33 ms·
Removing support for forwarded ports
- sph 3y agoRIP torrenting on Mullvad. It's been a nice 2 years, and I am upset by this change.
- sys42590 3y agoYes, the potential for abuse is quite a lot... from the rather harmless Torrent user up to running C&C servers for botnets.
- Hamuko 3y agoNo mention of refunds? That's quite a significant change to the service.
- oarsinsync 3y agoCant refund a gift card purchase, or anything else where you’ve deliberately not saved the customer payment details. Privacy has drawbacks.
- iakov 3y agoI've paid with my card though. It's possible to refund those, and PayPal. It's a very sudden move on the Mullvad part that impacts a lot of their customers. If the torrent speed drops down as much as I think it will I won't be very happy...
- deleted 3y ago[deleted]
- fruitreunion1 3y agoThey used to allow refunds for cryptocurrency payments but there's probably opportunity for abuse there since the payment method is practically anonymous to them.
- wkat4242 3y agoNope but they could add 10% of time credit or something. Especially to those who had port forwarding configured in the last year or so.
- jsheard 3y agoThey offer refunds within 30 days of purchase as a matter of course, provided you paid with a method that can actually be refunded. Seems like you're out of luck if you paid longer than 30 days ago, though. https://mullvad.net/en/help/refunds/ https://mullvad.net/en/help/refunds/
- worldofmatthew 3y agoNot for vouchers or crypto as per their official policy.
- orra 3y agoTo be fair, the terms and conditions say they stopped offering port forwarding two years ago https://web.archive.org/web/20210430072429/https://mullvad.net/en/help/terms-service/ https://web.archive.org/web/20210430072429/https://mullvad.n...
- Hamuko 3y agoThat specifies "an account that has an active subscription" and they only seem to be using the term "subscription" in the ToS for auto-renewing plans. >If you wish to subscribe to the service, you can sign up for a PayPal subscription. With a subscription, €5 is automatically deducted from your PayPal account each month. Otherwise they just talk about "using" or "paying". It has also been absolutely possible to a) add new port forwards if you have paid for Mullvad b) pay for Mullvad when you have port forwards, so those ToS wouldn't make sense if they referred to all Mullvad accounts.
- orra 3y agoAh, thanks, I had forgotten the distinction.
- gioo 3y agoReally a shame, especially for torrent users. The other good alternatives are double the monthly price at 10$/month in the case of IVPN (if you want port forwarding that is) and ProtonVPN. Unless you want to commit for a year or two and pay all in advance, which is meh but the discount may be worth it.
- anaganisk 3y agoWhy would this affect torrenting, isn't this only for explicitly added port forwards? Or am I missing something?
- switch007 3y agoTorrenting requires an open port accessible from peers for good speeds
- armada651 3y agoIt wouldn't be very helpful in preventing abuse if you could still forward ports through UPnP.
- reisse 3y agoFor torrenting at least one of the peers has to be accessible for outside world, either by having white IP, by using NAT with port forwarding, or by using IPv6-to-IPv4 shenanigans. If both peers are behind NAT, they cannot download data from each other. If you're an active seeder, it makes sense to configure your machine so that it is accessible for all the peers, including ones behind NAT. If you're just a leecher though, it makes little difference.
- SparkyMcUnicorn 3y agoIt will affect leeching torrents that don't have a ton of seeders. No forwarding could render a torrent unusable that would otherwise download just fine if you had an open port.
- 3y ago
- 2OEH8eoCRo0 3y agoHorrible news but I can't blame them > This has led to law enforcement contacting us, our IPs getting blacklisted, and hosting providers cancelling us.
- elashri 3y agoProbably this was the reason for the warrant they received earlier this month [1]. [1] https://news.ycombinator.com/item?id=35638917 https://news.ycombinator.com/item?id=35638917
- capableweb 3y agoAccording to TFA, it's because of multiple reasons, not just one search warrant: > This has led to law enforcement contacting us, our IPs getting blacklisted, and hosting providers cancelling us.
- deleted 3y ago[deleted]
- Atlas22 3y agoAll of those happen on VPNs period, not just with port forwarding. Dealing with annoyed law enforcement, hosting providers, and IP reputation is 99% of the value of a VPN. The other 1% is just setting up a VPN server to open proxy everything (which there are scripts on github that can do it in 2mins). Of course its not really preserving privacy much unless there are multiple users... Any significantly shared connection will have at least one person abusing it and causing most of the problems, the logical conclusion would be to ban the few abusers but if mullvad truely doesn't log/retain billing data as they claim, permanent banning would be difficult as a new account could just be created. I don't see why they couldn't do some kind of compromise like an account has to be of certain age/spend to use port forwarding. They do keep mappings of ports to account, so its not like they don't know which accounts are abusing. Getting banned would then be more expensive for the abusers.
