server |
| 8 | Iperf | Network performance analysis tool |
From the table above, all the components were assembled to create a microcomputer server. In this project, Raspberry Pi 3 (RPi3) Model B+ been used because it can boast a quad core processor clocked at 1.4Ghz and with 1GB of RAM. This device is more than enough to handle OpenVPN and supports an ethernet port with speeds up to 300 Mbps which is vital for OpenVPN server operation. Furthermore, headless setup is easier on RPi3 compared to its predecessor which is the Raspberry Pi Zero due to the presence of an ethernet port. A headless interface was possible due to Raspbian pre-installed with a VNC server.
A router is needed because the VPN server must be remotely accessed through the internet. Figure 1 displays the system architecture design for this project. User can access the OpenVPN server by using Viscosity, OpenVPN client software. The OpenVPN client will create a tunnel through the network so that encrypted and obfuscated packet can pass through until it reaches the OpenVPN server network. The packet will then be port forwarded to the VPN server itself and then reaches the desired website on the internet.
**Figure 1:** System Architecture
The process of installing OpenVPN in the Raspberry Pi 3 to create VPN Server started by using a shell script downloaded from the Linux repositories. After the installation is finished, an “ovpn” file is generated which contains all the necessary info that can be imported into a VPN client. Then, the VPN Server has been successfully setup on our local network to bypass network restrictions on public networks.
Next, obfuscation proxy needs to be installed inside VPN Server. In this project, a software called Obfs4 being used. Obfs4 is a scrambling proxy that can disguises the user’s internet traffic and resembling as a noise. Man-in-the-middle attacks are rendered useless, and it is impossible for perpetrators to spy on the user’s activity online. Furthermore, content blocking or filtering can easily be bypassed because Firewall Deep Packet Inspection outright ignores noise signals during the connection using obfuscation proxy.
Figure 2 shows the step to install Obfs4 alongside Figure 3 and Figure 4 which shows the configuration for which the proxy will listen for new connections. After all the steps are accomplished, Figure 5 shows an example of the cert KEY.
**Figure 2:** Obfs4 Installation Steps
 
**Figure 3:** Obfs4 Proxy Configuration **Figure 4:** Obfs4 Listening the New Connection
**Figure 5:** Obfs4 Certification Key
After setting up a VPN server, the connectivity has been tested by using a VPN client software. In this project, Viscosity software has been used as VPN client because it has obfuscation functionality. Viscosity is an OpenVPN client that supported on Windows operating system and Mac operating system. Viscosity providing user friendly interface for creating, editing, and controlling VPN connections. Thus, it easy for users new to VPNs to get started because of its clean and clear interface that simplifies menu such as creating, configuring, or importing VPN connections. Viscosity also caters for power and expert users by allowing full control over VPN connections, powerful routing options, custom scripts, and the ability to use obfuscator as a transport method. VPN clients with obfuscation transport method are more secured and can bypass firewall.
**TESTING AND RESULT ANALYSIS**
Several tests were conducted throughout the project to ascertain the viability of SafeSearch when used on a public network. These three tests were network restriction penetration assessment, VPN server network performance and lastly user acceptance test.
**Network Restriction Penetration Assessment**
VPNs are effective at securing a way to bypass geo-blocking and censorship, but government institutions and corporations that seeks to control internet access are always one step ahead. Various Anti-VPN technology can detect and block VPN users from websites and local networks that violates the country’s laws and regulations. This assessment was carried out to evaluate how effective SafeSearch is at penetrating network restrictions, the results were obtained through passive observation.
The test carried out was simply a passive observation. In this case, the test was carried out inside UiTM Arau campus. This test requires the user to access a blocked website in the web browser for example, a torrent website. Then user must connect to the VPN server and reload the page. If the website was accessible, the VPN worked. This meant that web filtering and deep packet inspection was easily bypassed.
Moving on to port blocking, user can simply try to torrent files through peer-to-peer connection. If torrent connections worked, the VPN can bypass port blocking. In the case of strict NAT, this can be tested through hosting online games. If the user can successfully host a game server, the test was a success. Finally, user can check if the IP is blacklisted using a website called “Whatismyipaddress.com”. Navigate through their website and find the IP blacklist check tool. Table 3 and Table 4 shows the assessment score guideline alongside the network penetration test results.
