Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Can't trust any VPN these days

blog.orhun.dev

Post reply on HN
Print view View original

71–80 of 85 posts

Re: Can't trust any VPN these days

#71

Post by [deleted] »

BSDobelix wrote: post #70
mmsc wrote: post #67

Earlier quoted context omitted.

>EnterpriseFirewall/VPN-Gateway Lan-> LocalNetwork(DNS,NTP,SMB/NFS etc) Lan-> EnterpriseFirewall HTTPS This does not seem to agree what you previously said: "VPN's where made so you can securely work inside your enterprise network" If you're connecting to the internet, route to the internet. If you're connecting to "inside your enterprise network", route through the VPN. >EnterpriseFirewall HTTPS If you're talking ab…

>If you're connecting to the internet, route to the internet. If you're connecting to "inside your enterprise network", route through the VPN. Block-lists, traffic-audit/amount, not allowed ports, protocol/packet inspection, mail-scanning and archival (aka have a hint how in-house data leaves your corporation)...enterprise stuff, you can do that on the endpoint, inside your "server-farm", or both, most enterprises di…

[deleted]

Re: Can't trust any VPN these days

#72

Post by Jnr »

martheen wrote: post #68
wink wrote: post #50

Earlier quoted context omitted.

It's been a while but e.g. with OpenVZ containers you couldn't do anything in the kernel, i.e. Wireguard. I don't have access to that VPS anymore, but I was already using Wireguard but had to use OpenVPN here, so I can't tell you if this is still a widespread problem or a historical curiosity. Also sometimes, especially cross-organization, the chance that OpenVPN is already in use is much higher (if they're not doing…

It depends on the OpenVZ kernel, some later version can use WG. But OpenVZ is dying anyway so if someone use a still supported container technology, WG is probably available. Depending on the ISP setup, sometimes WG can be less reliable due to MTU and/or UDP filtering, I remember an ISP from years ago where WG don't work only on certain hours, while OpenVPN running on the same server still work.

Wireguard can run in userspace mode if the kernel module is not available.

Changing the MTU for Wireguard to 1280 usually helps a lot with reliability and throughput.

Re: Can't trust any VPN these days

#73

Post by Jnr »

jmclnx wrote: post #65
Jnr wrote: post #22

Maybe a bit off-topic, but genuine curiosity - why would anyone go for OpenVPN these days, when there is Wireguard available? It makes sense if UDP is blocked, but in this case OP is clearly using UDP for OpenVPN.

OpenVPN is can hid your IP if set up correctly. Wireguard can in a way. But on the server your IP can be identified in some manner, maybe even after you sigh-out. Wireguard is good for places like Europe and North America. But if in Mainland China, Russia, Iran and countries like that, you need use OpenVPN.

Wireguard should leak less since the interface is up even if the connection is not established, it will still try routing packets through the Wireguard interface.

Not sure why Wireguard would be less useful in the mentioned countries, but I guess it is because of blocking of UDP traffic? And as far as I know, China and Russia does not block UDP traffic.

Re: Can't trust any VPN these days

#74

Post by Jnr »

wruza wrote: post #47
Jnr wrote: post #22

Maybe a bit off-topic, but genuine curiosity - why would anyone go for OpenVPN these days, when there is Wireguard available? It makes sense if UDP is blocked, but in this case OP is clearly using UDP for OpenVPN.

Is there a oneliner for setting it up on a ubuntu box akin to https://github.com/angristan/openvpn-install ? How does it work with iphone, android, windows? Can a regular person set up a client by receiving a single profile file? Idk about wg, but ovpn ticks all these boxes.

Wireguard works on Windows, iOS, Android, MacOS, Linux. It is supported on multiple routers. And it can be configured with a single file, which on mobile devices can be imported as a QR code. And the "server" side is set up the same way as client side - with a single config file per tunnel. Wireguard is popular because it is simple to configure.

And then there are many different solutions built on top of Wireguard, like Tailscale, which simplify some other aspects of setting up tunnels.

Re: Can't trust any VPN these days

#75

Post by Hikikomori »

yaris wrote: post #26

While there is some useful info in the post, the title is hugely misleading. The author tried one (single) VPN solution which they set up themselves, without full understanding of the things or even reading documentation upfront (although "it's right there under the DNS section"). It feels more like "I was unable to correctly setup VPN even using the very detailed instructions, but I can't blame myself, can I?"

Also not a privacy focused vpn that requires extra steps to be so.

Re: Can't trust any VPN these days

#76

Post by mingus88 »

Jnr wrote: post #73
jmclnx wrote: post #65

Earlier quoted context omitted.