- derefr 3y ago> I don't see why they couldn't do some kind of compromise like an account has to be of certain age/spend to use port forwarding. In my personal experience investigating these scammers: people are happy to resell "used accounts of good age and reputation that they no longer need" on blackhat marketplaces — usually for about a dollar. Here's one such marketplace: https://lzt.market/ https://lzt.market/ (Hopefully linking to it like this will increase the probability of the right eyes seeing it and getting it taken down)
- UI_at_80x24 3y agoWell bummer. I'll be applying for a refund.
- nly 3y agoI've just done so. I might rejoin but I'll look for alternatives first.
- switch007 3y agoThis seems like a signal that it’s the beginning of the end. We all knew popularity would be their demise. Hopefully a competitor will start up and attract less attention for a while until we have to do it all over again.
- altairprime 3y agoHow? Port forwarding isn’t a major factor in VPN selection and usage for most people, right?
- dymk 3y agoWell, yeah, it is
- Capricorn2481 3y agoWhy does this affect torrent users?
- 5e92cb50239222b 3y agoYou need to be able to accept incoming connections to be able to fully participate in the network. Last time I seriously looked into this, BitTorrent clients didn't support any sort of NAT hole punching (and they often work over TCP in any case). Try running a client with and without a forwarded port and you will see massive difference in the number of peer connections.
- shrimp_emoji 3y agoSo you're saying there's a chance
- justsomehnguy 3y agoOf course, but if everyone is behind the NAT then no one in the swarm can connect to any one. If this is a popular torrent when someone with the connectivity would show up, eventually, but otherwise good luck. Recently it took me four months to complete one torrent and I was the one with the real IP.
- krossitalk 3y ago> NAT hole punching Could we just throw a STUN service in front of this, then?
- deleted 3y ago[deleted]
- Capricorn2481 3y agoI think I might be doing that already, as this is the first I've heard of this. Unless Mullvad was automatically opening a port for me. Is it possible a lot of average torrenters are already not port forwarding?
- 3y ago
- ctime 3y agoAlso, does this mean they just aren’t going to allow fully routable ipv6 because of “abuse” or whatever (one of the promises of ipv6 whenever it’s realized probably shortly before the heat death of the universe is preciously what mullvad claims to be the cause of trouble)
- fruitreunion1 3y agoEveryone having a unique globally routable IPv6 address might be less private/anonymous. Less ability to blend with the crowd. Personally I wouldn't mind ULA on a commercial VPN.
- kome 3y agofyi AirVPN still support port forwarding https://airvpn.org/faq/port_forwarding/ https://airvpn.org/faq/port_forwarding/
- KomoD 3y agoAirVPN looks sketchy
- Fire-Dragon-DoL 3y agoIt does, but it works. Been using it for 3 years.
- yata69420 3y agoI've been a customer since 2016 and they've been excellent. They also recently added wireguard support which is nice. Reddit has a big comparison table if you're curious: https://old.reddit.com/r/VPN/comments/m736zt/vpn_comparison_table/ https://old.reddit.com/r/VPN/comments/m736zt/vpn_comparison_...
- fruitreunion1 3y agoMight be the most trustworthy option available if you need multiple ports associated with an account... IVPN only supports one port. ProtonVPN may be OK if you're okay with getting a new random port every connection.
- CommitSyn 3y agoPerfect-Privacy allows port forwarding as well. Also multihop (up to 4 I believe).
- kome 3y agoit doesn't looks sketchy to me. why it looks sketchy to you?
- armitron 3y agoPort forwarding is the reason I use mullvad, time to switch.
- fullspectrumdev 3y agoUnfortunately was only a matter of time, this happens to every VPN provider who offers port forwarding eventually - widespread abuse by script kiddies and such to host RAT C&C servers.
- az226 3y agoWhy don’t they just cancel the script kiddies and keep offering it to all other customers?
- deleted 3y ago[deleted]
- fullspectrumdev 3y agoThey could play whackamole cancelling abusive accounts, but that would require keeping logs to enable such activity. Which mullvad specifically want to avoid doing - their whole jam is not having logs.
- yokem55 3y agoThis is really going to hit folks who were trying to host stuff behind cgnat. I suppose a cheap vps will have to do instead.
