6 ms·

Another option is to run your own. I guess it's swings and roundabouts concerning privacy, traceability and so on. I have a script to automate setup of an IKEv2

by gmac 11y ago

Another option is to run your own. I guess it's swings and roundabouts concerning privacy, traceability and so on. I have a script to automate setup of an IKEv2 server on Ubuntu, which seems nice for a balance of security and the availability of built-in clients. I was inspired to set this up by the awful proposed Investigatory Powers Bill going through in the UK. https://github.com/jawj/IKEv2-setup https://github.com/jawj/IKEv2-setup

akerro 11y ago
Not really. shared public IP for dozens of users make them harder to track and their network traffic is mixed. Own VPN hides your traffic from one point, and 100% exposes in another.
- maze-le 11y ago
  That kind of depends on what you want to do with your VPN. A self-hosted VPN is perfectly valid when it comes to circumvent the ISP-restrictions just one country. Example: You want to evade the censorship of lets say Turkey, and use a french VPS-hoster to host a self-configured VPN. I don't see anything wrong with it. You are not very likeley to have problems with authorities in Turkey (they don't see what is going on on the wire) or France (they know you by name, but as long you dont do anything illigal with your VPN...).
- txutxu 11y ago
  In that case, tunnel your VPN inside of a public VPN. Trusting a remote VPN service not under your control, defeats the purpose of communication channel encryption. Calling it "VPN service" makes it look appealing, without realize that you are breaking the "P" in "VPN". If you want the "P", the master keys and certificates, and the systems where they live (client/server) should be under your control. Dot.
  - FiloSottile 11y ago
    Security is not binary. (I'm becoming boring, most of my comments start like this.) The question is what are you trying to protect against? If you are trying to protect against the local network, any VPN does the job. If you are trying to protect against tracking, ONLY a public VPN does the job (having a static private IP is a disaster in this scenario). If you are trying to protect against any organization seeing your traffic, then your argument might make sense. However, unless you can run that "private" server on metal you own on a network you own, there will still be a VPS provider and an ISP that can see your traffic as much as the VPN provider would. So you might want Tor a at this point.
    - txutxu 11y ago
      I can use public proxy lists since the 90's If I want to mix my output IP with other users (futile while my browser is fingerprint-able), I don't even need any VPN, and much less a third party one. I use VPN for what it is. Mostly to connect to my network (personal or professional) from the outside. If I still want to mix my traffic, I can do it, without "VPublicN services", without VPrivateN daemons, and without NSA's Tor. You are free to trust Tor and "Public VPrivateN services", and I'm free to do not trust them. Not sure if security is binary or not, but totally sure it's about trust.
      - akerro 11y ago
        >without NSA's Tor. Please explain your thought.
        txutxu 11y ago
        The news are explaining it for me.
  - mirimir 11y ago
    Once the traffic hits the Internet, nothing is trusted. Why worry so much about the VPN service? Everything important should be end-to-end encrypted, anyway. The VPN service is just for obfuscation.
  - DavideNL 11y ago
