7 ms·

I really respect how Mullvad is willing to sacrifice business to give extra security and reliability to the (remaining) customers. I first saw it when they disa

I really respect how Mullvad is willing to sacrifice business to give extra security and reliability to the (remaining) customers. I first saw it when they disabled auto-renewal with PayPal, because it'd force them to store PII along with your account. Unfortunately for me, they made one too many sacrifices, and disabled port forwarding[1]. They don't store any contact information that could be used to warn customers, so my connection mysteriously failed one day and I was left with several months of prepaid service. I'm a bit bitter for that, but honestly their technical writing and security decisions have earned enough good will from me that I want them to keep the money. As the only VPN that doesn't feel shady, I wish them all the best. [1] https://mullvad.net/en/blog/2023/5/29/removing-the-support-for-forwarded-ports/ https://mullvad.net/en/blog/2023/5/29/removing-the-support-f...

pteraspidomorph 3y ago
I'm glad to read this. We considered switching to them earlier this year (couldn't find the budget) and it was still on the table, but this is a deal breaker. If we'd switched I'd have been in the same situation, with a lot of prepaid service I couldn't use as intended.
- BoppreH 3y ago
  To be fair, the announcement came with the option of asking for refunds, and I have no reason to doubt them. My few interactions with their support were pretty good.
asynchronous 3y ago
They still support opening up ports, it’s just randomized instead of dedicated like uPnP.
- nabogh 3y ago
  Oh really? Could you elaborate or point me in the direction of more information on this please?
  - asynchronous 3y ago
    https://mullvad.net/en/account/wireguard-config https://mullvad.net/en/account/wireguard-config In the wireguard config section of their tutorials, there’s a spot to put a custom port - it’s really unclear from the docs but this allows you to expose out a service within the higher limits of the port ranges, and only on dedicated servers. Really hard to find but they call this “city ports” over global ports because you have to set them up beforehand.
    - Hakkin 3y ago
      The "custom port" option in the config creator just sets the endpoint port to use for Wireguard. It has nothing to do with port forwarding.
- internet-mat 3y ago
  This isn’t true, Mullvad completely disabled port forwarding earlier this year. See: https://mullvad.net/en/blog/2023/5/29/removing-the-support-for-forwarded-ports/ https://mullvad.net/en/blog/2023/5/29/removing-the-support-f...
  - asynchronous 3y ago
    I’m confused, the blog post backs up what you say but I can still set custom ports within my account page… And I’m currently running a service that needs to advertise out on a port to work from Mullvad.
    - fruitreunion1 3y ago
      I don't want to revoke a key to test but I'm pretty sure that just sets the port in the Endpoint part of the WireGuard config file. (the port you use to connect, for if the regular one is blocked). Are you sure your service behind Mullvad is accepting incoming connections?
    - piaste 3y ago
      Is it a torrent client, by any chance? Those can still work without port forwarding, if the swarm member you're sharing data with (regardless of direction) has an open port on their side. Try creating a new torrent with some random file, seeding it from a Mullvad device and downloading it from a different Mullvad device. That should only work if you have port forwarding set up (or if you're not actually going through Mullvad - you will see that by the peer IP in the torrent client).
    - electroly 3y ago
      That custom port on the WireGuard config page is not the place where you'd configure port forwarding; that's not what that is. They had a separate port forwarding page for configuring city ports which is now gone. But you say you have it working. My guess is that you're just misremembering where the configuration is, and that Mullvad hasn't removed existing port forwards yet like they said they would.
iaresee 3y ago
