Is there a better way to prevent Internet connection before VPN connection other than carrying a mobile AP?

Question

Cellular data (LTE, 4G, 3G, etc) is very expensive and one can find some free Wi-Fi APs. But these days, there are so many compromised or malicious APs.

To prevent man-in-the-middle attacks and to access the files stored on my home server, I would like to use a VPN tunnel to my home VPN server. The only problem is that background applications and services may try to access the Internet as soon as the network is connected before I connect the device to the VPN server.

The only guaranteed solution I came up with is to carry a private mobile AP that has VPN functionality built-in, and connect to the Internet through it. (I have not searched for such product yet; I just thought of it.) But are there any software-based generic solutions? Since I need to use Android, Windows, and OS X, I would like to know solutions for any of these OSes.

Answer 1

Only allow access to your private servers / services via VPN and not over the public internet. If you want public access also, you can have a different domain name for the internal access vs public access. Use Let's Encrypt to issue https certs for your custom domain names. This will help with man in the middle attacks. I would not expose any ip cameras to the public internet because of low quality security that many devices have.