- jsheard 3y agoI had to stop using Mullvad because so many of their IP ranges were blocked or throttled by various services, it was borderline unusable as a daily driver. Unfortunately there isn't a good way for them to protect the reputation of their IPs when they don't collect any information that could be used to identify abusive customers, by design. Maybe retiring port forwarding will help, but their IP ranges aren't going to be removed from every shitlist out there overnight.
- pierat 3y agoTo be fair, I use subscribed ProtonVPN. Same exact issues. Cloudflare gives me captchahell with infinite "click on fire hydrants or vans or bicycles or stoplights". Amazon just pretends to "site error". Numerous sites like Tiktok, JLwaters, my state's data portal, and others just give me a 403 forbidden. Other sites just load a <html></html> blank document on my VPN. And Proton is actually kind of hard to get port forwarding turned on. You can do it by adding a suffix to the OpenVPN name, or by generating a wireguard with port forwarding on. But again, I don't think it's anything to do with port forwarding per se. The current web demands deanonymization. And naturally "abuse" is blamed, even when attached to legit accounts with legit historical purchases etc.
- deleted 3y ago[deleted]
- Wowfunhappy 3y ago> And Proton is actually kind of hard to get port forwarding turned on. You can do it by adding a suffix to the OpenVPN name, or by generating a wireguard with port forwarding on. Regrettably, I suspect this does nothing for abusers, who are motivated, and instead impacts only "legitimate" customers.
- dublinben 3y agoEven without a VPN, the built-in tracking protection in Firefox trips Cloudflare’s bot detection every time. It’s a not-so-subtle FU for taking any steps to protect your privacy online.
- 0x_rs 3y agoPort forwarding is a big deal. Mullvad is very well respected, and so is their advocacy of privacy, but once the setup ports expire I'll be forced to pick another provider, not as safe and certainly not as cheap either—I think many others are on the same boat too. Up until now if you needed a VPN with this feature there weren't any better alternatives. Another day cursing at networking, I guess.
- eatbitseveryday 3y agoYes, again the extreme abusers of a service ruin it for the rest.
- konstancja 3y agowindscribe is a no-log VPN that still provides port forwarding features, if you're looking for an alternative (full disclosure this is my place of work)
- _zoltan_ 3y agodoes it accept cash in an envelope?
- efitz 3y agoNo, but I do.
- mardifoufs 3y agoHow do you guys deal with abuse? Just wondering because it seems like it has been a massive headache for mullvad so I wonder if they are targeted by abusers more than other services.
- Aeolun 3y agoI think it’s more of a headache for Mullvad because they allow truly anonymous VPN
- TOMDM 3y ago
- gigatexal 3y agoThis is off topic but how can Mullvad be a no log vpn and still operate without impunity? What about Uber illegal stuff like csam or terrorist stuff etc?
- capableweb 3y agoGenerally it's not illegal to host services that could potentially be used for those things (as basically any online service with user generated content could be used for that), but it's illegal to not act once you have received complaints about it and not acted. Presumably, Mullvad does act when they get noticed about their service being used in those manners.
- Mordisquitos 3y agoCompare it for example to a company operating taxis that can be hailed on the street and be paid in cash on arrival. The company does not log any details about its passengers, nor does it inspect their luggage or inquire about their reason to travel. How can the taxi company still operate with impunity? What about passengers using them for uber illegal stuff, like transporting drugs, illegal arms, or for escaping from law enforcement?
- remram 3y agoYou can still put the taxi driver on the stand. Most cabs are even equipped with cameras now. This is more comparable to a taxi company which makes driver take a pill to forget all details on arrival. That would be harder to defend, after the first incident of "why was this car in my driveway last night? - we couldn't tell you!"
- michaelmrose 3y agoThat is a terrible analogy because the information is inherently captured and you are talking about taking extraordinary measures to destroy evidence. It's also a failed conversational gambit because we end up discussing the bad analogy instead of the underlying issue. In other news despite VPNs people who commit crimes are prosecuted all the time via ordinary police work per normal. In fact despite sophisticated tech criminals on average leave behind more breadcrumbs than they ever did in prior eras.
- fulafel 3y agoCan you still accept incoming connections on IPs that are behind the VPN?
- fruitreunion1 3y agoThat requires port forwarding
- fulafel 3y agoNormally it doesn't, but I guess Mullvad have a user untouchable firewall in place then.
- jason2323 3y agoCan someone explain to me why they need port forwarding functionality through a VPN?
- input_sh 3y agoTorrents. As in you don't want your whole traffic to go through a VPN, but you may be in one of those places where a torrent client is a must.
- wkat4242 3y agoRouting your whole traffic doesn't help. The IP on the other side isn't just used by you. The problem is inbound connections. If both peers are behind NAT they can't connect.