Have you found a replacement? I did some light investigation but nothing really felt as solid as Mullvad so I haven't jumped ship yet.
- irusensei 3y ago
  Not that person but I've spinned a 1984 instance paid with bitcoin without KYC. Then setup nat+rdr rules that foward to my service through a wireguard tunnel.
  - iaresee 3y ago
    This might be the way I go. Thanks.
  - mandelken 3y ago
    Forgive my ignorance, but what’s a “1984 instance”? (Google could not help me.) Thanks!
    - skulk 3y ago
      I googled "1984 vps" and came up with http://1984.hosting/ http://1984.hosting/. I have no idea if this is what GP is referring to.
    - denton-scratch 3y ago
      Oh, I think that used to be 1984.is. Nice people, hydro powered, cooled by ice, strong privacy posture.
  - codedokode 3y ago
    Why use wireguard? It is trivially to detect by the ISP or government. Every decent VPN should masquerade as HTTP/2 or HTTP/3.
- BoppreH 3y ago
  None as solid, no. My needs are fairly specific (exit node in a specific country, torrent-friendly, good speed, not too expensive, not too shady, first-party support for my OS'es, doesn't have to be government-proof), so you'll need to do your own research. For what's worth, I eventually went with Proton VPN, but it's more expensive and gives a used-car-salesman feeling.
jjice 3y ago
I use IVPN and they also deprecated port forwarding. I believe they didn't cut people off directly but if you stop using it you can restart using it. I wonder if they removed it for the same reason.
2OEH8eoCRo0 3y ago
The discontinuation of port forwarding forced me to leave which is unfortunate because they are excellent.
hunter2_ 3y ago
> They don't store any contact information that could be used to warn customers, so my connection mysteriously failed one day This situation seems avoidable: what if the payment/signup flow had a big loud warning that you need to configure your own polling of an RSS endpoint using a client capable of pinging you?
- noahjk 3y ago
  That's honestly a great idea for an alternative to newsletters... it would be nice if there was better first-party RSS support (what about in the email client?) since I don't think any OSs have it, because right now that would probably confuse most customers
  - headsman771 3y ago
    The likelihood of being confused by rss among mullvad customers can't be very high.
    - chefandy 3y ago
      You might be surprised! The Mullvad client is super well designed and usable for newbs, and I'll bet a lot of their business is from people whose more technical friends told them it was a good idea. There's a reason that Tor warns users that posting personal information or using accounts with their regular credentials compromises anonymity. I wish RSS had more surface area with general computer users, but I reckon even being called RSS makes it unlikely. Folks in tech often forget how intimidating opaque names can be for nontechnical users.
      - hunter2_ 3y ago
        Not being a Mullvad user myself, I wasn't sure if people tend to use a Mullvad client or a generic VPN stack built into their OS, but the Mullvad client could simply display news like this to the former set of users leaving only the latter set to configure a separate RSS client or whatever.
- 3y ago
pixelatedindex 3y ago
I’m a network newbie so I have no idea about the importance of this. I have done port forwarding in my router before, mainly so I can access my Plex system outside of my house. I used to setup port forwarding when torrenting but I have realized that I can still get my Linux ISOs without it. I never cared even though I’m a heavy user of their product. When will it start to affect me, or in other words, what use cases am I locked out of when port forwarding is disabled?
- duozerk 3y ago
  You'd need that feature if you desired to host an actual service (a webserver for example) behind the VPN
  - pixelatedindex 3y ago
    Oh!! That makes a ton of sense now, I feel dumb for not thinking about that since I was just doing some config changes for Docker services running in my home server. I realized I couldn’t access it from another machine because the Dockerfile didn’t have ports forwarded appropriately. Thank you very much!
