5 ms·

Port forwarding

100 points by mondego 3y ago

mondego 3y ago
Title: AzireVPN added port-forwarding support A potential option for Mullvad refugees?
- thepangolino 3y ago
  What happens to Mullvad?
- nik736 3y ago
  Why are there Mullvad refugees?
  - mondego 3y ago
    https://mullvad.net/en/blog/2023/5/29/removing-the-support-for-forwarded-ports/ https://mullvad.net/en/blog/2023/5/29/removing-the-support-f...
    - roncesvalles 3y ago
      Here's the thing. The most likely reason Mullvad got rid of fixed forwarded ports is that it could be used to de-anonymize their users. TFA seems to offer a solution for that problem with "Experience uncompromising privacy with AzireVPN's Blind Operator! Your port stays confidential as we don't store or log assigned ports in any database. Thanks to our secure Blind Operator backend, your assigned port remains private." Ultimately you have to take their word that it works as well as described.
      - crazygringo 3y ago
        No, they got rid of it for security/liability/reputation reasons as port forwarding makes it attractive for botnets. Port forwarding doesn't assist in deanonymization. Ultimately you either trust your VPN or you don't.
        roncesvalles 3y ago
        Mullvad had to keep a record of which port maps to which account ID and LE could subpoena that. Mullvad's whole shtick is that even if LE has 100% of the data they have, you won't be deanonymized.
        eddythompson80 3y ago
        Which is why Mullvad used to not allow auto-billing if you had portforwarding. If you wanted to use portforwarding, which Mullvad had for years, you needed to pay in advance for how much you wanted to use it. They didn’t need to keep any of your information on file, including payment stuff. Just that a particular account is paid up until a certain date. Linking a port to an account ID is possible, but there is nothing that needs to be kept about the owner of an account id either. So even LE can’t really do much with that information.
        dec0dedab0de 3y ago
        Port forwarding, or really just having any ports open at all, can definitely be used as part of fingerprinting.
        crazygringo 3y ago
        Mullvad, like many VPN's, only gives (gave) you a single port. And you're free to change that port number as often as you like if you want to avoid being fingerprinted. But fingerprinting isn't deanonymization anyways. And this is stretching the idea of "fingerprinting" in the first place -- a single port number provides the same amount of information as an IP address. With a VPN you can rotate both as often or as little as you like.
        madars 3y ago
        Small correction: Mullvad gave you 5 ports per account that you could assign (per VPN server city) to any of your 5 public keys in an arbitrary manner. E.g. 3 for one + 2 for another.
      - 111111IIIIIII 3y ago
        > Ultimately you have to take their word that it works as well as described. Compared with what other options? Mullvad does not support port forwarding. You can try to defend it all you want, but if someone needs port forwarding and your alternative does not support port forwarding then you need to find another alternative or your point is moot.
        roncesvalles 3y ago
        IMO Mullvad is the most technologically advanced VPN provider in the industry. Mullvad decided to get rid of port forwarding entirely (knowing full well the impact it would have on their revenue) instead of trying to implement the special measures that TFA spends two whole paragraphs describing.
        AwaAwa 3y ago
        Could you point to some info on why Mullvad is the most technologically advanced VPN?
        livueta 3y ago
        "Most" might be hard to prove, but they're at the forefront of using new-ish technologies like TPM/SGX to ensure their non-retention policies are workable in practice: https://news.ycombinator.com/item?id=29903695 https://news.ycombinator.com/item?id=29903695 This results in raids leaving empty-handed: https://news.ycombinator.com/item?id=35638917 https://news.ycombinator.com/item?id=35638917 This is in contrast to the flocks of VPN providers whose retention-related claims were either complete horseshit or not well-implemented.
        111111IIIIIII 3y ago
        This doesn't answer the question at all.
- Alifatisk 3y ago
  OVPN offers port forwarding. https://www.ovpn.com/en/blog/port-forwarding-with-ovpn https://www.ovpn.com/en/blog/port-forwarding-with-ovpn
  - mondego 3y ago