    >> shared public IP for dozens of users make them harder to track and their network traffic is mixed > In that case, tunnel your VPN inside of a public VPN. That doesn't solve anything: #1. Public VPN -> Private VPN -> Internet <- Here you no longer have a shared IP with other users, so no more mixed traffic. Websites will see the IP of your private server/vps. #2. Private VPN -> Public VPN -> Internet <- Here your Public VPN provider can still see your web traffic
    - txutxu 11y ago
      > That doesn't solve anything: It solves the (lack of) trust on the Public virtual Private whatever provider. > #1. Public VPN -> Private VPN -> Internet <- Here you no longer have a shared IP with other users, so no more mixed traffic. Websites will see the IP of your private server/vps. For mix your IP with others (are the VPN users visiting the same sites?), I said there are open proxies since the beginnings of internet. It's not the purpose of an VPN. > #2. Private VPN -> Public VPN -> Internet <- Here your Public VPN provider can still see your web traffic They will always, in ANY case and scenario that involves them. But in this case, at least, now you're sure that your channel uses your encryption and policies. With a third party channel, you're never sure if the guy near you in starbucks with a headphone, also has the signing key of your "private thing".
  - akerro 11y ago
    I understand the issue of making my traffic public to service provider, there are other issues I had to consider: Using Tor - you make your traffic public to SOMEONE, activists, hackers, maybe governments. No one knows. Running own VPN - you still expose traffic somewhere and you can still be easily tracked and monitored. Here comes another problem - I can administrate simple servers, I do it as a hobby... but I'm not sysadmin, and I would make mistakes and expose everything my start and endpoint traffic that can be 100% correlated. Not using VPN or Tor at all = exposing myself to local government/council, neighbours and GCQH.
- peterwwillis 11y ago
  A VPN, whether public or private, will not hide your traffic from the government. Through statistical analysis and network protocol heuristics you can identify all sorts of things about bulk internet traffic - where it's coming from, where it's going to, the most likely content it's carrying, the application used, even a specific user's connection. This works over multiple network hops, encrypted, on a single tap of a large switch (though multiple taps spanning the network path work muuuuuch better). There is one good use for a VPS, though - store-and-forward network traffic. You use a remote VPS to retrieve and store content, and at a later time, download the content in bulk (or upload, same difference). You can change both the size and the form of the content before the bulk transfer, making it much harder to identify. You can also use different network paths for connecting to issue the download/upload commands, and connecting to transfer it - Tor comes in handy here.
juiced 11y ago
Not seeing any ip6tables in your script started wondering me if you might be prone to IPv6 leaking with your setup? You maybe want to check this out, if IPv6 is disabled on the clients everything should be fine. Browsers these days prefer using IPv6 when it is available and will not use the VPN tunnel if only IPv4 traffic is rerouted through the VPN tunnel. Same thing for DNS leaking and hi-jacking, you want to use the VPN gateway as your DNS server to prevent this (Bind configured as a forwarder for example.), I don't see these settings back in your script. Just FYI and stay safe! https://www.wifimask.com https://www.wifimask.com (<== i figured out a lot of this when building this, WifiMask is not vulnerable to IPv6 leaking and DNS hi-jacking and leaking :P)