OpenVPN is can hid your IP if set up correctly. Wireguard can in a way. But on the server your IP can be identified in some manner, maybe even after you sigh-out. Wireguard is good for places like Europe and North America. But if in Mainland China, Russia, Iran and countries like that, you need use OpenVPN.

Wireguard should leak less since the interface is up even if the connection is not established, it will still try routing packets through the Wireguard interface. Not sure why Wireguard would be less useful in the mentioned countries, but I guess it is because of blocking of UDP traffic? And as far as I know, China and Russia does not block UDP traffic.

Wireguard seems to be something they can reliably fingerprint and block in Russia and China

Previously HN discussion: https://news.ycombinator.com/item?id=39067213

Re: Can't trust any VPN these days

#77

Post by godelski »

vetinari wrote: post #59
wruza wrote: post #36

Has nothing to do with VPN or OpenVPN (almost). “You can’t trust” “Linux” in this case. Its network stack is still not mouse-friendly in general and requires some thought. Quoting key points from TFA: - (DNS leak happens) - The DNS changes are not automatically applied by the OpenVPN client on Linux. - You need to configure up and down scripts for managing the DNS updates. - The recommended script is update-resolv-co…

This is something I always wondered about: why so many linux users always take the hard way? They have two options: a) use the mouse-friendly way in NetworkManager to configure their VPN client (yes, it handles VPN DNS too; if you have systemd-resolved, it can also do split-horizon DNS over specific links) or b) funble around with tools and scripts they have no idea how they work, complain how complicated it is, and…

The mouse is the hard way.

OP could have solved their problem by rtfming... It is literally the first paragraph on DNS. We're talking about "turn it off and on again" style issues.

Before you reach for GPT, check the man pages and check the Arch wiki, you'll save a lot of time and get more information.

https://wiki.archlinux.org/title/OpenVPN#DNS

Re: Can't trust any VPN these days

#78

Post by vetinari »

godelski wrote: post #77
vetinari wrote: post #59

Earlier quoted context omitted.

This is something I always wondered about: why so many linux users always take the hard way? They have two options: a) use the mouse-friendly way in NetworkManager to configure their VPN client (yes, it handles VPN DNS too; if you have systemd-resolved, it can also do split-horizon DNS over specific links) or b) funble around with tools and scripts they have no idea how they work, complain how complicated it is, and…

The mouse is the hard way. OP could have solved their problem by rtfming... It is literally the first paragraph on DNS. We're talking about "turn it off and on again" style issues. Before you reach for GPT, check the man pages and check the Arch wiki, you'll save a lot of time and get more information. https://wiki.archlinux.org/title/OpenVPN#DNS

We probably have different ideas about what constitutes the hard way; but that's not the point in this thread.

Anyway, NetworkManager can be managed using cli for those that insist, so all that was needed was:

    nmcli connection import type openvpn file
Even Arch wiki says:

> By default networkmanager-openvpn plugin appends DNS servers provided by OpenVPN to /etc/resolv.conf.

(which is not really true. Yes, it does the right thing with DNS info, but the specific action depends on the resolver backend NetworkManager is configured to use; for systemd-resolved and dnsmasq it configures these services instead).

Re: Can't trust any VPN these days

#79

Post by justonenote »

nofunsir wrote: post #62
justonenote wrote: post #49

Earlier quoted context omitted.

Does Firefox route WebRTC through a socks proxy? Does it leak your locally configured IP when WebRTC is initiated? Even if the specific case of Firefox can be configured correctly and you have the source to verify that's it only sending traffic over the socks proxy, manually configuring every app to use a socks proxy is brittle and error pone, and for some apps just won't work. Much more straightforward to just have…

media.peerconnection.enabled = false also, this sounds like fud.

so you gave 3 steps to get it working for firefox but forget one step that results in an IP leak.

so not fud, it's a more brittle way to do it.

Re: Can't trust any VPN these days

#80

Post by ndheebebe »

nofunsir wrote: post #62
justonenote wrote: post #49

Earlier quoted context omitted.

Does Firefox route WebRTC through a socks proxy? Does it leak your locally configured IP when WebRTC is initiated? Even if the specific case of Firefox can be configured correctly and you have the source to verify that's it only sending traffic over the socks proxy, manually configuring every app to use a socks proxy is brittle and error pone, and for some apps just won't work. Much more straightforward to just have…

media.peerconnection.enabled = false also, this sounds like fud.

TFA is about forgetting to configure something and the VPN doesn't work while informing your ISP and probably your state of what you did.

Therefore I don't think this is fud for the wider privacy case.

Post reply on HN