    Well they also sold out to Pango https://www.ovpn.com/en/blog/next-chapter-for-ovpn https://www.ovpn.com/en/blog/next-chapter-for-ovpn
    - Alifatisk 3y ago
      That tells me nothing, is it bad?
  - patrakov 3y ago
    They also offer static public IPs as an add-on, making port forwarding unnecessary if you agree to give up the bit of privacy that comes from the shared IPs.
a2128 3y ago
On the home page they have a comparison table with other VPN providers, including Mullvad. One of the comparisons is "Require no Personal Data on sign up" and it's a green checkmark for both themselves and Mullvad. Yet when I click sign up, I get asked for a username, an optional email, and password. To imply this is on the same level as Mullvad, where you're already done when you click sign up, feels a bit disingenuous.
- eddythompson80 3y ago
  Nah, that’s just semantics at this point. Mullvad runs the “random user generator” function for you and just gives you a random number. This lets you run that random generator yourself. If you’re concerned about personal information, the final result is the same. Mullvad makes it so that you can’t even accidentally give them information they don’t need. This leaves it up to your own discretion. I don’t think it’s disingenuous.
  - InCityDreams 3y ago
    >Nah, that’s just semantics at this point. You talking about the green checkmark?
    - immanentize 3y ago
      He's talking about the distinction - anybody concerned with privacy should probably be capable of producing or otherwise finding a random username and password.
  - a2128 3y ago
    I don't think such important data should be left up to the user's discretion by a supposedly privacy-focused company. If they're okay with allowing users to enter a personal username, email address, and a password that's probably not unique, and if the attitude is "privacy-concerned people should just know xyz" then I have to wonder what other things they apply this attitude to
    - 3y ago
anderspitman 3y ago
The most interesting thing to me about this is that apparently they offer an HTTP API for their VPN service. But I haven't been able to find any documentation for it. Are there any VPN providers that offer an OAuth2 API that would let you set up VPN tunnels on behalf of users?
- DaiPlusPlus 3y ago
  Why is it important they use OAuth2 specifically?
  - anderspitman 3y ago
    It's not other than OAuth2 is the de facto standard for doing this sort of thing, for better or for worse. You could use a different protocol but developers are less likely to integrate with it.
CommitSyn 3y ago
I wish more VPN services offered multihop. I know of Mullvad (no more port forwarding), Perfect Privacy (slow), NordVPN (no port forwarding afaik) Who else offers multihop+port forwarding?
- tadfisher 3y ago
  Private Internet Access, through a semi-documented API. I have a NixOS module here: https://github.com/tadfisher/flake/blob/main/nixos/modules/pia-vpn.nix https://github.com/tadfisher/flake/blob/main/nixos/modules/p...
- LinuxBender 3y ago
  Another multi-hop would be the open source tinc-vpn [1] software. It performs dynamic mesh routing in user space. The trade-off is that you and/or your friends would need to run each hop. Some hacker groups did this in the past but they would grow their circle of trust too big and didn't last. It worked great for me for decades and routed around numerous internet outages. It's not as performant as Wireguard but I see no reason the lead developer could not integrate it into wg for the tun device. [1] - https://www.tinc-vpn.org/ https://www.tinc-vpn.org/
- madars 3y ago
  It is worth noting that not all implementations of multihop are the same. For example, if multihop is using a dedicated port on the entry node (e.g. connecting to any Mullvad server on port 3438 will give you a multihop through that server to se-sto-wg-001), someone can who observe your traffic to the entry server (e.g., your ISP) can immediately figure out the exit server because entry port<->exit server mapping is public. Double-tunneling (i.e. having a VPN connection inside an outer VPN connection) doesn't have the same problem but reduces MTU.
  - fruitreunion1 3y ago
    The mullvad app does multihop in a more secure way than what their help page says for manual wireguard, but it's not documented anywhere else so you have to read the source code of the app. I wish they would make that more clear or add documentation for the more secure way.
xony 3y ago
Mullvad move is cost cutting move .. no technology behind it , You need public IP's to forward and it is expansive

