Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ISP Spying

harrisonsand.com

Post reply on HN
Print view View original

91–100 of 134 posts

Re: ISP Spying

#91

Post by oger »

gruez wrote: post #62
alxndr13 wrote: post #32

In Germany you are able to use any router you want, regardless of which ISP you use. https://www.cr-online.de/bgbl116s0106.pdf

Do ISPs actually prevent you from doing that? At the very leas you can hook your router to the ISP's router and set up DMZ?

No. DSL-providers are legally obliged to let the customers use their own equipment (which includes the account details / passwords to establish the connection). Most of them even provide the details for the SIP connection that is included most of the times. If I remember correctly cable providers were fighting this - not sure about the final outcome...

Re: ISP Spying

#92

Post by shubb »

moviuro wrote: post #55
shubb wrote: post #13

Earlier quoted context omitted.

Personally I very much agree that using a vpn service for all your traffic is probably not a good idea. As well as other objections, some have been confirmed to sell fine grain traffic information, and may have an easier time justifying that as it is arguably anonymised. That said, if you set up your own vpn on a digital ocean node, moving your network boundary to the datacentre, then the cloud hosting companies netw…

> in my router That's probably the issue. A general purpose machine (with AES-NI), slap OpenBSD on it, disable DHCP server on your ISP router, let OpenBSD handle that... and done! (not for the faint of heart though) You might even add a NIC to it, and act as another physical hop for firewalling, etc.

Thanks for the tip - I'll try out a connection with AES-NI CPUs at both ends and see if that helps...

Re: ISP Spying

#93

Post by alyandon »

a012 wrote: post #88
alyandon wrote: post #75

Earlier quoted context omitted.

Usually, anything you can install a third party firmware on like openwrt, dd-wrt or tomato (shibby's version of tomato is the one I used the most). However, I gave up on consumer hardware and went with Ubiquiti for wifi AP and Mikrotik as my router. It was a bit of a pain to set up all my NAT rules in the Mikrotik router because unfortunately consumer devices do a lot of extra work behind that scenes (like setting up…

Opposite on me, I'm having a Mikrotik hAp ac and considering to use it as AP only then buy a Ubiquiti ER-X in front of it.

I did consider going with a pure Ubiquti solution but after borrowing a friends ER-Lite and comparing it to running RouterOS in a VM I decided that Mikrotik was a better overall fit for me from a technical standpoint. The RB3011 having a powerful cpu + the integrated 10 port (actually two different switches) switch helped push me that direction.

There was something almost zen-like watching 300Mbps of traffic transiting my RB3011 and seeing it utilize 6% cpu.

Ultimately, either is a fine solution and an ER-X is going to be a lot less fiddly to setup.

Re: ISP Spying

#94

Post by aus_ »

js2 wrote: post #89
aus_ wrote: post #80

Earlier quoted context omitted.

You might try this: https://github.com/jaysoffian/eap_proxy You have to enable `set system offload ipv4 vlan enable` else your routing performance will suffer.

Hey that’s me! I’m glad it’s working for you. All credit to the folks who figured out this bypass. I just coded it up in Python when I couldn’t get some of the other solutions to work for me.

Ha! Small world on HN. I haven't personally tried the Edgerouter solution. I've been trying to replicate on pfSense/BSD, but it isn't as simple as you might think. :/

https://forum.pfsense.org/index.php?topic=111043.0

Re: ISP Spying

#95

Post by nerraga »

TheRealDunkirk wrote: post #86
markwaldron wrote: post #66

Earlier quoted context omitted.

This is very informative! What router would you suggest purchasing?

I built my own, several years ago, on a (fanless!) board like this: http://www.pcengines.ch/apu3a4.htm It has 3 NIC's, for inside, outside, and DMZ. You can also put a wifi radio on it, and make it an access point. I run a full Ubuntu on it, with local DNS, DHCP, Shorewall, etc.

I picked up a couple of these and I have to say I'm pretty impressed. They're pretty inexpensive little machines and they ship quick from pcengines.

I have openbsd on one and ubuntu on the other. I'm using the openbsd one for dns, tftp, and a handful of projects. I was thinking about making the ubuntu one into an ap but I'm not sure about what kind of performance to expect vs my current off the shelf router. Have you used it as an access point?

