3 ms·

It's simple. I connect to a server of one VPN service. Then, through that VPN tunnel, I connect to a server of a second VPN service. Then, through that VPN tun

It's simple. I connect to a server of one VPN service. Then, through that VPN tunnel, I connect to a server of a second VPN service. Then, through that VPN tunnel, I connect to a server of a third VPN service. That's what I mean by nested. I don't use custom VPN clients. Just OpenVPN. In the setup that I'm currently using, one VPN client runs in a VirtualBox host machine. And the others run in pfSense VMs.[0] Each pfSense instance uses ~500MB RAM, however. But it also works in a single machine, using routing and iptables rules.[1] For a chain of three VPNs, these OUTPUT rules prevent leaks, with internet traffic restricted to the third VPN tunnel (tun2): -A OUTPUT -o enp0s3 -d VPN0 -j ACCEPT -A OUTPUT -o tun0 -d VPN1 -j ACCEPT -A OUTPUT -o tun1 -d VPN2 -j ACCEPT -A OUTPUT -o tun2 -j ACCEPT -A OUTPUT -j DROP VPN0, VPN1 and VPN2 are the IPv4 addresses of the VPN servers that I'm using. From different VPN services. The script that sets up the chain alters the routing so that each VPN connects through the previous one. There's no isolation between the different VPN clients, but that also makes it easy to switch chains periodically. Sort of like Tor. I pay for the first VPN with a credit card. But the rest I pay with Bitcoin, which has been mixed multiple times through Tor, using a different mixing service at each step. I used Bitcoin that's been mixed more times for VPNs that I connect to less directly. And I never lease different VPNs with the same batch of mixed Bitcoin. The last VPN know only what I connect to, and what VPN I connected from. 0) https://www.ivpn.net/privacy-guides/advanced-privacy-and-anonymity-part-1 https://www.ivpn.net/privacy-guides/advanced-privacy-and-ano... 1) https://github.com/mirimir/vpnchains https://github.com/mirimir/vpnchains

iudqnolq 7y ago
Thanks for the reply. Guess SE was wrong about the configs. If you don't mind me asking, why cc for the first hop? Also, vpnchains explicitly says they can't protect against adversaries with a global view od the network. That was the main weakness I assumed this would probably have. I'd buy that it protects from for instance VPN providers selling logs.
- mirimir 7y ago
  I use a card for the first one because it's gotta know my IP, and my ISP can link me to my IP. Nothing can protect from adversaries with a global view of the internet. At least, for low-latency activity. If the latency is high enough, and there's lots of chaff, there's maybe a chance. Or at least, there are too many false positives to deal with. Otherwise, you just make it harder. Once you have more than a couple VPNs in a chain, and especially if you switch chains frequently, latency varies a lot. So that likely helps too. Edit: There is nothing in OpenVPN about routing one VPN through another. That's all done in the host networking stack, or using multiple routers with NAT forwarding. There is, however, a SOCKS5 proxy option, which you can use to route a VPN through Tor. Or you can just run a VPN server as an onion service.
pheug 7y ago
But why go through so much trouble instead of just using Tor, which AFAIK gives you 3 hops right out of the box?
- mirimir 7y ago
  I do use Tor. Which gives me three hops for clearnet sites, and seven hops for onion services. But I don't trust Tor enough to connect directly to it. Given the risk of malicious relays, and of 0days like "relay early" that increase their effectiveness. And then there's the likelihood that TLAs track all connections to the Tor network. So the nested VPN chains isolate me from Tor entry guards. If Tor circuits get deanonymized, an adversary just learns a VPN exit. Or at least, an adversary that isn't doing global traffic analysis. But as Mirimir, I don't need all that. I really don't need anonymity at all, except to protect my professional reputation. And being retired, that doesn't matter any more. So anyway, nested VPN chains are arguably enough for people who aren't juicy targets. They almost certainly aren't as good as Tor, unless Tor is more compromised than it seems. But what they are is lots faster. There's somewhat less latency than Tor. And bandwidth is much higher.
UI_at_80x24 7y ago
You might want to look into wireguard. It has much lower over-head then OpenVPN, and in your case the inter-connection latency/processing would be improved.

iudqnolq 7y ago

Thanks for the reply. Guess SE was wrong about the configs. If you don't mind me asking, why cc for the first hop? Also, vpnchains explicitly says they can't protect against adversaries with a global view od the network. That was the main weakness I assumed this would probably have. I'd buy that it protects from for instance VPN providers selling logs.

mirimir 7y ago
I use a card for the first one because it's gotta know my IP, and my ISP can link me to my IP. Nothing can protect from adversaries with a global view of the internet. At least, for low-latency activity. If the latency is high enough, and there's lots of chaff, there's maybe a chance. Or at least, there are too many false positives to deal with. Otherwise, you just make it harder. Once you have more than a couple VPNs in a chain, and especially if you switch chains frequently, latency varies a lot. So that likely helps too. Edit: There is nothing in OpenVPN about routing one VPN through another. That's all done in the host networking stack, or using multiple routers with NAT forwarding. There is, however, a SOCKS5 proxy option, which you can use to route a VPN through Tor. Or you can just run a VPN server as an onion service.

pheug 7y ago

But why go through so much trouble instead of just using Tor, which AFAIK gives you 3 hops right out of the box?

mirimir 7y ago
I do use Tor. Which gives me three hops for clearnet sites, and seven hops for onion services. But I don't trust Tor enough to connect directly to it. Given the risk of malicious relays, and of 0days like "relay early" that increase their effectiveness. And then there's the likelihood that TLAs track all connections to the Tor network. So the nested VPN chains isolate me from Tor entry guards. If Tor circuits get deanonymized, an adversary just learns a VPN exit. Or at least, an adversary that isn't doing global traffic analysis. But as Mirimir, I don't need all that. I really don't need anonymity at all, except to protect my professional reputation. And being retired, that doesn't matter any more. So anyway, nested VPN chains are arguably enough for people who aren't juicy targets. They almost certainly aren't as good as Tor, unless Tor is more compromised than it seems. But what they are is lots faster. There's somewhat less latency than Tor. And bandwidth is much higher.

UI_at_80x24 7y ago

You might want to look into wireguard. It has much lower over-head then OpenVPN, and in your case the inter-connection latency/processing would be improved.