4 ms·

I had to stop using Mullvad because so many of their IP ranges were blocked or throttled by various services, it was borderline unusable as a daily driver. Unfo

I had to stop using Mullvad because so many of their IP ranges were blocked or throttled by various services, it was borderline unusable as a daily driver. Unfortunately there isn't a good way for them to protect the reputation of their IPs when they don't collect any information that could be used to identify abusive customers, by design. Maybe retiring port forwarding will help, but their IP ranges aren't going to be removed from every shitlist out there overnight.

pierat 3y ago
To be fair, I use subscribed ProtonVPN. Same exact issues. Cloudflare gives me captchahell with infinite "click on fire hydrants or vans or bicycles or stoplights". Amazon just pretends to "site error". Numerous sites like Tiktok, JLwaters, my state's data portal, and others just give me a 403 forbidden. Other sites just load a <html></html> blank document on my VPN. And Proton is actually kind of hard to get port forwarding turned on. You can do it by adding a suffix to the OpenVPN name, or by generating a wireguard with port forwarding on. But again, I don't think it's anything to do with port forwarding per se. The current web demands deanonymization. And naturally "abuse" is blamed, even when attached to legit accounts with legit historical purchases etc.
- deleted 3y ago
  [deleted]
- Wowfunhappy 3y ago
  > And Proton is actually kind of hard to get port forwarding turned on. You can do it by adding a suffix to the OpenVPN name, or by generating a wireguard with port forwarding on. Regrettably, I suspect this does nothing for abusers, who are motivated, and instead impacts only "legitimate" customers.
- dublinben 3y ago
  Even without a VPN, the built-in tracking protection in Firefox trips Cloudflare’s bot detection every time. It’s a not-so-subtle FU for taking any steps to protect your privacy online.
  - judge2020 3y ago
    The goal is privacy, but the side effect is that you appear exactly as any spam/scraping bot out there. So website owners block this scenario and are fine that it'll likely exclude a minority of visitors who try to browse the web with maximum privacy.
    - raxxorraxor 3y ago
      True, but it still is a flaw with services like cloudflare and I don't believe their users know how many people actually get blocked. There are quite a few people that are familiar with these issues and it isn't only the technically affine.
      - Wicher 3y ago
        Users of cloudflare-ish services (site owners) may see a joyful dashboard counter that expresses "we blocked 9000 nefarious attempts this month" instead. Of course without the big fat asterisk of "actually, we have no idea what our false positive ratio is. So they could be 9000 prospective customers that we blocked." And then the customer will think "oh wow good service, all those baddies blocked, better stay in the warm embrace of this service or who knows what will happen to my site".
        judge2020 3y ago
        This is being improved by CF - if you have any "managed challenge" firewall rules on the CF dashboard, which is 'browser detection and Captcha if potential bot', it will show a Captcha Solve Rate, so hopefully site owners will adjust their firewall rule settings till the CSR is under 10% or so. https://rr.judge.sh/Screenshot%202023-05-30%20at%2011.19.52%20AM.png https://rr.judge.sh/Screenshot%202023-05-30%20at%2011.19.52%...
- VWWHFSfQ 3y ago
  > The current web demands deanonymization. And naturally "abuse" is blamed I used to work at a smallish mom-and-pop website host (do those even exist anymore?) that also offered email services. Our PF firewall just straight-up blocked huge swaths of IPv4 CIDRs because it was 99% email spam and exploit scanners. We had no ability whatsoever to fight it any other way. I don't recall even a single complaint from any of our customers.
  - wiml 3y ago
    > I don't recall even a single complaint from any of our customers Well, there are two different reasons you might not have received any complaints...
    - VWWHFSfQ 3y ago
      What are the two different reasons?
      - zdragnar 3y ago
