Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Can't trust any VPN these days

blog.orhun.dev

Post reply on HN
Print view View original

51–60 of 85 posts

Re: Can't trust any VPN these days

#51

Post by the_third_wave »

BSDobelix wrote: post #21
arcade79 wrote: post #10

The tragedy here is that expectations differ. I would expect my laptop to use my local DNS server if the VPN is up. My local DNS server is the one I have on my home network. The rest of my traffic, I would expect to go through the VPN tunnel. Problem of course is that VPNs used to be expert-level stuff. This kind of "avoid government blocks" use of VPN wasn't even common when I started fiddling with OpenVPN around 20…

>I would expect my laptop to use my local DNS server if the VPN is up No, a correct configured VPN-tunnel is tunneling all data from one point to another (zero exceptions) if vpn is de-connected no data should be transferred (aka interface down). If you want something else work with per-application proxy's. >Problem of course is that VPNs used to be expert-level stuff. And it still should be that way, VPN's where mad…

His exceptions aren't "wrong", they just differ from the proposed use case. I use a VPN connection just like that, to temporarily gain access to my private network when abroad. When connected all "regular" (port 53) DNS traffic goes through the VPN so as to have easy access to internal addresses (many of which have external addresses as well), when disconnected the private network is not available. While I use the same setup to avoid being "monetised" by "free" WiFi connections that is not its main purpose. If my intention was to be completely safe from the TLA I'd use a different setup which only presents the VPN interface for outside connections, i.e no VPN means no network connections.

Re: Can't trust any VPN these days

#52

Post by Hikikomori »

axegon_ wrote: post #5

I have honestly never trusted VPN providers in any shape or form. I had a university professor back in the early 2010's who said something very accurate: "Proprietary services providing anonymity provide everything but anonymity". I'm far more comfortable running a vps somewhere when I need to. And even then, VPN is kind of an exception since I hate fiddling with the setup(as easy as it may be). For most of my usage,…

Try reading the article.

Re: Can't trust any VPN these days

#53

Post by WmWsjA6B29B4nfk »

mmsc wrote: post #33
WmWsjA6B29B4nfk wrote: post #28

Earlier quoted context omitted.

I understood they have been simply accessing their ISPs DNS through the tunnel.

No: >Okay, at that point I was clueless. I tried changing the DNS settings of OpenVPN (i.e. dhcp-option DNS 1.1.1.1) but it didn't work. After a couple of iterations with ChatGPT, it finally led me to the correct path.

This line was no-op until the author started using the `up` script as they describe later.

> The OpenVPN server can push DHCP options such as DNS and WINS server addresses to clients (some caveats to be aware of). Windows clients can accept pushed DHCP options natively, while non-Windows clients can accept them by using a client-side up script which parses the foreign_option_n environmental variable list.

It's still not clear to me what the experience would have been if the author had only 1.1.1.1 set at the system level, not touching any OpenVPN options.

Re: Can't trust any VPN these days

#54

Post by ninkendo »

BSDobelix wrote: post #48
ninkendo wrote: post #40

Earlier quoted context omitted.

I share GP’s expectations too. For me, VPN’s are that thing you do to access things that are normally not available to the public internet, ie. your work email and stuff. I use wireguard to access my home network while I’m not at home for instance. I have homelab stuff at *.lan.mydomain.example, and in my ideal world, my iPhone would only connect on-demand when I try to connect to something in that domain. (Currently…

>I share GP’s expectations too. Sorry but no you don't, since you call into your LAN-network of course you can see your local machines. But if you sit in a LAN and you call outside there should be no traffic leaked to the local network your calling out from (for example airport/motel etc). >Point is, I don’t think of VPNs as something that prevents anyone from seeing my traffic Correct, every middleman (normally ISP)…

> Sorry but no you don't

Yes, I really do.

I specifically want my traffic to “leak” from my VPN when traveling away from home, because my home internet upload speed is slow and I don’t want it to bottleneck everything else on my device. I only want the tunnel to be used when I am talking to my LAN.

Similarly when I’m at home and using my work VPN, I want a split tunnel there too. I don’t want every bit of traffic going over the VPN tunnel, because my work network tends to have congestion, and if I’m streaming music or something to listen to, there’s no reason that should have to go throufh my work’s network.

Before saying “nuh uh!” every time someone disagrees with you, maybe stop and consider that people have different use cases from you?

Re: Can't trust any VPN these days

#55

Post by mr_mitm »

wruza wrote: post #47
Jnr wrote: post #22

Maybe a bit off-topic, but genuine curiosity - why would anyone go for OpenVPN these days, when there is Wireguard available? It makes sense if UDP is blocked, but in this case OP is clearly using UDP for OpenVPN.

Is there a oneliner for setting it up on a ubuntu box akin to https://github.com/angristan/openvpn-install ? How does it work with iphone, android, windows? Can a regular person set up a client by receiving a single profile file? Idk about wg, but ovpn ticks all these boxes.

There is this by the same author: https://github.com/angristan/wireguard-install

Mobile users simply scan a QR code and are good to go.

Re: Can't trust any VPN these days

#56

Post by BSDobelix »

ninkendo wrote: post #54
BSDobelix wrote: post #48

Earlier quoted context omitted.

