4 ms·

Well, I had only little time to dig further but I can confirm your findings that OpenVPN alone behaves as it should while the NordVPN client acts differently. H

by limond 7y ago

Well, I had only little time to dig further but I can confirm your findings that OpenVPN alone behaves as it should while the NordVPN client acts differently. However, wireshark says I am only communicating with the NordVPN server when connected through their client. I would love to know where the difference in configuration is. I always assumed NordVPN would just call OpenVPN with the public ovpn configs. They call the OpenVPN client with a config that is shortly deleted after OpenVPN starts but can be extracted when swapping the openvpn binary. It looks unsuspicious. A management unix socket is opened to control the OpenVPN client. I would like to know how the communication is configured.

mirimir 7y ago
I'm also testing now with NordVPN CLI v3.4.0-1 in a Debian 10.1.0 x64 VM with standard Gnome desktop. I used the default settings. In particular, I didn't enable "obfuscate", which I gather uses two hops. I'm using a crude infinite while script.[0] And so far, I haven't come across any servers with unexpected "akamai-x-get-client-ip" for Disney. But then, there are well over 1000 US server IPs. So did you enable "obfuscate"? Or "CyberSec"? Or other options? It would also help if you could share which servers showed unexpected "akamai-x-get-client-ip" for Disney. 0) https://pastebin.com/hz5due96 https://pastebin.com/hz5due96
- mirimir 7y ago
  Damn, I can be such a dumbass. I was testing "www.disney.com", not "www.disneyplus.com". Now I always see residential proxies for US servers. Or SSL certificate failures, occasionally. Edit: That's using either the Windows GUI client, or the Linux terminal client in Debian. Not using "Obfuscate", "CyberSec", or other non-default options. But residential proxies aren't used for "www.disney.com" or "paypal.com". Also, with the stock openvpn in Debian, I don't see residential proxies being used for "www.disneyplus.com".

by limond 7y ago

mirimir 7y ago

I'm also testing now with NordVPN CLI v3.4.0-1 in a Debian 10.1.0 x64 VM with standard Gnome desktop. I used the default settings. In particular, I didn't enable "obfuscate", which I gather uses two hops. I'm using a crude infinite while script.[0] And so far, I haven't come across any servers with unexpected "akamai-x-get-client-ip" for Disney. But then, there are well over 1000 US server IPs. So did you enable "obfuscate"? Or "CyberSec"? Or other options? It would also help if you could share which servers showed unexpected "akamai-x-get-client-ip" for Disney. 0) https://pastebin.com/hz5due96 https://pastebin.com/hz5due96

mirimir 7y ago
Damn, I can be such a dumbass. I was testing "www.disney.com", not "www.disneyplus.com". Now I always see residential proxies for US servers. Or SSL certificate failures, occasionally. Edit: That's using either the Windows GUI client, or the Linux terminal client in Debian. Not using "Obfuscate", "CyberSec", or other non-default options. But residential proxies aren't used for "www.disney.com" or "paypal.com". Also, with the stock openvpn in Debian, I don't see residential proxies being used for "www.disneyplus.com".