**Table 3:** Assessment Score Guideline
| 1 |
Poor
|
| 2 |
Average
|
| 3 |
Excellent
|
**Table 4:** Network Penetration Test Result
| Obstructions. | Description | Score (1-3) |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------ | ----------- |
| Web filtering | A proxy firewall may block certain websites based on category tags | 3 |
| Port blocking | Routers can allow only specific port to be forwarded, blocked ports will drop the packet | 3 |
| Deep packet inspection | Deep packet inspection can drop a packet on the fly if it determines that the packet is going to a blocked destination address | 3 |
| Strict NAT | Specifically, for hosted game servers. Players from outside the LAN will not be able to join the server. | 2 |
| IP block | Certain ranges of IP addresses are blocked from a web server. | 1 |
| Total Score | 12/15 | |
**VPN Server Network Performance Assessment**
Latency is a term used when delay happens in data communication over a network. It is a time interval between the user’s request and the server response (Kwon, 2015). There are many factors that affect latency. Transmission mediums such as WAN or fiber optic cables all had limitations that can affect latency simply due to their nature. Different routers have different approaches to analyze the header information of routed packets as well as in some cases, add additional information. Every hop a packet takes from router to router increases latency. Finally, distance can also affect latency because of light propagation speeds in fiber optic cables. High latency creates bottlenecks in any network communication. It prevents the data from taking full advantage of the network pipe and effectively decreases the communication bandwidth (Techopedia, 2021).
This assessment was carried out to measure the latency when a user browsed the web with a VPN and without a VPN. Three websites each hosted at different countries were visited to test the latency. The tools used for this testing was Azure Latency Test. Readings are taken 3 times every 60 seconds to calculate the average. Table 5 shows the result of the latency assessment and Figure 6 shows the graph of average latency in different countries.
**Table 5:** Network Penetration Test Result
|
Singapore |
UK |
US |
|
|
|
|
With VPN |
No VPN |
With VPN |
No VPN |
With VPN |
No
VPN |
| 1 |
54 |
33 |
211 |
186 |
293 |
248 |
| 2 |
52 |
29 |
214 |
188 |
310 |
240 |
| 3 |
60 |
37 |
219 |
189 |
285 |
256 |
| Average |
55 |
33 |
215 |
187 |
296 |
248 |
**Figure 6:** Average Latency in Different Countries
Based on the graph above, the average latency increases when users tunnelled their connection through a VPN server. One of the principal causes of network latency is distance, therefore the farther the client is from the server, the higher the latency. Therefore, latency in countries such a UK and US are higher. Distance coupled with the VPN server alongside the processes performed by the obfuscation proxy to hide traffics will slightly increases latency. Although the higher latency has a negative effect on user’s experience, it is a necessary trade-off to ensure their privacy was not intruded upon.
Bandwidth describes the maximum data transfer rate of a network or an Internet connection. It measures how much data can be sent over a specific connection in each amount of time. Sometimes, VPN encryption protocols can potentially cause the low bandwidth.
This assessment was carried out to measure download and upload speed using VPN and without VPN to discover how much bandwidth was lost in the process. The tests are accomplished with an ADSL internet connection with download and upload speeds of up to 30 megabits per second. The tools used to measure bandwidth speed is a website called “speedtest.net”. Both download and upload speeds are taken 3 times to accurately calculate the average speed. Table 6 shows the bandwidth test results and Figure 7 shows the average download and upload speed with VPN and without VPN.
**Table 6:** Bandwidth Test Result
| Test | Bandwidth (mbps) | | | |
| ------- | ---------------- | ----------- | -------- | ----------- |
| | Download | Upload | | |
| | With VPN | Without VPN | With VPN | Without VPN |
| 1 | 20.80 | 24.82 | 25.56 | 29.63 |
| 2 | 25.12 | 27.97 | 20.44 | 29.52 |
| 3 | 17.00 | 26.97 | 17.22 | 31.13 |
| Average | 20.98 | 26.59 | 21.07 | 30.09 |
**Figure 7:** Average Download and Upload Speeds
Based on the results above, bandwidth decreases when using VPN due to the overhead cost when going through the VPN tunnel.
**User Acceptance Test**
In software development, user acceptance testing is a process to evaluate whether the solution created fits the user’s narrative. The goal of User Acceptance Test (UAT) is to ensure the software or hardware can both handle real-world tasks and perform up to development specifications. For this project, user acceptance testing was performed by giving 32 participants various questions to test their knowledge and awareness to cybersecurity issues such as the dangers of public Wi-Fi.
The questions are formulated using google form because it is easy and intuitive to use. The participants then were given access to the VPN Server so that they can test its functionality. Participants were told to visit blocked websites, send any e-mail, or visit any social media websites. The ingress and egress packet will be captured by a packet sniffer software to test the VPN security (Girdhar, et. al, 2016). After their hands-on experience with the VPN Server, participants were told to give feedback by answering the google form questionnaire to evaluate their web browsing experience. Below are the questions in the questionnaires used for User Acceptance Test.
