Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Can't trust any VPN these days

blog.orhun.dev

Post reply on HN
Print view View original

21–30 of 85 posts

Re: Can't trust any VPN these days

#21

Post by BSDobelix »

arcade79 wrote: post #10

The tragedy here is that expectations differ. I would expect my laptop to use my local DNS server if the VPN is up. My local DNS server is the one I have on my home network. The rest of my traffic, I would expect to go through the VPN tunnel. Problem of course is that VPNs used to be expert-level stuff. This kind of "avoid government blocks" use of VPN wasn't even common when I started fiddling with OpenVPN around 20…

>I would expect my laptop to use my local DNS server if the VPN is up

No, a correct configured VPN-tunnel is tunneling all data from one point to another (zero exceptions) if vpn is de-connected no data should be transferred (aka interface down).

If you want something else work with per-application proxy's.

>Problem of course is that VPNs used to be expert-level stuff.

And it still should be that way, VPN's where made so you can securely work inside your enterprise/home network while sitting anywhere in the world, all services are provided from local servers and if external, go through the enterprise-firewall (traffic-audit, IDS, and maybe other VPN-tunnels to other external locations subnet's etc).

Re: Can't trust any VPN these days

#22

Post by Jnr »

Maybe a bit off-topic, but genuine curiosity - why would anyone go for OpenVPN these days, when there is Wireguard available?

It makes sense if UDP is blocked, but in this case OP is clearly using UDP for OpenVPN.

Re: Can't trust any VPN these days

#23

Post by isoprophlex »

endymi0n wrote: post #6
jrvieira wrote: post #2

These days?

Had the same thought from the headline, but the punchline is that he's using the VPN he completely built himself and can't even trust that one.

... which is entirely a PEBCAC-type error in this case, as he never tested if his configuration worked as expected.

Re: Can't trust any VPN these days

#24

Post by nofunsir »

bog-standard ssh server + bitvise local client = VPN

1) enable port forwarding in your sshd config (implies you can't just do this on a server which you don't admin and which has this disabled)

2) point bitvise's socks5 proxy server feature at the ssh server

3) point anything that needs to be tunneled at the bitvise client's port (default 1080) e.g. firefox > about:preferences > Network Settings (at bottom) > Manual proxy configuration > SOCKS v5 (enter details and your password if you set it up in bitvise) > also check "Proxy DNS when using SOCKS v5" at bottom

4) voila, packets leave and return via the ssh server's public IP.

5) For stubborn apps, check their config files, or use tsocks

Re: Can't trust any VPN these days

#25

Post by letters90 »

nofunsir wrote: post #9
jbverschoor wrote: post #3

Run your own exit node for tailscale or zerotier somewhere

or bog-standard ssh server + bitvise local client. EDIT to clarify because i feel many might not be aware how easy it is: 1) enable port forwarding in your sshd config (implies you can't just do this on a server which you don't admin and which has this disabled) 2) point bitvise's socks5 proxy server feature at the ssh server 3) point anything that needs to be tunneled at the bitvise client's port (default 1080) e.g.…

or just a portable mingw coming with an openssh and a dynamic proxy

there you go with an easy socks5 proxy.

Re: Can't trust any VPN these days

#26

Post by yaris »

While there is some useful info in the post, the title is hugely misleading. The author tried one (single) VPN solution which they set up themselves, without full understanding of the things or even reading documentation upfront (although "it's right there under the DNS section"). It feels more like "I was unable to correctly setup VPN even using the very detailed instructions, but I can't blame myself, can I?"

Re: Can't trust any VPN these days

#27

Post by nofunsir »

nofunsir wrote: post #24

bog-standard ssh server + bitvise local client = VPN 1) enable port forwarding in your sshd config (implies you can't just do this on a server which you don't admin and which has this disabled) 2) point bitvise's socks5 proxy server feature at the ssh server 3) point anything that needs to be tunneled at the bitvise client's port (default 1080) e.g. firefox > about:preferences > Network Settings (at bottom) > Manual…

For extra fun:

6) make a chain of ssh port forwarding.

7) make a script that randomizes the ssh port forwarding chain.

Re: Can't trust any VPN these days

#28

Post by WmWsjA6B29B4nfk »

mmsc wrote: post #18
WmWsjA6B29B4nfk wrote: post #16

What if the the author simply used 1.1.1.1 / 8.8.8.8 / any other public DNS outside of their country for all traffic? It's an easier solution (yeah, with some drawbacks)

It would be intercepted at the ISP level and the false results would still be received. There are lots of DNS intercepting tools ISPs buy these days. DNS isn't authenticated.

I understood they have been simply accessing their ISPs DNS through the tunnel.

Re: Can't trust any VPN these days

#29

Post by axegon_ »

anakaine wrote: post #8
axegon_ wrote: post #5

I have honestly never trusted VPN providers in any shape or form. I had a university professor back in the early 2010's who said something very accurate: "Proprietary services providing anonymity provide everything but anonymity". I'm far more comfortable running a vps somewhere when I need to. And even then, VPN is kind of an exception since I hate fiddling with the setup(as easy as it may be). For most of my usage,…

The article doesnt quite match the headline in the way your reply suggests. Trust, in this instance, is more about accidental leakage and installers not tailoring the OS to have Up and Down watchers to apply DNS changes. It's not about whether the VPN provider can be trusted.

On the contrary: an accidental leakage is one of the many reasons a VPN provider cannot be trusted. Say I want to hide myself temporarily - which is safer - a VPN provider, having no idea how they handle data, logs and whatnot, or a tiny vps somewhere for half an hour while you need it, get your job done and then nuke it out of existence. The latter would be infinitely harder to compromise if you know what you are doing as opposed to a service that is running 24/7 and having no idea how data is retained.

Re: Can't trust any VPN these days

#30

Post by ndheebebe »

nofunsir wrote: post #9
jbverschoor wrote: post #3

Run your own exit node for tailscale or zerotier somewhere

or bog-standard ssh server + bitvise local client. EDIT to clarify because i feel many might not be aware how easy it is: 1) enable port forwarding in your sshd config (implies you can't just do this on a server which you don't admin and which has this disabled) 2) point bitvise's socks5 proxy server feature at the ssh server 3) point anything that needs to be tunneled at the bitvise client's port (default 1080) e.g.…

So I open say Firefox and it routes it all through that. No gotchas?
Post reply on HN