        Nobody had a complaint to lodge because none of the emails were legitimate, or they had no means of contacting them because the were completely blocked, presumably.
- KomoD 3y ago
  ProtonVPN supports port forwarding? Had no clue!
  - pierat 3y ago
    Sure does. And it's easier with Wireguard than OVPN. I never successfully got an OpenVPN set up with proper port forwarding. It would appear to, and then just up and fail. With Wireguard, I set the port automatically with UPnP (Soulseek and torrents). Have it set up there, and works like a champ. You'll have to log in, go to Wireguard configs, set port forwarding and a P2P VPN, and download. Then do the usual with /etc/Wireguard and start it up. That's it.
- ignoramous 3y ago
  Re: Captchas: Have you had any luck with PrivacyPass? https://www.hcaptcha.com/privacy-pass https://www.hcaptcha.com/privacy-pass
  - pierat 3y ago
    Ive had no luck, cause I wasn't aware of PrivacyPass. Thank you! Looking into it now.
onetimeusename 3y ago
yes. Cloudflare seems to be aggressively blocking Mullvad and Tor and I am sure others. It started a few months ago. Meta has been blocking them for some time also. The other side of this problem is so many domains are sitting behind Cloudflare.
- mildmotive 3y ago
  Isn’t it possible for Cloudflare customers to turn off the captcha, or at the very least prevent infinite captchas?
  - onetimeusename 3y ago
    Yes, but I don't know which rules are responsible. It could be the bot management product but it could also be custom or default firewall rules. I think it's a combination of both. I don't know if the goal was to deliberately block certain exit points or if that was a side effect of some common settings meant to block bots or generic abuse.
  - joseph_grobbles 3y ago
    [dead]
- marginalia_nu 3y ago
  It's not without reason. VPN providers are (by the nature of their business) home to all sorts of shady business. Sucks that some innocent people get hassle from it, but IP reputation systems are nothing if not damn effective at preventing abuse.
aftbit 3y ago
I doubt port forwarding had anything to do with this. These IPs are on blacklists because they are used by robots and scammers to make requests, not because they are used to host malware.
iudqnolq 3y ago
I deliberately chose Mullvad because their IPs are on those blacklists. My impression is that the only way for an established, non-tiny VPN provider to have clean IPs is if they're buying residential proxys. My impression is that the only way to make the residential proxy business work at scale is either malware or unwanted misleading bundled crapware. I don't feel comfortable benefiting from a service that, at best, relies on tricking less tech savvy people into installing crapware.
- mardifoufs 3y ago
  There are ways to get residential proxies in a more ethical way these days. Some apps/extensions are now offering money for network access/network usage and they are open about what they are doing. They pay you with cash in exchange for your network, no covert VPN or sneaky SDK in unrelated apps. I think even the more ethically dubious providers are shifting towards that model. Which makes sense since they have to pay anyways.
  - iudqnolq 3y ago
    I'm skeptical even those services properly inform users about the risks and downsides. I also suspect those services turn a blind eye to resellers violating their consent policies
    - explaininjs 3y ago
      Alternatively, the users are well aware and embrace the plausible deniability it lends their own traffic.
      - iudqnolq 3y ago
        I think the experiences of people operating open relays suggest that would be a foolish assumption. If you tell a police search team you have plausible deniability they will seize all your tech and investigate you. If you're actually guilty there's a decent chance there will be other incriminating evidence. If you're innocent this will be unpleasant, expensive, and they might end up finding what they think is evidence against you anyway
raxxorraxor 3y ago
I don't use them but an alternative provider. The benefit of not collecting info is still worth the hassle. I usually have no problems to access anything aside the rare cloudflare prompt that they believe me to be a robot.