Re: ISP Spying

#96

Post by js2 »

aus_ wrote: post #94
js2 wrote: post #89

Earlier quoted context omitted.

Hey that’s me! I’m glad it’s working for you. All credit to the folks who figured out this bypass. I just coded it up in Python when I couldn’t get some of the other solutions to work for me.

Ha! Small world on HN. I haven't personally tried the Edgerouter solution. I've been trying to replicate on pfSense/BSD, but it isn't as simple as you might think. :/ https://forum.pfsense.org/index.php?topic=111043.0

Yeah that seems like a bit of a headache. I appreciate your dedication to sticking with pfSense.

Re: ISP Spying

#97

Post by js2 »

wil421 wrote: post #79
liotier wrote: post #73

I plugged French Orange's GPON FTTH ONT into my Debian router's RJ-45 port, added a VLAN interface, added a couple of lines to my DHCP client configuration to pretend my router is some Sagem device and pass authentication to the server... And that's all - sweet 500/200 Mb/s throughput, no ISP CPE in sight (well, technically the ONT...) and Orange even waived the 3€/month CPE rental fee ! Former provider offered FTTB…

I thought about bridging an Ubiquit EdgeRouter and putting in front of the AT&T gateway. You must pass authentication back to the gateway. Users were also reporting around 100megs max speed which wasn’t acceptable for me since I pay for gigabit. There is a new line of EdgeRouters out and maybe it has some acceleration for bridging. I would like this setup.

I get wirespeed routing from my ERL on my 1Gps connection. If it’s maxing out at 100 Mbps, those folks have it configured so that it’s having to route with the CPU.

Re: ISP Spying

#98

Post by etskinner »

EADGBE wrote: post #81
laveur wrote: post #71

When I bought my fist house a few years ago here in the Bay. Comcast tried to give me one of their new routers wifi and everything built in. I let them but I wasn't happy. I hooked up my own router and ended up double natting it. After a few hours of frustration I went out bought my own cable modem. Installed that and returned the one comcast had provided. When asked why I sighted security and privacy concerns. Worki…

Does not using their own routers make ISP traffic sniffing that much harder? I'd assume if you're using their pipes, they can see what goes through it, regardless. Genuinely intrigued in this.

End-to-end encryption like SSL (https) is meant to limit the middle man's ability to 'see everything'. Instead of seeing the details of your Google search, all they see is that you accessed Google at [x] time, and exchanged [y] amount of data.

This is why there is such a push for end to end encryption on web traffic, chat apps, etc.

Re: ISP Spying

#99

Post by wil421 »

js2 wrote: post #97
wil421 wrote: post #79

Earlier quoted context omitted.

I thought about bridging an Ubiquit EdgeRouter and putting in front of the AT&T gateway. You must pass authentication back to the gateway. Users were also reporting around 100megs max speed which wasn’t acceptable for me since I pay for gigabit. There is a new line of EdgeRouters out and maybe it has some acceleration for bridging. I would like this setup.

I get wirespeed routing from my ERL on my 1Gps connection. If it’s maxing out at 100 Mbps, those folks have it configured so that it’s having to route with the CPU.

I can’t find the dslreports link but here is one on the Ubiquiti forums . You can see the comments below about 100Mbps. The dslreports was slightly different but same results.

[1]https://community.ubnt.com/t5/EdgeMAX-Stories/Bypassing-AT-a...

Re: ISP Spying

#100

Post by justsomedood »

alyandon wrote: post #75
markwaldron wrote: post #66

Earlier quoted context omitted.

This is very informative! What router would you suggest purchasing?

Usually, anything you can install a third party firmware on like openwrt, dd-wrt or tomato (shibby's version of tomato is the one I used the most). However, I gave up on consumer hardware and went with Ubiquiti for wifi AP and Mikrotik as my router. It was a bit of a pain to set up all my NAT rules in the Mikrotik router because unfortunately consumer devices do a lot of extra work behind that scenes (like setting up…

I'm in the exact same scenario. Mikrotik Router and a Ubiquiti API. I do have an older 2011, the 3011's are much faster.

The 3rd party firmwares aren't as powerful as mikrotik's RouterOS, and the Mikrotik hardware is really pretty cheap - though the UI is pretty bad for it. They're great once you get used to the UI

Post reply on HN