Why You Should Start Using a VPN

It's sad to see the reasoning for using VPN's being so deeply mixed with bittorrent and similar things "worth hiding" according to some. There are actually many good reasons to use various forms of secure tunneling.

Many ISP's serve requested pages from massive caches. Although provider caching can improve performance in some cases as well as reduce bandwidth costs for the ISP, it can often result in stale information being passed to the client (you!).

Another common speed/cost improvement for ISP's is serving degraded images from their cache -- by recompressing images (jpg) at a higher compression ratio, the file size is reduced at the expense of degrading the image quality. This is extremely common on mobile networks, but it is becoming more common with land-based providers. In most cases, you'll never notice, since you'll just assume it's a crappy image from the original server. On the other hand, if you do any work with images, then you could be stuffed by the modified images being delivered to you.

Having a consistent endpoint provided by a VPN provider can also be a real advantage. For example, if you're doing checking, testing or trouble shooting, against a system on the `net, then knowing what traffic is yours in the logs can be real helpful. With dynamic IP addressing, your endpoint (public IP) always changes. When you're using a VPN and helping out a friend with something as trivial as reporting bugs, you can tell them that the funky traffic from xxx.example.com is just you running some tests. Even if the site owner isn't your best friend or anyone you really know, it's great when reporting bugs to say, "Hey pg, my traffic is always coming from la.tunnelr.com" so it's easier for them to find it in their logs.

If you need to do your own pen testing across the `net and your ISP does deep packet inspection (DPI) and egress filtering, then once again, you're stuffed without a VPN or unfiltered remote host. Of course, you need to be on good terms with your VPN provider and let them know in advance that you'll be sending some dodgy traffic over their network, but that's not a big deal most of the time.

If you participated in the recent Stripe.com Capture The Flag contest without using a VPN or staged connection (ssh), then you really didn't put very much thought into what could happen if some malicious person rooted the game server and attacked the game participants. Sure, the Stripe folks are fantastic, and they keep an eye on things, but no person has sub-microsecond response times. ;)

Also, some ISP's have bandwidth caps and automated thresholds for reducing connection performance, but they usually have a stipulation in their contract excluding VPN bandwidth from the cap/limit accounting. The reason is simple; business customers would use another ISP if the caps/limits interfered with doing work, and most (sane) businesses provide a company VPN to their employees for remote work.

I use http://www.tunnelr.com almost all of the time simply because it makes my mobile (EVDO VerizonWireless) connection a lot more consistent and reliable on UNIX (OpenBSD). A lot of mobile ISP's don't support UNIX at all, and they expect you to run inane and unaudited software ("VZAccess" which is actually just rebranded stuff from SmithMicro). Having a SSH connection present prevents some of the (intentional) oddities of mobile connections (e.g. "pausing" the link/connection).

There are plenty of good reasons to use a VPN that don't involve bittorrent or similar. The best reason of all is if your ISP does not provide all of the exact details of their filtering and caching methods --of course, none do.

"Theory of Operation

It's like a VPN, since it can forward every port on an entire network, not just ports you specify. Conveniently, it lets you use the "real" IP addresses of each host rather than faking port numbers on localhost.

On the other hand, the way it works is more like ssh port forwarding than a VPN. Normally, a VPN forwards your data one packet at a time, and doesn't care about individual connections; ie. it's "stateless" with respect to the traffic. sshuttle is the opposite of stateless; it tracks every single connection.

You could compare sshuttle to something like the old Slirp program, which was a userspace TCP/IP implementation that did something similar. But it operated on a packet-by-packet basis on the client side, reassembling the packets on the server side. That worked okay back in the "real live serial port" days, because serial ports had predictable latency and buffering.

But you can't safely just forward TCP packets over a TCP session (like ssh), because TCP's performance depends fundamentally on packet loss; it must experience packet loss in order to know when to slow down! At the same time, the outer TCP session (ssh, in this case) is a reliable transport, which means that what you forward through the tunnel never experiences packet loss. The ssh session itself experiences packet loss, of course, but TCP fixes it up and ssh (and thus you) never know the difference. But neither does your inner TCP session, and extremely screwy performance ensues.

sshuttle assembles the TCP stream locally, multiplexes it statefully over an ssh session, and disassembles it back into packets at the other end. So it never ends up doing TCP-over-TCP. It's just data-over-TCP, which is safe."

Yes, it supports dns now using the --dns option. UDP is not supported though.

I trust a VPN provider more than a ISP. The reason is pretty simple, I trust a random company more than a 30-200 year old telecommunication company which has strong ties to government and content delivery networks.

How many VPN's companies has deals with content networks? How many ISP has a content network deal?

How many VPN's has has a past of cooperative with government surveillance? How many ISP has cooperated with police and government secret police?

How many VPN's has lobbyist in government. How many ISP's has lobbyists in government?

An ISP has all the reasons to snoop at the traffic of their users, and they commonly do. Their core product is advertised as an service that provides Internet connectivity. Their core product is thus not effected by much if they get caught snooping on their users. A VPN has few reasons to snoop (QoS is the major exception), and their core product is to provide privacy. If they are caught snooping, their core service of providing privacy suffers.

Thus, yes. I trust more a VPN provider than an ISP.

And a seedbox would work just as well for this purpose, and will result in much higher upload/download speeds and, in the case of private trackers, save you the costs of owning/running a PC on 24/7 to seed back your downloads.