>I share GP’s expectations too. Sorry but no you don't, since you call into your LAN-network of course you can see your local machines. But if you sit in a LAN and you call outside there should be no traffic leaked to the local network your calling out from (for example airport/motel etc). >Point is, I don’t think of VPNs as something that prevents anyone from seeing my traffic Correct, every middleman (normally ISP)…

> Sorry but no you don't Yes, I really do. I specifically want my traffic to “leak” from my VPN when traveling away from home, because my home internet upload speed is slow and I don’t want it to bottleneck everything else on my device. I only want the tunnel to be used when I am talking to my LAN . Similarly when I’m at home and using my work VPN, I want a split tunnel there too. I don’t want every bit of traffic go…

>Yes, I really do.

No you don't, you need a normal (for example) ssh-tunnel, not a "VPN"...trust me ;)

>Before saying “nuh uh!” every time someone disagrees with you, maybe stop and consider that people have different use cases from you?

You want to actively weakening a system that was made for one thing only (a point to point encrypted tunnel with no exceptions of data flow), but hey go on and make your setup a cobbled mess, but don't cry about leaked information.

Re: Can't trust any VPN these days

#57

Post by wruza »

mr_mitm wrote: post #55
wruza wrote: post #47

Earlier quoted context omitted.

Is there a oneliner for setting it up on a ubuntu box akin to https://github.com/angristan/openvpn-install ? How does it work with iphone, android, windows? Can a regular person set up a client by receiving a single profile file? Idk about wg, but ovpn ticks all these boxes.

There is this by the same author: https://github.com/angristan/wireguard-install Mobile users simply scan a QR code and are good to go.

Thank you very much, I’ll try it soon!

My relative has an android device that can’t run ovpn but may work with this.

Re: Can't trust any VPN these days

#58

Post by dongcarl »

mr_mitm wrote: post #39
Jnr wrote: post #22

Maybe a bit off-topic, but genuine curiosity - why would anyone go for OpenVPN these days, when there is Wireguard available? It makes sense if UDP is blocked, but in this case OP is clearly using UDP for OpenVPN.

Unrelated to OP's story, but besides tunneling traffic over TCP or even an HTTP proxy (which OpenVPN supports OOTB): plain Wireguard doesn't support 2FA, which is a requirement in some places. Unless there is an open source 2FA VPN solution built on Wireguard that I haven't heard about yet, in which case I'm interested.

I believe Tailscale has 2FA? Headscale is an open source implementation: https://github.com/juanfont/headscale

Re: Can't trust any VPN these days

#59

Post by vetinari »

wruza wrote: post #36

Has nothing to do with VPN or OpenVPN (almost). “You can’t trust” “Linux” in this case. Its network stack is still not mouse-friendly in general and requires some thought. Quoting key points from TFA: - (DNS leak happens) - The DNS changes are not automatically applied by the OpenVPN client on Linux. - You need to configure up and down scripts for managing the DNS updates. - The recommended script is update-resolv-co…

This is something I always wondered about: why so many linux users always take the hard way?

They have two options: a) use the mouse-friendly way in NetworkManager to configure their VPN client (yes, it handles VPN DNS too; if you have systemd-resolved, it can also do split-horizon DNS over specific links) or b) funble around with tools and scripts they have no idea how they work, complain how complicated it is, and either get lucky so it works somehow or break their system entirely.

With a current desktop linux system, they should take the option a). They can use command line if they insist, nmcli is also here.

Re: Can't trust any VPN these days

#60

Post by ninkendo »

BSDobelix wrote: post #56
ninkendo wrote: post #54

Earlier quoted context omitted.

> Sorry but no you don't Yes, I really do. I specifically want my traffic to “leak” from my VPN when traveling away from home, because my home internet upload speed is slow and I don’t want it to bottleneck everything else on my device. I only want the tunnel to be used when I am talking to my LAN . Similarly when I’m at home and using my work VPN, I want a split tunnel there too. I don’t want every bit of traffic go…

>Yes, I really do. No you don't, you need a normal (for example) ssh-tunnel, not a "VPN"...trust me ;) >Before saying “nuh uh!” every time someone disagrees with you, maybe stop and consider that people have different use cases from you? You want to actively weakening a system that was made for one thing only (a point to point encrypted tunnel with no exceptions of data flow), but hey go on and make your setup a cobb…

> No you don't, you need a normal (for example) ssh-tunnel, not a "VPN"...trust me ;)

Yes I do. (See how tiring this is getting?)

I don’t want an SSH tunnel when wireguard does the same thing but faster and with an iOS app that works correctly out of the box. I’m aware of SSH tunnels and that’s how I used to do things back in 2008 but times have changed and wireguard is infinitely better at that use case.

> You want to actively weakening a system that was made for one thing only (a point to point encrypted tunnel with no exceptions of data flow), but hey go on and make your setup a cobbled mess, but don't cry about leaked information.

Nobody’s talking about weakening anything here, you’re coming into a conversation where someone said “use cases differ”, and you’re trying to deny that reality… every time someone shows you a different use case you childishly shout “nuh uh” and act like such a use case is wrong because it invalidates your point.

A split tunnel VPN is a valid use case, period. It’s not the only use case. People who want full tunnel where all traffic goes through the tunnel, ALSO have a valid use case. But it doesn’t mean split tunnel is not a thing, and it doesn’t mean people who want split tunnels are wrong.

Post reply on HN