Port forwarding

100 points by mondego 3y ago

mondego 3y ago

Title: AzireVPN added port-forwarding support A potential option for Mullvad refugees?

thepangolino 3y ago
What happens to Mullvad?
nik736 3y ago
Why are there Mullvad refugees?
- mondego 3y ago
  https://mullvad.net/en/blog/2023/5/29/removing-the-support-for-forwarded-ports/ https://mullvad.net/en/blog/2023/5/29/removing-the-support-f...
  - roncesvalles 3y ago
    Here's the thing. The most likely reason Mullvad got rid of fixed forwarded ports is that it could be used to de-anonymize their users. TFA seems to offer a solution for that problem with "Experience uncompromising privacy with AzireVPN's Blind Operator! Your port stays confidential as we don't store or log assigned ports in any database. Thanks to our secure Blind Operator backend, your assigned port remains private." Ultimately you have to take their word that it works as well as described.
    - crazygringo 3y ago
      No, they got rid of it for security/liability/reputation reasons as port forwarding makes it attractive for botnets. Port forwarding doesn't assist in deanonymization. Ultimately you either trust your VPN or you don't.
      - roncesvalles 3y ago
        Mullvad had to keep a record of which port maps to which account ID and LE could subpoena that. Mullvad's whole shtick is that even if LE has 100% of the data they have, you won't be deanonymized.
        eddythompson80 3y ago
        Which is why Mullvad used to not allow auto-billing if you had portforwarding. If you wanted to use portforwarding, which Mullvad had for years, you needed to pay in advance for how much you wanted to use it. They didn’t need to keep any of your information on file, including payment stuff. Just that a particular account is paid up until a certain date. Linking a port to an account ID is possible, but there is nothing that needs to be kept about the owner of an account id either. So even LE can’t really do much with that information.
      - dec0dedab0de 3y ago
        Port forwarding, or really just having any ports open at all, can definitely be used as part of fingerprinting.
        crazygringo 3y ago
        Mullvad, like many VPN's, only gives (gave) you a single port. And you're free to change that port number as often as you like if you want to avoid being fingerprinted. But fingerprinting isn't deanonymization anyways. And this is stretching the idea of "fingerprinting" in the first place -- a single port number provides the same amount of information as an IP address. With a VPN you can rotate both as often or as little as you like.
        madars 3y ago
        Small correction: Mullvad gave you 5 ports per account that you could assign (per VPN server city) to any of your 5 public keys in an arbitrary manner. E.g. 3 for one + 2 for another.
    - 111111IIIIIII 3y ago
      > Ultimately you have to take their word that it works as well as described. Compared with what other options? Mullvad does not support port forwarding. You can try to defend it all you want, but if someone needs port forwarding and your alternative does not support port forwarding then you need to find another alternative or your point is moot.
      - roncesvalles 3y ago
        IMO Mullvad is the most technologically advanced VPN provider in the industry. Mullvad decided to get rid of port forwarding entirely (knowing full well the impact it would have on their revenue) instead of trying to implement the special measures that TFA spends two whole paragraphs describing.
        AwaAwa 3y ago
        Could you point to some info on why Mullvad is the most technologically advanced VPN?
        livueta 3y ago
        "Most" might be hard to prove, but they're at the forefront of using new-ish technologies like TPM/SGX to ensure their non-retention policies are workable in practice: https://news.ycombinator.com/item?id=29903695 https://news.ycombinator.com/item?id=29903695 This results in raids leaving empty-handed: https://news.ycombinator.com/item?id=35638917 https://news.ycombinator.com/item?id=35638917 This is in contrast to the flocks of VPN providers whose retention-related claims were either complete horseshit or not well-implemented.
        111111IIIIIII 3y ago
        This doesn't answer the question at all.
Alifatisk 3y ago
OVPN offers port forwarding. https://www.ovpn.com/en/blog/port-forwarding-with-ovpn https://www.ovpn.com/en/blog/port-forwarding-with-ovpn
- mondego 3y ago
  Well they also sold out to Pango https://www.ovpn.com/en/blog/next-chapter-for-ovpn https://www.ovpn.com/en/blog/next-chapter-for-ovpn
  - Alifatisk 3y ago
    That tells me nothing, is it bad?
- patrakov 3y ago
  They also offer static public IPs as an add-on, making port forwarding unnecessary if you agree to give up the bit of privacy that comes from the shared IPs.

