6 ms·

Aren't they just reselling Mullvad? So is everything said here true for Mullvad generally? Edit: I use an always on VPN on my phone but I can only have one, an

Aren't they just reselling Mullvad? So is everything said here true for Mullvad generally? Edit: I use an always on VPN on my phone but I can only have one, and that's taken by my local wireguard so I can access the not-cloud services that I run remotely. I've figured out how to connect Mullvad at the same time on that server, such that all traffic on the server goes through Mullvad. I can't figure out how to chain them. I want to make a request to my local network wireguard (wg0) and have any traffic that isn't local be routed through to the mullvad connection (wg1) so I can both access my local network and use the internet over the VPN. Has anyone don this or could anyone point me in the right direction? This is on a linux machine...

tyingq 5y ago
The GUI client is different and produced by Mozilla, probably other pieces as well. https://github.com/mozilla-mobile/mozilla-vpn-client https://github.com/mozilla-mobile/mozilla-vpn-client
- deleted 5y ago
  [deleted]
kristjank 5y ago
Yup, it's still just mullvad.net with less privacy and a shadier corporate front. Chaining is doable using separate routing domains. Not for the faint of heart though.
- orf 5y ago
  I trust Mozilla way more than I trust Mullvad. And I’m a Mullvad customer.
  - haswell 5y ago
    This raises an interesting question: Is there any benefit to getting the Mozilla offering over the Mullvad offering?
    - stjohnswarts 5y ago
      Mozilla gets money? I mean if you like supporting mozilla.
    - CameronNemo 5y ago
      Last I heard the Mozilla reskin is cheaper. And you support Mozilla (the foundation? Corporation? I can't tell).
      - haswell 5y ago
        Mozilla VPN starts at $9.99/month with month to month pricing. Mullvad is €5/month, period. Mozilla pricing starts to align once you pay 12 months at a time. At least on the surface, Mozilla isn’t providing a benefit to the consumer aside from an account / subscription management approach that is slightly more “normal”, and it’s unclear if that’s actually a good (or bad) thing.
  - stjohnswarts 5y ago
    Eh 90% of the "trust" lies on the wireguard server side and not the client side. Seems like a useless worry to me since mullvad controls that part.
nullify88 5y ago
You may need to modify the routing table so Linux can route traffic destined for a particular network down the interface of your chosing. I haven't worked with wireguard and it may already have this feature built in, but the fundamentals remain the same. Edit: Perhaps its "AllowedIPs" in the connection config.
- 3np 5y ago
  "AllowedIPs" detemines which target networks are allowed to be routed through the tunnel. If it actually gets routed or not depends on the software. wg-quick adds routes to AllowedIPs by default, systemd-networkd does not.
jvanderbot 5y ago
Either your wireguard endpoint should be the router / gateway for the local traffic, and ip_forwarding is enabled on that gateway, OR you have to specify routes in iptables for the different networks you want to reach. ip route add <subnet> dev <device name> via <gateway or router> Like this: ip route add 192.168.1.1/24 dev wg0 via 192.168.1.1 (which is the router, usually). This really helped me https://unix.stackexchange.com/questions/666072/how-to-set-up-nat-of-vpn-sourced-ip-packets https://unix.stackexchange.com/questions/666072/how-to-set-u...
- xanaxagoras 5y ago
  Hey, thanks a lot! I started reading that and then I bought a router that runs OPNsense... I'm just going to run the whole network through the mullvad VPN. Setting up dynamic DNS and poking a little hole in OPNsense so I can connect to my local network wireguard... that's more of my speed.
  - xanaxagoras 5y ago
    Actually I got into the OPNsense documentation tonight, I think what I'm looking to do will be even easier than I imagined with it acting both as my local server and routing traffic to the mullvad interface... e.g. with my current local wireguard server retired. This networking stuff is crazy hard, I'd rather have a proper solution with good documention than what I was trying to do on a machine that has its own complocated local networks for libvirt and other stuff that I just kind of use without fully understanding.
commoner 5y ago
> So is everything said here true for Mullvad generally? No, since the client apps are different. However, Mullvad has completed several audits, including 2 of their client app: https://mullvad.net/en/blog/tag/audits/ https://mullvad.net/en/blog/tag/audits/
- threatofrain 5y ago
  I wonder if there's a better way to do this because the client updates often, and so any security report is going to be outdated in a month.
  - tomxor 5y ago
    You could just use plain wiregaurd built into the linux kernel... Download a tiny config from mullvad (there is a separate config for each server), pop it in `/etc/wiregaurd`, `chmod 600` and `chown root:root` it and use the `wg-quick` command to bring it up e.g `wg-quick up config-name`. That's it, no appy apps needed. I believe this is all the apps are doing, they just make it easier by retrieving and installing the configs for you and of course add more attack vectors in the process. This is how i use wiregaurd and it's pretty easy via the wg-quick interface. If using systemd you can also generate a unit for a particular config to bring it up at boot with: `systemctl enable wg-quick@config-name` where config-name is whichever one you want from your /etc/wiregaurd dir. If you want to be able to check a file to see it's up, e.g for i3status bar or something, you can use /sys like this: `/sys/devices/virtual/net/mullvad*/dev_id` i'm using a wildcard but you can be more specific if you aren't going to be changing configs.
    - prox 5y ago
      Interesting, thanks!
    - aborsy 5y ago
      Apps do much more. You can change location with a click, force kill switch, blocks ads or malware, change to openVPN if UDP is blocked, automatically connect and switch between networks, etc. It’s a better experience.
Thorentis 5y ago
I was just about to comment "how does this compare to Mullvad?", had no idea they were basically the same thing. Mullvad is already great and available in more countries, so I see no reason to move to Mozilla VPN.
- viccuad 5y ago
  One can support Mozilla (and Mullvad by extension), and a sizeable user portion only cares about Wireguard, not openVPN etc.
3np 5y ago
From the Introduction: "This report describes the results of a security assessment targeting five Mozilla VPN Qt5applications and clients, together with their corresponding codebase" It's only the client-side software in scope,not the VPN service itself.
- kchr 5y ago
  That's because they are using Mullvad as infrastructure, which was audited earlier this year: https://mullvad.net/en/blog/2021/1/20/no-pii-or-privacy-leaks-found-cure53s-infrastructure-audit/ https://mullvad.net/en/blog/2021/1/20/no-pii-or-privacy-leak...
  - 3np 5y ago
    I don't want to speculate as for the reason of the scope for the audit. Just answering the question "So is everything said here true for Mullvad generally?" with "No, the audit is only looking at the client-side software and is therefore not saying anything of Mullvad in general".
ynezz 5y ago
> Has anyone don this or could anyone point me in the right direction? Policy based routing https://blog.scottlowe.org/2013/05/29/a-quick-introduction-to-linux-policy-routing/ https://blog.scottlowe.org/2013/05/29/a-quick-introduction-t...
Jiocus 5y ago
There's no problem having several wireguard connections enabled at the same time. Routes are selected per metrics/distance. E.g: A private virtual network between you and remote hosts won't be interrupted by the presence of a VPN service. The entry connection to the private network would be routed through the VPN service, though.