- deleted 3y ago
  [deleted]
- treyd 3y ago
  Your torrent client probably uses UPnP to have your router selectively open ports to your machine for the duration of the session.
riley_dog 3y ago
After they disabled port forwarding, I moved to ProtonVPN. They seem like the next best thing, and they continue to state that they have no intention of removing port forwarding (for now, I assume).
kfreds 3y ago
I sincerely apologize for the inconvenience we have caused you. Announcing the removal of a feature such as this a mere 30 days ahead is not how we like to conduct our business in the general case. I expect those of our customers who relied on this feature to be disappointed by its removal as well as the manner in which it was done. Nevertheless it was the right thing to do. The manner and extent in which it came to be abused in recent months made it unacceptable for us to continue providing it. This feature should have been removed a long time ago, with a longer grace period. It wasn't - a mistake on our part - and some of our users suffered for it, including you. For this I am sorry. Affected customers can get their money back for any prepaid service they can not use, of course. If you used port forwarding to (I) make a service reachable (II) from the open Internet there are plenty of good hosting providers which will happily take your business. If you used port forwarding to (III) stay anonymous while (I) making a service reachable we can highly recommend Tor's "onion service" feature. It was built with that use case in mind. If you used port forwarding to (III) stay anonymous while (I) making a service reachable (II) from the open Internet, there are no good options that we can recommend. Port forwarding needed to be removed on moral grounds. It needed to be removed because it was causing too much of a disturbance to our core mission of making mass surveillance and censorship ineffective. I hope my explanation has - if not allayed your disappointment - at least provided some clarity. Best regards, Fredrik Stromberg (cofounder of Mullvad VPN)
- treesciencebot 3y ago
  What sort of abuses you have encountered when dealing with port forwarding? Was it DMCA'd content hosting or were there other major issues with it? Also how does other VPNs that offer port forwarding (like Proton) function against those sort of abuses?
  - alwyn 3y ago
    They give some examples of things bad actors used port forwarding for in the blog post[1] announcing the removal of the feature. [1]: https://mullvad.net/en/blog/2023/5/29/removing-the-support-for-forwarded-ports/ https://mullvad.net/en/blog/2023/5/29/removing-the-support-f...
darkwater 3y ago
What are legitimate use case to use port-forwarding behind a VPN IP? Genuinely curious, I'm not implying anything. The main use-case is hosting something for which you don't want to reveal your IP or circumvent some ISP that block hosting web servers on their residential IPs. I'm sure I'm missing many more use cases.
- morpheuskafka 3y ago
  I have been out of the loop for a while on this, but doesn't BitTorrent require you to set up a port forward? Otherwise you can only connect to peers that do, but not other peers that don't.
  - codedokode 3y ago
    I think it is possible to connect using STUN even if both users are behind NAT.
- rand846633 3y ago
  Can be used for hosting libgen/sci-hub. Basically you have a thin proxy on some not so cheap but ‘anonymous’ Bitcoin payed VM, that then (http) links to your vpn endpoint. You need the dual setup as using the btc vm for storage of terabytes of data as well as for TB of traffic is too expensive for a volunteer run project.
pipes 3y ago
Becoming well known for always trying to put customers first is a good strategy and probably makes business sense in the long run. I have used mullvad for years. I have no intention of shifting provider. Mainly because the evidence is starting to stack up that they are one of the few good actors in a cess pit of shitty/shady competition. (Though it's a shane mullvad gets blocked by netflix, well the last time I tried it wasn't working). The only other service I have any brand loyalty to gog.com. For some reason I feel the same about them.

