Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Can't trust any VPN these days

blog.orhun.dev

Post reply on HN
Print view View original

61–70 of 85 posts

Re: Can't trust any VPN these days

#61

Post by [deleted] »

the_third_wave wrote: post #51
BSDobelix wrote: post #21

Earlier quoted context omitted.

>I would expect my laptop to use my local DNS server if the VPN is up No, a correct configured VPN-tunnel is tunneling all data from one point to another (zero exceptions) if vpn is de-connected no data should be transferred (aka interface down). If you want something else work with per-application proxy's. >Problem of course is that VPNs used to be expert-level stuff. And it still should be that way, VPN's where mad…

His exceptions aren't "wrong", they just differ from the proposed use case. I use a VPN connection just like that, to temporarily gain access to my private network when abroad. When connected all "regular" (port 53) DNS traffic goes through the VPN so as to have easy access to internal addresses (many of which have external addresses as well), when disconnected the private network is not available. While I use the sa…

[deleted]

Re: Can't trust any VPN these days

#62

Post by nofunsir »

justonenote wrote: post #49
nofunsir wrote: post #32

Earlier quoted context omitted.

firefox > about:preferences > Network Settings (at bottom) > Manual proxy configuration > SOCKS v5 (enter details and your password if you set it up in bitvise) > also check "Proxy DNS when using SOCKS v5" at bottom

Does Firefox route WebRTC through a socks proxy? Does it leak your locally configured IP when WebRTC is initiated? Even if the specific case of Firefox can be configured correctly and you have the source to verify that's it only sending traffic over the socks proxy, manually configuring every app to use a socks proxy is brittle and error pone, and for some apps just won't work. Much more straightforward to just have…

media.peerconnection.enabled = false

also, this sounds like fud.

Re: Can't trust any VPN these days

#63

Post by wruza »

vetinari wrote: post #59
wruza wrote: post #36

Has nothing to do with VPN or OpenVPN (almost). “You can’t trust” “Linux” in this case. Its network stack is still not mouse-friendly in general and requires some thought. Quoting key points from TFA: - (DNS leak happens) - The DNS changes are not automatically applied by the OpenVPN client on Linux. - You need to configure up and down scripts for managing the DNS updates. - The recommended script is update-resolv-co…

This is something I always wondered about: why so many linux users always take the hard way? They have two options: a) use the mouse-friendly way in NetworkManager to configure their VPN client (yes, it handles VPN DNS too; if you have systemd-resolved, it can also do split-horizon DNS over specific links) or b) funble around with tools and scripts they have no idea how they work, complain how complicated it is, and…

I think I did exactly that on my servers and had no dns issues. Just dropped an .ovpn into it.

Re: Can't trust any VPN these days

#64

Post by BSDobelix »

ninkendo wrote: post #60
BSDobelix wrote: post #56

Earlier quoted context omitted.

>Yes, I really do. No you don't, you need a normal (for example) ssh-tunnel, not a "VPN"...trust me ;) >Before saying “nuh uh!” every time someone disagrees with you, maybe stop and consider that people have different use cases from you? You want to actively weakening a system that was made for one thing only (a point to point encrypted tunnel with no exceptions of data flow), but hey go on and make your setup a cobb…

> No you don't, you need a normal (for example) ssh-tunnel, not a "VPN"...trust me ;) Yes I do. (See how tiring this is getting?) I don’t want an SSH tunnel when wireguard does the same thing but faster and with an iOS app that works correctly out of the box. I’m aware of SSH tunnels and that’s how I used to do things back in 2008 but times have changed and wireguard is infinitely better at that use case. > You want…

No problem have fun.

Re: Can't trust any VPN these days

#65

Post by jmclnx »

Jnr wrote: post #22

Maybe a bit off-topic, but genuine curiosity - why would anyone go for OpenVPN these days, when there is Wireguard available? It makes sense if UDP is blocked, but in this case OP is clearly using UDP for OpenVPN.

OpenVPN is can hid your IP if set up correctly. Wireguard can in a way. But on the server your IP can be identified in some manner, maybe even after you sigh-out.

Wireguard is good for places like Europe and North America. But if in Mainland China, Russia, Iran and countries like that, you need use OpenVPN.

Re: Can't trust any VPN these days

#67

Post by mmsc »

BSDobelix wrote: post #46
mmsc wrote: post #37

Earlier quoted context omitted.

