(Non-BT) Fon WAP security

Even if you aren't a BT Broadband customer, you can, apparently, get access to Fon hotspots by buying a Fon WAP to provide a public hotspot via your own Internet connection.

The Fon blurb says

In reference to support.fon.com/entries/20106041-How-do-Foneras-work-:

The Fonera routers use your existing connection and send out a public and private wireless signal. It is the public signal that makes your Fonera a Fon Spot. You will use the public signal of other Foneras to connect when you are travelling. The private signal is strictly for you, your family, and friends that live in your residence since it is encrypted.

But how does the security on that work? What stops people connecting over the "public signal" from being access your LAN once they have a connection, via the Fon WAP, to your router?

The connection is in a VPN tunnel with no access to your network.

Ta. I don't understand enough about VPN works to know how that makes it safe. I guess I have to either just trust that that's OK, or not turn on the Fon (or, turn it on but remove aerial).

Do you also understand how MAC filtering for WiFi connections works with the Fon devices? I currently have a separate WAP, and enter into the the router's whitelist the MAC addresses of everything I want to allow to connect via the WAP.
My naive view is that with the Fon either I need to turn off my router's MAC filtering of WLAN clients, or no-one can connect. Fon say not, but can't explain why to me - does the Fon WAP get around MAC filtering by pretending all the clients are wired?

In reply to a post by d_nick:

But how does the security on that work? What stops people connecting over the "public signal" from being access your LAN once they have a connection, via the Fon WAP, to your router?

The same way way a BT Hub does.

The Fon connection does not touch your network. It's an entry point to the Fon network not yours. It's a completely separate network.

Thanks. Hmm, again, I think
In a simplistic way, it clearly does "touch" my network, in that the Fon device is plugged in to my my router. What is it that stops people connected to it from seeing the rest of my LAN?
Do I just have to accept that there is a VPN, and that magically that VPN (a) gets around the MAC address filtering on my router and (b) stops anyone connected to the Fon device from doing anything on my LAN. How would I verify that there is indeed a VPN that has those effects?
It may well be that this just works, securely for the hosting punter, and that it's too technically complicated for the average person to understand, in which case I just have to make a decision about whether I'm happy enough with that to connect this device.
I could, I suppose, connect the device but unscrew it's aerial, but that seems rather against the spirit of the idea.

its like the guest network you see on some routers.

its in a different ip subnet and is "isolated" from your own lan. Obviously in theory its possible for someone to break out of that isolation, but there is no known instances of that happening.

In reply to a post by d_nick:

What is it that stops people connected to it from seeing the rest of my LAN?

The IP addressing for starters, if the FON clients are on a different subnet to your LAN / WLAN clients then there's no ability to exchange data.

Thanks, both. Any suggestions as to what I can do to check that the public SSID is on a different sub-net?

The public FON Wi-Fi is isolated from the LAN and other WLAN users.

IP ranges (and sub-net) will be different for the secured Wi-Fi and Public (FON) Wi-Fi signals.

Thanks. Any suggestions as to what I can do to check that the public SSID is on a different sub-net?

Connect to the secured one and see what the IP/subnet is then connect to the public one and see what the IP/subnet is.

A VPN connection is a secure tunnel, traffic traveling across it cannot 'see' anything else on the network it is passing across, all it can 'see' is the other endpoint of the VPN connection which is going to be a server at Fon.

In the same way you can't see anything if you go through a tunnel apart from the inside of the tunnel.