Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ISP Spying

harrisonsand.com

Post reply on HN
Print view View original

111–120 of 134 posts

Re: ISP Spying

#111

Post by user9182031 »

jimpudar wrote: post #101
markwaldron wrote: post #66

Earlier quoted context omitted.

This is very informative! What router would you suggest purchasing?

A very secure solution is building your own box to run OpenBSD. There are some good guides on how to set up OpenBSD as a typical NAT router / firewall here: https://www.openbsd.org/faq/pf/example1.html I like PF a lot more than IPTables. I've found it to be far simpler to configure.

Once you use PF, you can't really go back to iptables. The fact that you still can't create anchors or anything equivalent in iptables blows my mind. I can look at any of my older configurations from PF and understand what I was doing very quickly compared to iptables which is much harder to read and much less intuitive.

Re: ISP Spying

#112

Post by phs2501 »

user9182031 wrote: post #111
jimpudar wrote: post #101

Earlier quoted context omitted.

A very secure solution is building your own box to run OpenBSD. There are some good guides on how to set up OpenBSD as a typical NAT router / firewall here: https://www.openbsd.org/faq/pf/example1.html I like PF a lot more than IPTables. I've found it to be far simpler to configure.

Once you use PF, you can't really go back to iptables. The fact that you still can't create anchors or anything equivalent in iptables blows my mind. I can look at any of my older configurations from PF and understand what I was doing very quickly compared to iptables which is much harder to read and much less intuitive.

Can you briefly explain how a PF anchor is not equivalent to a iptables chain? From a very short perusal of the PF documentation it appears to be the same concept to me (i.e. a set of filtering rules you can branch to from another part of the ruleset...)

Re: ISP Spying

#113

Post by woolvalley »

jimpudar wrote: post #101
markwaldron wrote: post #66

Earlier quoted context omitted.

This is very informative! What router would you suggest purchasing?

A very secure solution is building your own box to run OpenBSD. There are some good guides on how to set up OpenBSD as a typical NAT router / firewall here: https://www.openbsd.org/faq/pf/example1.html I like PF a lot more than IPTables. I've found it to be far simpler to configure.

Usually the issue in setting up a PC to do this kind of stuff is power consumption. Typically it's a minimum of 60W to run an idle PC, while an ARM router would run at 1-5W and have multiple ethernet ports.

Re: ISP Spying

#114

Post by woolvalley »

TheRealDunkirk wrote: post #86
markwaldron wrote: post #66

Earlier quoted context omitted.

This is very informative! What router would you suggest purchasing?

I built my own, several years ago, on a (fanless!) board like this: http://www.pcengines.ch/apu3a4.htm It has 3 NIC's, for inside, outside, and DMZ. You can also put a wifi radio on it, and make it an access point. I run a full Ubuntu on it, with local DNS, DHCP, Shorewall, etc.

Whats the power consumption of this setup?

Re: ISP Spying

#115

Post by Mister_Snuggles »

markwaldron wrote: post #66
wepple wrote: post #63

I’ve pulled apart router firmware plenty of times, and am never surprised to see nbtscan, nmap, and all sorts of other tools on there. A lot of ISPs will perform remote diagnosis by connecting into your router and scanning your internal hosts to see if there are any problems. Between that capability and general appalling security of routers, you’re basically on Starbucks WiFi from a security perspective even at home.…

This is very informative! What router would you suggest purchasing?

I've gone with a Ubiquiti UniFi Security Gateway.

It's not too fancy (but getting fancier as updates are delivered) and does the job well. I wasn't satisfied with the VPN options, so I port-forward to an internal host and set up static routes as required.

Re: ISP Spying

#116

Post by dang »

jwilk wrote: post #110
dang wrote: post #105

Earlier quoted context omitted.

The HN guidelines ask: "Please use the original title, unless it is misleading or linkbait." This one was linkbait—it used the linkbait "you" twice. We took that out. https://news.ycombinator.com/newsguidelines.html

I could figure out that "you" doesn't refer to me personally, and so can the rest of HN. There's nothing "linkbait" about it. You can express your opinion about the original title in a comment. There's no need it impose this (twisted, IMO) view on everyone.

As the people who read the most headlines here, probably by an order of magnitude, I'm afraid we have to pull rank on that. Gratuitous "you" in titles is one of the biggest linkbait tropes. Presumably we're all wired to direct our attention to someone saying "hey you!"; headline writers figured this out and have been milking it ever since.

Re: ISP Spying

#117

Post by tinix »

nerraga wrote: post #95
TheRealDunkirk wrote: post #86

Earlier quoted context omitted.