- michaelmrose 3y agoYou don't need port forwarded to use bittorrent. Clients connected to the network exchange information with each other. Magnet links or torrent files provide the information needed to get in touch with peers to make the initial connection.
- gersg 3y agoIf neither side has their ports open there is no way to make the initial connection.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- seized 3y agoTorrents need a port open and forwarded.
- michaelmrose 3y ago
- zokier 3y agoFyi there are plenty of commercial/foss solutions in this sort of "port forwarding service" space https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling
- flangola7 3y agoIf I don't torrent how does this affect me
- deleted 3y ago[deleted]
- joffspkfjeueebo 3y ago[dead]
- npteljes 3y agoIt doesn't affect web browsing via their service, for example. If you only do that, then you're not affected.
- LjutiBrk 3y agoHide.me supports port forwarding with uPnP
- timtom39 3y agoDam, really liked these guys but this makes it about useless for torrent seeding. I wish they would have considered alternatives like only allowing port forwarding for some of their IPs. I don't care about IP reputation.
- Gareth321 3y agoExactly. For torrenting it doesn't need to access web services. It just needs to be able to connect to peers. Having a port forwarding IP block would make everyone happy.
- fomine3 3y agoTorrent peers are too random so it's hard to restrict for IPs. If the problem is hosting malicious websites, they may able to provide limited port forwarding. Browsers' restricted port can't be used by browser so it's a way to avoid web hosting I believe. A problem is that there are only 80 ports now (for Chromium). https://chromium.googlesource.com/chromium/src.git/+/refs/heads/master/net/base/port_util.cc https://chromium.googlesource.com/chromium/src.git/+/refs/he...
- JP44 3y agoNot in need of fowarding, and a happy mullvad customer but that does sound like a good compromise. Although I think that still may attract a lot of attention from authorities etc
- null0pointer 3y agoI would happily pay more for an account with port forwarding enabled. Maybe charging more for port forwarding enabled accounts could help offset the increased trouble caused by port forwarding abusers. It might even push some of them to other providers. Either way, this thread is evidence enough that port forwarding is a feature that people want.
- Roark66 3y agoPity. I never used them, but I know the pain of not having an externally reachable IP. My Lte provider (the only one in my area with "unlimited" plans) has basically all of its tens of thousands of users on a single IP. So I've been using a vpn terminated in Aws to access for example Ip cameras and other stuff at home while I'm away. I can't wait until we finally get ubiquitous ipv6. Probably not in my lifetime(because security). I've been waiting for it for last 20 years.
- AnonC 3y agoSo basically, Mullvad is saying that you can use its VPN aeevice as a client to reach services but not host a service yourself (especially in a home network behind NAT or CGNAT) and have others connect to it via the VPN. The most commonly used scenario for port forwarding would be torrenting, where users forward ports so that they can be “connectable” (i.e., accept incoming connections from the Internet).
- SamuelAdams 3y agoI would argue consoles might be more common. Xbox live still likes to see port 3074 forwarded for open NAT.
- alberth 3y agoWhy do individuals use a VPN, other than to do questionable activities? Not trolling, genuinely curious.
- oefnak 3y agoTo access my home network?
- zo1 3y agoMy local ISP throttles YouTube. VPN bypasses that entirely, despite my traffic traveling to another continent on the other hemisphere.
- b5n 3y agoAll depends on who it is that is deciding what is questionable and what is not.
- alberth 3y agoWhat’s an example of an activity you’d consider debatable on whether or not it’s “questionable”?
- DarmokJalad1701 3y agoWatching Netflix outside your "region".
- deleted 3y ago[deleted]
- dharmab 3y ago- There are countries, and ISPs in some countries, that block or throttle access to commonly used websites. - You can get cheaper rates on some travel expenses, such as car rentals, by changing your IP to one in a different geo.
- serf 3y agoI would like to watch Japanese commercials and trailers for things i'd like to watch -- but Japanese publishers are big on region locking on the streaming sites, so I circumvent the issues with VPNs. Questionable? Maybe; but I don't really feel personally beholden to copyright/trademark law that isn't preventing a loss anywhere -- in many cases when I watch these trailers I make purchases based upon them, so if anything the corporations that region-lock their YouTube videos away from other markets are doing more damage than I -- the extra diligent customer. If you need an absolutely vanilla answer : I VPN into a network node that can access other nodes that only host their services to the local network. That's also a big advantage, and as far as I know it doesn't step on any legal toes.
- forty 3y agoI'm curious: if you have a forwarded port on your vpn that anyone can send traffic to, assuming that someone can observe the encrypted traffic going out of the vpn provider, couldn't they send various traffic "shape" to the port and try to find the same pattern in the encrypted traffic to figure out who you are?