Q1: By using SafeSearch, I would never have to worry about my privacy.
Q2: By using SafeSearch, information theft can be reduced
Q3: By using SafeSearch, I can bypass network restrictions with ease
Q4: SafeSearch does not impact my experience when browsing the web (lag, error 404, failed download)
Q5: Overall, I am satisfied with SafeSearch
**Figure 8:** Mean Results of SafeSearch Prototype Evaluation
Based on Figure 8 above, the outcome was positive as the average mean results were above 4.5. The result shows that the project can perform up to development specifications. Moreover, participants were satisfied with how SafeSearch functions to secure their privacy by encrypting transmitted packets. This proved that the project was a success.
**CONCLUSION AND RECOMMENDATIONS**
The development for SafeSearch – Obfuscated VPN Server using microcomputer is low-cost implementation and simple to be configured. This system was developed to provide the secure connection and hide users online traffics activity when browsing the web through the public network. The purpose of this project is to develop a custom VPN server using a low-cost Raspberry Pi so that users can save cost by not subscribing to a premium VPN service or even the free VPN. Furthermore, Safesearch is also more secured than any other VPN because it uses the OpenVPN protocol which performs great under high latency connections and provides strong encrypted connectivity to user’s online activity. Based on the user acceptance test that been conducted with 32 respondents, most of them was satisfied with the VPN and confident that it would protect their privacy. The network performance also has slightly degraded during connected to the VPN Server but has no significant difference in terms of latency and bandwidth. The SafeSearch network performance considered excellent which still can provide the great connectivity along with the strong security.
Since the VPN was completed, there are several recommendations to improve the system for future uses. One of the recommendations was to implement a DNS sinkhole inside SafeSearch to block out targeted advertisement. A DNS sinkhole sits between the user and the internet to intercept any outgoing or incoming DNS requests to block certain domains from accessing the user’s device, mainly advertisement websites. Besides that, another recommendation was to install an Intrusion Detection System (IDS) to further secure the traffic routed to SafeSearch. Network traffic that’s injected with a virus can be stopped before entering the network.
**REFERENCES**
Bodis, M. (2017). What is Obfuscation? Retrieved from https://hackernoon.com/what-is-obfuscation-30d8cc68b4d8
Girdhar, P., Tech, M., Phool, B., Vishvidhalaya, M., & Khanpur, K. (2016). A Study on Detecting Packet Using Sniffing Method. *Journal of Network Communications and Emerging Technologies*, 6(7), 45–46.
Jaha, A. A. (2015). Performance Evaluation of Remote Access VPN Protocols on Wireless Networks. *International Journal of Computer and Information Technology*, 04(02), 201–206.
Kwon, M. (2015). A Tutorial on Network Latency and Its Measurements. Enabling Real-Time Mobile Cloud Computing through Emerging Technologies. ISBN: 9781466686625
Legezo, D. (2016). Research on Unsecured Wi-Fi Networks Across the World. Kaspersky Security Network. Retrieve from https://securelist.com/research-on-unsecured-wi-fi-networks-across-the-world/76733/
Mardisalu, R. (2020). What is VPN and How Does VPN Work. The Best VPN. Retrieve from https://thebestvpn.com/what-is-vpn-beginners-guide/\#what
Moore, R. (2015). Cybercrime Investigating High-Technology Computer Crime. Routledge. 2nd Edition. ISBN: 9781138168626
Pooja Karan, B., Akansha Santosh, M., Anurag Mohan, N., & Madhumita, C. (2018). Secure VPN Server Deployed on Raspberry Pi*. Journal of Network Communications and Emerging Technologies (JNCET)*, 8(5), 31.
Taib, A.M., Zabri, M.T., Radzi, N.A.M., & Kadir, E.A. (2020). NetGuard: Securing Network Environment Using Integrated OpenVPN, Pi-Hole, and IDS on Raspberry Pi. *In. Charting the Sustainable Future of ASEAN in Science and Technology*, 97-110
Taib, A. M., Ishak, M. F. H., Kamarudin, N. K., Darus, M. Y., Radzi, N. A. M. (2020). Securing Network Using Raspberry Pi by Implementing VPN, Pi-Hole, IPS (VPiSec). *International Journal of Advance Trends in Computer Science and Engineering*, 9(1.3), 457-464
Techopedia. (2021). What Does Network Latency Mean? Retrieve from https://www.techopedia.com/definition/8553/network-latency
Whatismyip. (2021). What Is A VPN? Virtual Private Networks Explained. Retrieved from https://www.whatismyip.com/what-is-a-vpn/
Vanhoef, M. & Piessens, F. (2017). Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2. *Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security*, 1313-1328.