I built my own, several years ago, on a (fanless!) board like this: http://www.pcengines.ch/apu3a4.htm It has 3 NIC's, for inside, outside, and DMZ. You can also put a wifi radio on it, and make it an access point. I run a full Ubuntu on it, with local DNS, DHCP, Shorewall, etc.

I picked up a couple of these and I have to say I'm pretty impressed. They're pretty inexpensive little machines and they ship quick from pcengines. I have openbsd on one and ubuntu on the other. I'm using the openbsd one for dns, tftp, and a handful of projects. I was thinking about making the ubuntu one into an ap but I'm not sure about what kind of performance to expect vs my current off the shelf router. Have you…

I have an older APU1C4 with two WLAN cards (WLE200NX) and it's hosting two physical APs and a few virtual ones (diff BSSID/subnet one running at 2.4 ghz other at 5). I just run vanilla Debian on it... The SD card has finally become corrupted over the years, however. When I reboot it, all my changes that were supposedly flushed to disk are lost. Thankfully I only reboot it occasionally when there are critical kernel updates. I just rsync over the filesystem in memory to facilitate restoring the previous configurations.

Anyway, I run various services on it, aside from hostapd... It acts as my firewall, gateway, access point, and runs some other services like nginx to proxy some services from my LAN across subnets (like plex, etc) and motiond as a security camera monitor. I've used it as an SSH style VPN at times, in a pinch. When our WAN goes down I can simply plug my phone in to the APU via USB and tweak some iptables rules to use the LTE connection from the phone over USB network interface.

I also have a newer APU2C4, along w/ an AC WLAN card and an msata drive... have had it for years just sitting there, grr. I really only got the newer one since it has AES-NI support on the processor and I can do much heavier VPN traffic, but the SD card issues have become annoying, so I think this post has encouraged me to finally set it up this weekend... Thanks :P

Anyway, I wouldn't hesitate to pull the trigger on any of the pcengines stuff... Go for it!

Just make sure the WLAN cards you use are well supported via hostapd. :)

Re: ISP Spying

#118

Post by tinix »

woolvalley wrote: post #114
TheRealDunkirk wrote: post #86

Earlier quoted context omitted.

I built my own, several years ago, on a (fanless!) board like this: http://www.pcengines.ch/apu3a4.htm It has 3 NIC's, for inside, outside, and DMZ. You can also put a wifi radio on it, and make it an access point. I run a full Ubuntu on it, with local DNS, DHCP, Shorewall, etc.

Whats the power consumption of this setup?

Negligible... I run an APU1 w/ dual WLAN cards, and am using all of the internal NICs, and running a pile of services on it. It uses less power than a light bulb, even under full load.

Re: ISP Spying

#119

Post by mirimir »

moviuro wrote: post #6
mirimir wrote: post #4

I always assume that they might be. So I always use my own perimeter router/firewall running pfSense. Plus I use VPN services. And so my ISps don't end up seeing anything except encrypted streams. And have no visibility into my vLANs.

You're just paying some extra third-party that handles all your traffic now. What's to prevent them from doing the same? You're moving trust to another actor.

Sure I am, but they're a VPN service with a long history of protecting users from snooping. And they don't do business from the jurisdiction that I'm subject to. So targeted surveillance would be harder. Not impossible, of course, by major national intelligence organizations. But hey.

Also, I dont rely on just the one VPN service. I use nested chains of VPNs, and so distribute trust among multiple providers. Doing business from different jurisdictions. Just as Tor does with three-relay circuits. Sometimes I use private VPNs running on anonymously leased VPS.

Finally, each of my personas uses a different nested VPN chain, or Tor (Whonix) through other nested VPN chains. So linking my various personas would be nontrivial.

Re: ISP Spying

#120

Post by mirimir »

moviuro wrote: post #55
shubb wrote: post #13

Earlier quoted context omitted.

Personally I very much agree that using a vpn service for all your traffic is probably not a good idea. As well as other objections, some have been confirmed to sell fine grain traffic information, and may have an easier time justifying that as it is arguably anonymised. That said, if you set up your own vpn on a digital ocean node, moving your network boundary to the datacentre, then the cloud hosting companies netw…

> in my router That's probably the issue. A general purpose machine (with AES-NI), slap OpenBSD on it, disable DHCP server on your ISP router, let OpenBSD handle that... and done! (not for the faint of heart though) You might even add a NIC to it, and act as another physical hop for firewalling, etc.

I've had good luck with pfSense as a VPN client. Either as VMs, or on dedicated hardware with a decent CPU. If you're wanting more than 100 mbps, however, you probably also want a cryptoprocessor chip.
Post reply on HN