tyingq 5y ago

The GUI client is different and produced by Mozilla, probably other pieces as well. https://github.com/mozilla-mobile/mozilla-vpn-client https://github.com/mozilla-mobile/mozilla-vpn-client

deleted 5y ago
[deleted]

kristjank 5y ago

Yup, it's still just mullvad.net with less privacy and a shadier corporate front. Chaining is doable using separate routing domains. Not for the faint of heart though.

orf 5y ago
I trust Mozilla way more than I trust Mullvad. And I’m a Mullvad customer.
- haswell 5y ago
  This raises an interesting question: Is there any benefit to getting the Mozilla offering over the Mullvad offering?
  - stjohnswarts 5y ago
    Mozilla gets money? I mean if you like supporting mozilla.
  - CameronNemo 5y ago
    Last I heard the Mozilla reskin is cheaper. And you support Mozilla (the foundation? Corporation? I can't tell).
    - haswell 5y ago
      Mozilla VPN starts at $9.99/month with month to month pricing. Mullvad is €5/month, period. Mozilla pricing starts to align once you pay 12 months at a time. At least on the surface, Mozilla isn’t providing a benefit to the consumer aside from an account / subscription management approach that is slightly more “normal”, and it’s unclear if that’s actually a good (or bad) thing.
- stjohnswarts 5y ago
  Eh 90% of the "trust" lies on the wireguard server side and not the client side. Seems like a useless worry to me since mullvad controls that part.

nullify88 5y ago

You may need to modify the routing table so Linux can route traffic destined for a particular network down the interface of your chosing. I haven't worked with wireguard and it may already have this feature built in, but the fundamentals remain the same. Edit: Perhaps its "AllowedIPs" in the connection config.