>Your exceptions are wrong, a correct configured VPN-tunnel is tunneling all data from one point to another (zero exceptions) if vpn is de-connected no data should be transferred (aka interface down). >VPN's where made so you can securely work inside your enterprise network Discord.com is not your enterprise network.

YourLocation VPN-> EnterpriseFirewall/VPN-Gateway Lan-> LocalNetwork(DNS,NTP,SMB/NFS etc) Lan-> EnterpriseFirewall HTTPS-> Discord.com Ok?

>EnterpriseFirewall/VPN-Gateway Lan-> LocalNetwork(DNS,NTP,SMB/NFS etc) Lan-> EnterpriseFirewall HTTPS

This does not seem to agree what you previously said: "VPN's where made so you can securely work inside your enterprise network"

If you're connecting to the internet, route to the internet. If you're connecting to "inside your enterprise network", route through the VPN.

>EnterpriseFirewall HTTPS

If you're talking about forced https interception, then it sounds like an excellent way to make something secure (https) insecure.

Re: Can't trust any VPN these days

#68

Post by martheen »

wink wrote: post #50
Jnr wrote: post #22

Maybe a bit off-topic, but genuine curiosity - why would anyone go for OpenVPN these days, when there is Wireguard available? It makes sense if UDP is blocked, but in this case OP is clearly using UDP for OpenVPN.

It's been a while but e.g. with OpenVZ containers you couldn't do anything in the kernel, i.e. Wireguard. I don't have access to that VPS anymore, but I was already using Wireguard but had to use OpenVPN here, so I can't tell you if this is still a widespread problem or a historical curiosity. Also sometimes, especially cross-organization, the chance that OpenVPN is already in use is much higher (if they're not doing…

It depends on the OpenVZ kernel, some later version can use WG. But OpenVZ is dying anyway so if someone use a still supported container technology, WG is probably available.

Depending on the ISP setup, sometimes WG can be less reliable due to MTU and/or UDP filtering, I remember an ISP from years ago where WG don't work only on certain hours, while OpenVPN running on the same server still work.

Re: Can't trust any VPN these days

#69

Post by martheen »

sbt567 wrote: post #34

Nice writeup. I'm wondering though. If the block is on DNS level, isn't it easier and cheaper to use dns-over-https or dot instead?

If it's just DNS, yes. But more and more countries start using SNI filtering for blocking, which can be bypassed by locally running obfuscation tool, but at some point one can get annoyed enough and just use a VPN entirely.

Re: Can't trust any VPN these days

#70

Post by BSDobelix »

mmsc wrote: post #67
BSDobelix wrote: post #46

Earlier quoted context omitted.

YourLocation VPN-> EnterpriseFirewall/VPN-Gateway Lan-> LocalNetwork(DNS,NTP,SMB/NFS etc) Lan-> EnterpriseFirewall HTTPS-> Discord.com Ok?

>EnterpriseFirewall/VPN-Gateway Lan-> LocalNetwork(DNS,NTP,SMB/NFS etc) Lan-> EnterpriseFirewall HTTPS This does not seem to agree what you previously said: "VPN's where made so you can securely work inside your enterprise network" If you're connecting to the internet, route to the internet. If you're connecting to "inside your enterprise network", route through the VPN. >EnterpriseFirewall HTTPS If you're talking ab…

>If you're connecting to the internet, route to the internet. If you're connecting to "inside your enterprise network", route through the VPN.

Block-lists, traffic-audit/amount, not allowed ports, protocol/packet inspection, mail-scanning and archival (aka have a hint how in-house data leaves your corporation)...enterprise stuff, you can do that on the endpoint, inside your "server-farm", or both, most enterprises distrust endpoints (for good reason), and completely trust the internal infrastructure (for often not so good reasons).

I know we are in that HN bubble but ~97% of enterprise don't work in IT but need lots of it.

>If you're talking about forced https interception,

No i don't, but some company's absolutely want that (sometimes for good reasons)

But you can also argue that an endpoint-firewall is just allowed to connect to one external ip (VPN-gateway) is also not a bad thing.

If you ever work for something critical (Financial/Defend/Insurance) you see 1000 points for securing/restricting the traffic (especially port 80/443) of endpoints and one for the opposite (that grumpy dev/ceo who wants admin right on his laptop and wants to use it "privately" too...btw even worse with smartphones).

Post reply on HN