a2128 3y ago

On the home page they have a comparison table with other VPN providers, including Mullvad. One of the comparisons is "Require no Personal Data on sign up" and it's a green checkmark for both themselves and Mullvad. Yet when I click sign up, I get asked for a username, an optional email, and password. To imply this is on the same level as Mullvad, where you're already done when you click sign up, feels a bit disingenuous.

eddythompson80 3y ago
Nah, that’s just semantics at this point. Mullvad runs the “random user generator” function for you and just gives you a random number. This lets you run that random generator yourself. If you’re concerned about personal information, the final result is the same. Mullvad makes it so that you can’t even accidentally give them information they don’t need. This leaves it up to your own discretion. I don’t think it’s disingenuous.
- InCityDreams 3y ago
  >Nah, that’s just semantics at this point. You talking about the green checkmark?
  - immanentize 3y ago
    He's talking about the distinction - anybody concerned with privacy should probably be capable of producing or otherwise finding a random username and password.
- a2128 3y ago
  I don't think such important data should be left up to the user's discretion by a supposedly privacy-focused company. If they're okay with allowing users to enter a personal username, email address, and a password that's probably not unique, and if the attitude is "privacy-concerned people should just know xyz" then I have to wonder what other things they apply this attitude to
  - 3y ago

anderspitman 3y ago

The most interesting thing to me about this is that apparently they offer an HTTP API for their VPN service. But I haven't been able to find any documentation for it. Are there any VPN providers that offer an OAuth2 API that would let you set up VPN tunnels on behalf of users?

DaiPlusPlus 3y ago
Why is it important they use OAuth2 specifically?
- anderspitman 3y ago
  It's not other than OAuth2 is the de facto standard for doing this sort of thing, for better or for worse. You could use a different protocol but developers are less likely to integrate with it.

CommitSyn 3y ago

I wish more VPN services offered multihop. I know of Mullvad (no more port forwarding), Perfect Privacy (slow), NordVPN (no port forwarding afaik) Who else offers multihop+port forwarding?

tadfisher 3y ago
Private Internet Access, through a semi-documented API. I have a NixOS module here: https://github.com/tadfisher/flake/blob/main/nixos/modules/pia-vpn.nix https://github.com/tadfisher/flake/blob/main/nixos/modules/p...
LinuxBender 3y ago
Another multi-hop would be the open source tinc-vpn [1] software. It performs dynamic mesh routing in user space. The trade-off is that you and/or your friends would need to run each hop. Some hacker groups did this in the past but they would grow their circle of trust too big and didn't last. It worked great for me for decades and routed around numerous internet outages. It's not as performant as Wireguard but I see no reason the lead developer could not integrate it into wg for the tun device. [1] - https://www.tinc-vpn.org/ https://www.tinc-vpn.org/
madars 3y ago
It is worth noting that not all implementations of multihop are the same. For example, if multihop is using a dedicated port on the entry node (e.g. connecting to any Mullvad server on port 3438 will give you a multihop through that server to se-sto-wg-001), someone can who observe your traffic to the entry server (e.g., your ISP) can immediately figure out the exit server because entry port<->exit server mapping is public. Double-tunneling (i.e. having a VPN connection inside an outer VPN connection) doesn't have the same problem but reduces MTU.
- fruitreunion1 3y ago
  The mullvad app does multihop in a more secure way than what their help page says for manual wireguard, but it's not documented anywhere else so you have to read the source code of the app. I wish they would make that more clear or add documentation for the more secure way.

xony 3y ago

Mullvad move is cost cutting move .. no technology behind it , You need public IP's to forward and it is expansive