3np 5y ago
"AllowedIPs" detemines which target networks are allowed to be routed through the tunnel. If it actually gets routed or not depends on the software. wg-quick adds routes to AllowedIPs by default, systemd-networkd does not.

jvanderbot 5y ago

Either your wireguard endpoint should be the router / gateway for the local traffic, and ip_forwarding is enabled on that gateway, OR you have to specify routes in iptables for the different networks you want to reach. ip route add <subnet> dev <device name> via <gateway or router> Like this: ip route add 192.168.1.1/24 dev wg0 via 192.168.1.1 (which is the router, usually). This really helped me https://unix.stackexchange.com/questions/666072/how-to-set-up-nat-of-vpn-sourced-ip-packets https://unix.stackexchange.com/questions/666072/how-to-set-u...

xanaxagoras 5y ago
Hey, thanks a lot! I started reading that and then I bought a router that runs OPNsense... I'm just going to run the whole network through the mullvad VPN. Setting up dynamic DNS and poking a little hole in OPNsense so I can connect to my local network wireguard... that's more of my speed.
- xanaxagoras 5y ago
  Actually I got into the OPNsense documentation tonight, I think what I'm looking to do will be even easier than I imagined with it acting both as my local server and routing traffic to the mullvad interface... e.g. with my current local wireguard server retired. This networking stuff is crazy hard, I'd rather have a proper solution with good documention than what I was trying to do on a machine that has its own complocated local networks for libvirt and other stuff that I just kind of use without fully understanding.

commoner 5y ago

> So is everything said here true for Mullvad generally? No, since the client apps are different. However, Mullvad has completed several audits, including 2 of their client app: https://mullvad.net/en/blog/tag/audits/ https://mullvad.net/en/blog/tag/audits/

threatofrain 5y ago
I wonder if there's a better way to do this because the client updates often, and so any security report is going to be outdated in a month.
- tomxor 5y ago
  You could just use plain wiregaurd built into the linux kernel... Download a tiny config from mullvad (there is a separate config for each server), pop it in `/etc/wiregaurd`, `chmod 600` and `chown root:root` it and use the `wg-quick` command to bring it up e.g `wg-quick up config-name`. That's it, no appy apps needed. I believe this is all the apps are doing, they just make it easier by retrieving and installing the configs for you and of course add more attack vectors in the process. This is how i use wiregaurd and it's pretty easy via the wg-quick interface. If using systemd you can also generate a unit for a particular config to bring it up at boot with: `systemctl enable wg-quick@config-name` where config-name is whichever one you want from your /etc/wiregaurd dir. If you want to be able to check a file to see it's up, e.g for i3status bar or something, you can use /sys like this: `/sys/devices/virtual/net/mullvad*/dev_id` i'm using a wildcard but you can be more specific if you aren't going to be changing configs.
  - prox 5y ago
    Interesting, thanks!
  - aborsy 5y ago
    Apps do much more. You can change location with a click, force kill switch, blocks ads or malware, change to openVPN if UDP is blocked, automatically connect and switch between networks, etc. It’s a better experience.

Thorentis 5y ago

I was just about to comment "how does this compare to Mullvad?", had no idea they were basically the same thing. Mullvad is already great and available in more countries, so I see no reason to move to Mozilla VPN.

viccuad 5y ago
One can support Mozilla (and Mullvad by extension), and a sizeable user portion only cares about Wireguard, not openVPN etc.

3np 5y ago

From the Introduction: "This report describes the results of a security assessment targeting five Mozilla VPN Qt5applications and clients, together with their corresponding codebase" It's only the client-side software in scope,not the VPN service itself.

kchr 5y ago
That's because they are using Mullvad as infrastructure, which was audited earlier this year: https://mullvad.net/en/blog/2021/1/20/no-pii-or-privacy-leaks-found-cure53s-infrastructure-audit/ https://mullvad.net/en/blog/2021/1/20/no-pii-or-privacy-leak...
- 3np 5y ago
  I don't want to speculate as for the reason of the scope for the audit. Just answering the question "So is everything said here true for Mullvad generally?" with "No, the audit is only looking at the client-side software and is therefore not saying anything of Mullvad in general".

ynezz 5y ago

> Has anyone don this or could anyone point me in the right direction? Policy based routing https://blog.scottlowe.org/2013/05/29/a-quick-introduction-to-linux-policy-routing/ https://blog.scottlowe.org/2013/05/29/a-quick-introduction-t...

Jiocus 5y ago

There's no problem having several wireguard connections enabled at the same time. Routes are selected per metrics/distance. E.g: A private virtual network between you and remote hosts won't be interrupted by the presence of a VPN service. The entry connection to the private network would be routed through the VPN service, though.