11 ms·

> So is everything said here true for Mullvad generally? No, since the client apps are different. However, Mullvad has completed several audits, including 2 of

> So is everything said here true for Mullvad generally? No, since the client apps are different. However, Mullvad has completed several audits, including 2 of their client app: https://mullvad.net/en/blog/tag/audits/ https://mullvad.net/en/blog/tag/audits/

threatofrain 5y ago
I wonder if there's a better way to do this because the client updates often, and so any security report is going to be outdated in a month.
- tomxor 5y ago
  You could just use plain wiregaurd built into the linux kernel... Download a tiny config from mullvad (there is a separate config for each server), pop it in `/etc/wiregaurd`, `chmod 600` and `chown root:root` it and use the `wg-quick` command to bring it up e.g `wg-quick up config-name`. That's it, no appy apps needed. I believe this is all the apps are doing, they just make it easier by retrieving and installing the configs for you and of course add more attack vectors in the process. This is how i use wiregaurd and it's pretty easy via the wg-quick interface. If using systemd you can also generate a unit for a particular config to bring it up at boot with: `systemctl enable wg-quick@config-name` where config-name is whichever one you want from your /etc/wiregaurd dir. If you want to be able to check a file to see it's up, e.g for i3status bar or something, you can use /sys like this: `/sys/devices/virtual/net/mullvad*/dev_id` i'm using a wildcard but you can be more specific if you aren't going to be changing configs.
  - prox 5y ago
    Interesting, thanks!
  - aborsy 5y ago
    Apps do much more. You can change location with a click, force kill switch, blocks ads or malware, change to openVPN if UDP is blocked, automatically connect and switch between networks, etc. It’s a better experience.
    - viccuad 5y ago
      All of that will come to Linux UI once there's a network-manager-wireguard plugin, the same that one can do it for openVPN and the like now. Wireguard is still new, and network-manager was still finding the correct UX a year ago.
    - tomxor 5y ago
      You can do all of this without the app. I would say it's an "easier" experience, better is subjective.
  - gnull 5y ago
    I used Wireguard clients by default and didn't even know Mullvad has a dedicated client!
  - NilsIRL 5y ago
    Plug: if you want to obtain wireguard configurations for use with Mozilla VPN: https://github.com/NilsIrl/MozWire/ https://github.com/NilsIrl/MozWire/
mhh__ 5y ago
Clicked on it to find the following: Sorry, Web Safe has blocked this site This site has been blocked by Web Safe. It's listed as having content that’s inappropriate for children, involving either pornography, hate, crime, drugs, violence, hacking, self harm or suicide. Thank you, Virgin Media. At least they actually tell you they're blocking them now rather than just forcing a DNS failure.
- Macha 5y ago
  Isn't that a UK thing which you need to opt out of, not a Virgin thing? They don't do that here in Ireland, while I was under the impression most UK ISPs at least had default on porn filters
  - Lio 5y ago
    It depends on the ISP. It a voluntary scheme and not all bother with it.
  - 1_player 5y ago
    I got Zen (another UK ISP) and the page isn't blocked, and I'm a happy Mullvad customer. In fact, I haven't encountered a site that's blocked on the ISP level with them. So it's a Virgin Media thing.
- judge2020 5y ago
  Spectrum does this as well in the U.S., yet some on HN wonder why the industry is rolling out ECH (formerly eSNI) and encrypted DNS.
- pacifika 5y ago
  > If you’re a Virgin Fibre customer, we’ll ask to you choose your Web Safe settings when you register for My Virgin Media.
- weavie 5y ago
  I'm on Virgin, you can configure this. Log into your account and there's a whole range of categories you can select/unselect to block. It's only sites involved in pirating that you can't choose and have to use a VPN.
miked85 5y ago
Is there any reason to use the client apps? There are opensource OpenVPN and WireGuard clients, both of which work fine with Mullvad.
- Semaphor 5y ago
  Ease of setup. That’s pretty much it. I need no advanced features, and I have no other WG servers to connect to besides Mullvad, so I’m simply using their app which handles everything for me.
- photon-torpedo 5y ago
  Mullvad supports split-tunnel. Sure you can somehow set that up manually with the standard clients, but with Mullvad you can simply run a command with "mullvad-exclude" and the process will be exempt from VPN. Pretty convenient.

