41–50 of 85 posts
These days?
Had the same thought from the headline, but the punchline is that he's using the VPN he completely built himself and can't even trust that one.
Earlier quoted context omitted.
Had the same thought from the headline, but the punchline is that he's using the VPN he completely built himself and can't even trust that one.
... which is entirely a PEBCAC-type error in this case, as he never tested if his configuration worked as expected.
The tragedy here is that expectations differ. I would expect my laptop to use my local DNS server if the VPN is up. My local DNS server is the one I have on my home network. The rest of my traffic, I would expect to go through the VPN tunnel. Problem of course is that VPNs used to be expert-level stuff. This kind of "avoid government blocks" use of VPN wasn't even common when I started fiddling with OpenVPN around 20…
even if you want local control of the dns server, i would still set up the dns server to retreive its data via the ssh tunnel (via standard port forwarding) as well.
I have honestly never trusted VPN providers in any shape or form. I had a university professor back in the early 2010's who said something very accurate: "Proprietary services providing anonymity provide everything but anonymity". I'm far more comfortable running a vps somewhere when I need to. And even then, VPN is kind of an exception since I hate fiddling with the setup(as easy as it may be). For most of my usage,…
bog-standard ssh server + bitvise local client = VPN 1) enable port forwarding in your sshd config (implies you can't just do this on a server which you don't admin and which has this disabled) 2) point bitvise's socks5 proxy server feature at the ssh server 3) point anything that needs to be tunneled at the bitvise client's port (default 1080) e.g. firefox > about:preferences > Network Settings (at bottom) > Manual…
For extra fun: 6) make a chain of ssh port forwarding. 7) make a script that randomizes the ssh port forwarding chain.
Earlier quoted context omitted.
>I would expect my laptop to use my local DNS server if the VPN is up No, a correct configured VPN-tunnel is tunneling all data from one point to another (zero exceptions) if vpn is de-connected no data should be transferred (aka interface down). If you want something else work with per-application proxy's. >Problem of course is that VPNs used to be expert-level stuff. And it still should be that way, VPN's where mad…
>Your exceptions are wrong, a correct configured VPN-tunnel is tunneling all data from one point to another (zero exceptions) if vpn is de-connected no data should be transferred (aka interface down). >VPN's where made so you can securely work inside your enterprise network Discord.com is not your enterprise network.
Ok?
Maybe a bit off-topic, but genuine curiosity - why would anyone go for OpenVPN these days, when there is Wireguard available? It makes sense if UDP is blocked, but in this case OP is clearly using UDP for OpenVPN.
Idk about wg, but ovpn ticks all these boxes.
Earlier quoted context omitted.
>I would expect my laptop to use my local DNS server if the VPN is up No, a correct configured VPN-tunnel is tunneling all data from one point to another (zero exceptions) if vpn is de-connected no data should be transferred (aka interface down). If you want something else work with per-application proxy's. >Problem of course is that VPNs used to be expert-level stuff. And it still should be that way, VPN's where mad…
I share GP’s expectations too. For me, VPN’s are that thing you do to access things that are normally not available to the public internet, ie. your work email and stuff. I use wireguard to access my home network while I’m not at home for instance. I have homelab stuff at *.lan.mydomain.example, and in my ideal world, my iPhone would only connect on-demand when I try to connect to something in that domain. (Currently…
Sorry but no you don't, since you call into your LAN-network of course you can see your local machines.
But if you sit in a LAN and you call outside there should be no traffic leaked to the local network your calling out from (for example airport/motel etc).
>Point is, I don’t think of VPNs as something that prevents anyone from seeing my traffic
Correct, every middleman (normally ISP) can see that you connect from your External-IP to the other External-IP over an encrypted tunnel (udp or tcp). The expression 'vpn' i nearly as muddled as cloud ;)
If you want to obfuscate your traffic you need something like tor/i2p, however it's also possible to tunnel your vpn-tunnel through tor-tunnel's (but i don't see much sense in that since exit-nodes are for sure under more observation and publicly known)
Tor and vpn traffic can be detected and blocked (for example Chinese firewall) and for that, shadowsocks can be a solution:
Earlier quoted context omitted.
So I open say Firefox and it routes it all through that. No gotchas?
firefox > about:preferences > Network Settings (at bottom) > Manual proxy configuration > SOCKS v5 (enter details and your password if you set it up in bitvise) > also check "Proxy DNS when using SOCKS v5" at bottom
Even if the specific case of Firefox can be configured correctly and you have the source to verify that's it only sending traffic over the socks proxy, manually configuring every app to use a socks proxy is brittle and error pone, and for some apps just won't work.
Much more straightforward to just have a system wide VPN as the only available route for outbound traffic so that all apps use it transparently.
Maybe a bit off-topic, but genuine curiosity - why would anyone go for OpenVPN these days, when there is Wireguard available? It makes sense if UDP is blocked, but in this case OP is clearly using UDP for OpenVPN.
I don't have access to that VPS anymore, but I was already using Wireguard but had to use OpenVPN here, so I can't tell you if this is still a widespread problem or a historical curiosity.
Also sometimes, especially cross-organization, the chance that OpenVPN is already in use is much higher (if they're not doing Open/StrongSWAN anyway).