pierat 3y ago

To be fair, I use subscribed ProtonVPN. Same exact issues. Cloudflare gives me captchahell with infinite "click on fire hydrants or vans or bicycles or stoplights". Amazon just pretends to "site error". Numerous sites like Tiktok, JLwaters, my state's data portal, and others just give me a 403 forbidden. Other sites just load a <html></html> blank document on my VPN. And Proton is actually kind of hard to get port forwarding turned on. You can do it by adding a suffix to the OpenVPN name, or by generating a wireguard with port forwarding on. But again, I don't think it's anything to do with port forwarding per se. The current web demands deanonymization. And naturally "abuse" is blamed, even when attached to legit accounts with legit historical purchases etc.

deleted 3y ago
[deleted]
Wowfunhappy 3y ago
> And Proton is actually kind of hard to get port forwarding turned on. You can do it by adding a suffix to the OpenVPN name, or by generating a wireguard with port forwarding on. Regrettably, I suspect this does nothing for abusers, who are motivated, and instead impacts only "legitimate" customers.
dublinben 3y ago
Even without a VPN, the built-in tracking protection in Firefox trips Cloudflare’s bot detection every time. It’s a not-so-subtle FU for taking any steps to protect your privacy online.
- judge2020 3y ago
  The goal is privacy, but the side effect is that you appear exactly as any spam/scraping bot out there. So website owners block this scenario and are fine that it'll likely exclude a minority of visitors who try to browse the web with maximum privacy.
  - raxxorraxor 3y ago
    True, but it still is a flaw with services like cloudflare and I don't believe their users know how many people actually get blocked. There are quite a few people that are familiar with these issues and it isn't only the technically affine.
    - Wicher 3y ago
      Users of cloudflare-ish services (site owners) may see a joyful dashboard counter that expresses "we blocked 9000 nefarious attempts this month" instead. Of course without the big fat asterisk of "actually, we have no idea what our false positive ratio is. So they could be 9000 prospective customers that we blocked." And then the customer will think "oh wow good service, all those baddies blocked, better stay in the warm embrace of this service or who knows what will happen to my site".
      - judge2020 3y ago
        This is being improved by CF - if you have any "managed challenge" firewall rules on the CF dashboard, which is 'browser detection and Captcha if potential bot', it will show a Captcha Solve Rate, so hopefully site owners will adjust their firewall rule settings till the CSR is under 10% or so. https://rr.judge.sh/Screenshot%202023-05-30%20at%2011.19.52%20AM.png https://rr.judge.sh/Screenshot%202023-05-30%20at%2011.19.52%...
VWWHFSfQ 3y ago
> The current web demands deanonymization. And naturally "abuse" is blamed I used to work at a smallish mom-and-pop website host (do those even exist anymore?) that also offered email services. Our PF firewall just straight-up blocked huge swaths of IPv4 CIDRs because it was 99% email spam and exploit scanners. We had no ability whatsoever to fight it any other way. I don't recall even a single complaint from any of our customers.
- wiml 3y ago
  > I don't recall even a single complaint from any of our customers Well, there are two different reasons you might not have received any complaints...
  - VWWHFSfQ 3y ago
    What are the two different reasons?
    - zdragnar 3y ago
      Nobody had a complaint to lodge because none of the emails were legitimate, or they had no means of contacting them because the were completely blocked, presumably.
KomoD 3y ago
ProtonVPN supports port forwarding? Had no clue!
- pierat 3y ago
  Sure does. And it's easier with Wireguard than OVPN. I never successfully got an OpenVPN set up with proper port forwarding. It would appear to, and then just up and fail. With Wireguard, I set the port automatically with UPnP (Soulseek and torrents). Have it set up there, and works like a champ. You'll have to log in, go to Wireguard configs, set port forwarding and a P2P VPN, and download. Then do the usual with /etc/Wireguard and start it up. That's it.
ignoramous 3y ago
Re: Captchas: Have you had any luck with PrivacyPass? https://www.hcaptcha.com/privacy-pass https://www.hcaptcha.com/privacy-pass
- pierat 3y ago
  Ive had no luck, cause I wasn't aware of PrivacyPass. Thank you! Looking into it now.

onetimeusename 3y ago

yes. Cloudflare seems to be aggressively blocking Mullvad and Tor and I am sure others. It started a few months ago. Meta has been blocking them for some time also. The other side of this problem is so many domains are sitting behind Cloudflare.

mildmotive 3y ago
Isn’t it possible for Cloudflare customers to turn off the captcha, or at the very least prevent infinite captchas?
- onetimeusename 3y ago
  Yes, but I don't know which rules are responsible. It could be the bot management product but it could also be custom or default firewall rules. I think it's a combination of both. I don't know if the goal was to deliberately block certain exit points or if that was a side effect of some common settings meant to block bots or generic abuse.
- joseph_grobbles 3y ago
  [dead]
marginalia_nu 3y ago
It's not without reason. VPN providers are (by the nature of their business) home to all sorts of shady business. Sucks that some innocent people get hassle from it, but IP reputation systems are nothing if not damn effective at preventing abuse.

aftbit 3y ago

I doubt port forwarding had anything to do with this. These IPs are on blacklists because they are used by robots and scammers to make requests, not because they are used to host malware.

iudqnolq 3y ago

I deliberately chose Mullvad because their IPs are on those blacklists. My impression is that the only way for an established, non-tiny VPN provider to have clean IPs is if they're buying residential proxys. My impression is that the only way to make the residential proxy business work at scale is either malware or unwanted misleading bundled crapware. I don't feel comfortable benefiting from a service that, at best, relies on tricking less tech savvy people into installing crapware.

mardifoufs 3y ago
There are ways to get residential proxies in a more ethical way these days. Some apps/extensions are now offering money for network access/network usage and they are open about what they are doing. They pay you with cash in exchange for your network, no covert VPN or sneaky SDK in unrelated apps. I think even the more ethically dubious providers are shifting towards that model. Which makes sense since they have to pay anyways.
- iudqnolq 3y ago
  I'm skeptical even those services properly inform users about the risks and downsides. I also suspect those services turn a blind eye to resellers violating their consent policies
  - explaininjs 3y ago
    Alternatively, the users are well aware and embrace the plausible deniability it lends their own traffic.
    - iudqnolq 3y ago
      I think the experiences of people operating open relays suggest that would be a foolish assumption. If you tell a police search team you have plausible deniability they will seize all your tech and investigate you. If you're actually guilty there's a decent chance there will be other incriminating evidence. If you're innocent this will be unpleasant, expensive, and they might end up finding what they think is evidence against you anyway

raxxorraxor 3y ago

I don't use them but an alternative provider. The benefit of not collecting info is still worth the hassle. I usually have no problems to access anything aside the rare cloudflare prompt that they believe me to be a robot.