by gmac 11y ago

akerro 11y ago

Not really. shared public IP for dozens of users make them harder to track and their network traffic is mixed. Own VPN hides your traffic from one point, and 100% exposes in another.

maze-le 11y ago
That kind of depends on what you want to do with your VPN. A self-hosted VPN is perfectly valid when it comes to circumvent the ISP-restrictions just one country. Example: You want to evade the censorship of lets say Turkey, and use a french VPS-hoster to host a self-configured VPN. I don't see anything wrong with it. You are not very likeley to have problems with authorities in Turkey (they don't see what is going on on the wire) or France (they know you by name, but as long you dont do anything illigal with your VPN...).
txutxu 11y ago
In that case, tunnel your VPN inside of a public VPN. Trusting a remote VPN service not under your control, defeats the purpose of communication channel encryption. Calling it "VPN service" makes it look appealing, without realize that you are breaking the "P" in "VPN". If you want the "P", the master keys and certificates, and the systems where they live (client/server) should be under your control. Dot.
- FiloSottile 11y ago
  Security is not binary. (I'm becoming boring, most of my comments start like this.) The question is what are you trying to protect against? If you are trying to protect against the local network, any VPN does the job. If you are trying to protect against tracking, ONLY a public VPN does the job (having a static private IP is a disaster in this scenario). If you are trying to protect against any organization seeing your traffic, then your argument might make sense. However, unless you can run that "private" server on metal you own on a network you own, there will still be a VPS provider and an ISP that can see your traffic as much as the VPN provider would. So you might want Tor a at this point.
  - txutxu 11y ago
    I can use public proxy lists since the 90's If I want to mix my output IP with other users (futile while my browser is fingerprint-able), I don't even need any VPN, and much less a third party one. I use VPN for what it is. Mostly to connect to my network (personal or professional) from the outside. If I still want to mix my traffic, I can do it, without "VPublicN services", without VPrivateN daemons, and without NSA's Tor. You are free to trust Tor and "Public VPrivateN services", and I'm free to do not trust them. Not sure if security is binary or not, but totally sure it's about trust.
    - akerro 11y ago
      >without NSA's Tor. Please explain your thought.
      - txutxu 11y ago
        The news are explaining it for me.
- mirimir 11y ago
  Once the traffic hits the Internet, nothing is trusted. Why worry so much about the VPN service? Everything important should be end-to-end encrypted, anyway. The VPN service is just for obfuscation.
- DavideNL 11y ago
  >> shared public IP for dozens of users make them harder to track and their network traffic is mixed > In that case, tunnel your VPN inside of a public VPN. That doesn't solve anything: #1. Public VPN -> Private VPN -> Internet <- Here you no longer have a shared IP with other users, so no more mixed traffic. Websites will see the IP of your private server/vps. #2. Private VPN -> Public VPN -> Internet <- Here your Public VPN provider can still see your web traffic
  - txutxu 11y ago
    > That doesn't solve anything: It solves the (lack of) trust on the Public virtual Private whatever provider. > #1. Public VPN -> Private VPN -> Internet <- Here you no longer have a shared IP with other users, so no more mixed traffic. Websites will see the IP of your private server/vps. For mix your IP with others (are the VPN users visiting the same sites?), I said there are open proxies since the beginnings of internet. It's not the purpose of an VPN. > #2. Private VPN -> Public VPN -> Internet <- Here your Public VPN provider can still see your web traffic They will always, in ANY case and scenario that involves them. But in this case, at least, now you're sure that your channel uses your encryption and policies. With a third party channel, you're never sure if the guy near you in starbucks with a headphone, also has the signing key of your "private thing".
- akerro 11y ago
  I understand the issue of making my traffic public to service provider, there are other issues I had to consider: Using Tor - you make your traffic public to SOMEONE, activists, hackers, maybe governments. No one knows. Running own VPN - you still expose traffic somewhere and you can still be easily tracked and monitored. Here comes another problem - I can administrate simple servers, I do it as a hobby... but I'm not sysadmin, and I would make mistakes and expose everything my start and endpoint traffic that can be 100% correlated. Not using VPN or Tor at all = exposing myself to local government/council, neighbours and GCQH.
peterwwillis 11y ago
A VPN, whether public or private, will not hide your traffic from the government. Through statistical analysis and network protocol heuristics you can identify all sorts of things about bulk internet traffic - where it's coming from, where it's going to, the most likely content it's carrying, the application used, even a specific user's connection. This works over multiple network hops, encrypted, on a single tap of a large switch (though multiple taps spanning the network path work muuuuuch better). There is one good use for a VPS, though - store-and-forward network traffic. You use a remote VPS to retrieve and store content, and at a later time, download the content in bulk (or upload, same difference). You can change both the size and the form of the content before the bulk transfer, making it much harder to identify. You can also use different network paths for connecting to issue the download/upload commands, and connecting to transfer it - Tor comes in handy here.

juiced 11y ago

Not seeing any ip6tables in your script started wondering me if you might be prone to IPv6 leaking with your setup? You maybe want to check this out, if IPv6 is disabled on the clients everything should be fine. Browsers these days prefer using IPv6 when it is available and will not use the VPN tunnel if only IPv4 traffic is rerouted through the VPN tunnel. Same thing for DNS leaking and hi-jacking, you want to use the VPN gateway as your DNS server to prevent this (Bind configured as a forwarder for example.), I don't see these settings back in your script. Just FYI and stay safe! https://www.wifimask.com https://www.wifimask.com (<== i figured out a lot of this when building this, WifiMask is not vulnerable to IPv6 leaking and DNS hi-jacking and leaking :P)