- dtx1 3y agoYes, if you can observe incoming and outgoing traffic you can trivially use timing attacks. That being said, If you have that capability, mullvad isn't going to keep you save anyway. As the folks over at PerfectPrivacy succinctly put it: If you have a whole NSA Team after you it's game over anyway.
- jftuga 3y agoI wrote something tangentially related, but for single user. "gofwd" is a cross-platform TCP port forwarder with Duo 2FA and Geographic IP integration. Its use case is to help protect services when using a VPN is not possible. Before a connection is forwarded, the remote IP address is geographically checked against city, region (state), and/or country. Distance (in miles) can also be used. If this condition is satisfied, a Duo 2FA request can then be sent to a mobile device. The connection is only forwarded after Duo has verified the user. https://github.com/jftuga/gofwd https://github.com/jftuga/gofwd
- wkat4242 3y agoOhhhh too bad. It was useful for torrents. That said, I never actually got incoming connections over UDP working properly anyway through these ports, even though they were supposed to be supported. But I can understand the reasoning yeah.
- naet 3y agoShame, I'd been greatly enjoying Mullvad and their stance on privacy, but port forwarding is a must for some of the services I run. Anyone have a good suggested alternative?
- NL807 3y agoJust tried AirVPN. Works good.
- joeman1000 3y agoThis will be the end for me, after being a constant customer since 2018. I absolutely need this feature and will have to find another product.
- eduction 3y agoI port forward via ec2. Had to learn iptables (which apparently are now deprecated) and set up openvpn (these days I’d probably do wiregaurd). Works fine for my personal website, and paying in advance the cost is maybe $3/mo, didn’t realize it was remotely controversial.
- SamuelAdams 3y agoThis feels a bit like the Dropbox comment. Sure, open source tools exist that enable you to do things yourself. However there’s a large market for less-technical people (prosumers) who might pay for a lot of that complexity to be simplified.
- eduction 3y agoeh except I'm not saying I don't get why people need VPNs, I totally get that and have used several. The Dropbox comment was saying Dropbox is redundant. I don't feel that way at all about VPNs and didn't say anything like that. I'm just saying there are workarounds that mean we don't have to be beholden to the Mullvads of the world if they drop this feature. I think we're basically one good blog post away from a situation where most people who need port forwarding can set it up themselves via ec2. If they prefer VPNs, and can find some that do port forwarding, more power to them.
- fomine3 3y agoAnd it breaks original purpose to use VPN: "privacy"
- SamuelAdams 3y agoSee I’ve never understood the privacy argument. Who are you trying to stay private from? If it’s your local ISP, sure that could probably work. But if it’s LEO’s and the VPN provider must comply with international laws, you’re really just changing the amount of paperwork someone has to do. If the American FBI wants to see access logs for a VPN provider in Switzerland, the VPN provider must respond and comply with a subpoena or court order. I feel like people really need to think about who they’re trying to be private from before signing up for VPN’s.
- 2oMg3YWV26eKIs 3y agoMullvad used to have a "how to" guide for torrenting on VPN. But now it 404s: https://mullvad.net/en/help/bittorrent/ https://mullvad.net/en/help/bittorrent/ According to wayback machine, they deleted the page sometime mid 2021. Here's an archived version of the page: https://web.archive.org/web/20210513051214/https://mullvad.net/en/help/bittorrent/ https://web.archive.org/web/20210513051214/https://mullvad.n...
- Aeolun 3y agoI like how blunt they are about this. No excuses. “Some people are ruining it for all of you, so you can’t have the good things any more”.
- benatkin 3y ago> Unfortunately port forwarding also allows avenues for abuse, which in some cases can result in a far worse experience for the majority of our users. Let me rephrase that. > Unfortunately port forwarding also allows people to get the value for the money they pay us, which in some cases can result in our service not functioning like a gym membership, where we aren't used for much but many users continue to pay for us (sadly many services block traffic coming from us which makes a lot of simpler uses of a VPN fail as well). We'll aggressively defend against chargebacks.
- null0pointer 3y agoAs far as I’m aware Mullvad doesn’t have a method of automatic recurring payments. So they can’t operate on the gym model. Only users who want to use it pay for it repeatedly.
- benatkin 3y agoThe new gym model is annual payments. (Gyms use them too.) And chargebacks are very relevant there. Which they avoid by getting people to use other payment methods. But they also take credit cards. Edit: Ooh, they charge the same whether you sign up monthly or annually. Not too shabby.