threatofrain 5y ago

I wonder if there's a better way to do this because the client updates often, and so any security report is going to be outdated in a month.

tomxor 5y ago
You could just use plain wiregaurd built into the linux kernel... Download a tiny config from mullvad (there is a separate config for each server), pop it in `/etc/wiregaurd`, `chmod 600` and `chown root:root` it and use the `wg-quick` command to bring it up e.g `wg-quick up config-name`. That's it, no appy apps needed. I believe this is all the apps are doing, they just make it easier by retrieving and installing the configs for you and of course add more attack vectors in the process. This is how i use wiregaurd and it's pretty easy via the wg-quick interface. If using systemd you can also generate a unit for a particular config to bring it up at boot with: `systemctl enable wg-quick@config-name` where config-name is whichever one you want from your /etc/wiregaurd dir. If you want to be able to check a file to see it's up, e.g for i3status bar or something, you can use /sys like this: `/sys/devices/virtual/net/mullvad*/dev_id` i'm using a wildcard but you can be more specific if you aren't going to be changing configs.
- prox 5y ago
  Interesting, thanks!
- aborsy 5y ago
  Apps do much more. You can change location with a click, force kill switch, blocks ads or malware, change to openVPN if UDP is blocked, automatically connect and switch between networks, etc. It’s a better experience.
  - viccuad 5y ago
    All of that will come to Linux UI once there's a network-manager-wireguard plugin, the same that one can do it for openVPN and the like now. Wireguard is still new, and network-manager was still finding the correct UX a year ago.
  - tomxor 5y ago
    You can do all of this without the app. I would say it's an "easier" experience, better is subjective.
- gnull 5y ago
  I used Wireguard clients by default and didn't even know Mullvad has a dedicated client!
- NilsIRL 5y ago
  Plug: if you want to obtain wireguard configurations for use with Mozilla VPN: https://github.com/NilsIrl/MozWire/ https://github.com/NilsIrl/MozWire/

mhh__ 5y ago

Clicked on it to find the following: Sorry, Web Safe has blocked this site This site has been blocked by Web Safe. It's listed as having content that’s inappropriate for children, involving either pornography, hate, crime, drugs, violence, hacking, self harm or suicide. Thank you, Virgin Media. At least they actually tell you they're blocking them now rather than just forcing a DNS failure.

Macha 5y ago
Isn't that a UK thing which you need to opt out of, not a Virgin thing? They don't do that here in Ireland, while I was under the impression most UK ISPs at least had default on porn filters
- Lio 5y ago
  It depends on the ISP. It a voluntary scheme and not all bother with it.
- 1_player 5y ago
  I got Zen (another UK ISP) and the page isn't blocked, and I'm a happy Mullvad customer. In fact, I haven't encountered a site that's blocked on the ISP level with them. So it's a Virgin Media thing.
judge2020 5y ago
Spectrum does this as well in the U.S., yet some on HN wonder why the industry is rolling out ECH (formerly eSNI) and encrypted DNS.
pacifika 5y ago
> If you’re a Virgin Fibre customer, we’ll ask to you choose your Web Safe settings when you register for My Virgin Media.
weavie 5y ago
I'm on Virgin, you can configure this. Log into your account and there's a whole range of categories you can select/unselect to block. It's only sites involved in pirating that you can't choose and have to use a VPN.

miked85 5y ago

Is there any reason to use the client apps? There are opensource OpenVPN and WireGuard clients, both of which work fine with Mullvad.

Semaphor 5y ago
Ease of setup. That’s pretty much it. I need no advanced features, and I have no other WG servers to connect to besides Mullvad, so I’m simply using their app which handles everything for me.
photon-torpedo 5y ago
Mullvad supports split-tunnel. Sure you can somehow set that up manually with the standard clients, but with Mullvad you can simply run a command with "mullvad-exclude" and the process will be exempt from VPN. Pretty convenient.