pteraspidomorph 3y ago

I'm glad to read this. We considered switching to them earlier this year (couldn't find the budget) and it was still on the table, but this is a deal breaker. If we'd switched I'd have been in the same situation, with a lot of prepaid service I couldn't use as intended.

BoppreH 3y ago
To be fair, the announcement came with the option of asking for refunds, and I have no reason to doubt them. My few interactions with their support were pretty good.

asynchronous 3y ago

They still support opening up ports, it’s just randomized instead of dedicated like uPnP.

nabogh 3y ago
Oh really? Could you elaborate or point me in the direction of more information on this please?
- asynchronous 3y ago
  https://mullvad.net/en/account/wireguard-config https://mullvad.net/en/account/wireguard-config In the wireguard config section of their tutorials, there’s a spot to put a custom port - it’s really unclear from the docs but this allows you to expose out a service within the higher limits of the port ranges, and only on dedicated servers. Really hard to find but they call this “city ports” over global ports because you have to set them up beforehand.
  - Hakkin 3y ago
    The "custom port" option in the config creator just sets the endpoint port to use for Wireguard. It has nothing to do with port forwarding.
internet-mat 3y ago
This isn’t true, Mullvad completely disabled port forwarding earlier this year. See: https://mullvad.net/en/blog/2023/5/29/removing-the-support-for-forwarded-ports/ https://mullvad.net/en/blog/2023/5/29/removing-the-support-f...
- asynchronous 3y ago
  I’m confused, the blog post backs up what you say but I can still set custom ports within my account page… And I’m currently running a service that needs to advertise out on a port to work from Mullvad.
  - fruitreunion1 3y ago
    I don't want to revoke a key to test but I'm pretty sure that just sets the port in the Endpoint part of the WireGuard config file. (the port you use to connect, for if the regular one is blocked). Are you sure your service behind Mullvad is accepting incoming connections?
  - piaste 3y ago
    Is it a torrent client, by any chance? Those can still work without port forwarding, if the swarm member you're sharing data with (regardless of direction) has an open port on their side. Try creating a new torrent with some random file, seeding it from a Mullvad device and downloading it from a different Mullvad device. That should only work if you have port forwarding set up (or if you're not actually going through Mullvad - you will see that by the peer IP in the torrent client).
  - electroly 3y ago
    That custom port on the WireGuard config page is not the place where you'd configure port forwarding; that's not what that is. They had a separate port forwarding page for configuring city ports which is now gone. But you say you have it working. My guess is that you're just misremembering where the configuration is, and that Mullvad hasn't removed existing port forwards yet like they said they would.

iaresee 3y ago

Have you found a replacement? I did some light investigation but nothing really felt as solid as Mullvad so I haven't jumped ship yet.

irusensei 3y ago
Not that person but I've spinned a 1984 instance paid with bitcoin without KYC. Then setup nat+rdr rules that foward to my service through a wireguard tunnel.
- iaresee 3y ago
  This might be the way I go. Thanks.
- mandelken 3y ago
  Forgive my ignorance, but what’s a “1984 instance”? (Google could not help me.) Thanks!
  - skulk 3y ago
    I googled "1984 vps" and came up with http://1984.hosting/ http://1984.hosting/. I have no idea if this is what GP is referring to.
  - denton-scratch 3y ago
    Oh, I think that used to be 1984.is. Nice people, hydro powered, cooled by ice, strong privacy posture.
- codedokode 3y ago
  Why use wireguard? It is trivially to detect by the ISP or government. Every decent VPN should masquerade as HTTP/2 or HTTP/3.
BoppreH 3y ago
None as solid, no. My needs are fairly specific (exit node in a specific country, torrent-friendly, good speed, not too expensive, not too shady, first-party support for my OS'es, doesn't have to be government-proof), so you'll need to do your own research. For what's worth, I eventually went with Proton VPN, but it's more expensive and gives a used-car-salesman feeling.

jjice 3y ago

I use IVPN and they also deprecated port forwarding. I believe they didn't cut people off directly but if you stop using it you can restart using it. I wonder if they removed it for the same reason.

2OEH8eoCRo0 3y ago

The discontinuation of port forwarding forced me to leave which is unfortunate because they are excellent.

hunter2_ 3y ago

> They don't store any contact information that could be used to warn customers, so my connection mysteriously failed one day This situation seems avoidable: what if the payment/signup flow had a big loud warning that you need to configure your own polling of an RSS endpoint using a client capable of pinging you?

noahjk 3y ago
That's honestly a great idea for an alternative to newsletters... it would be nice if there was better first-party RSS support (what about in the email client?) since I don't think any OSs have it, because right now that would probably confuse most customers
- headsman771 3y ago
  The likelihood of being confused by rss among mullvad customers can't be very high.
  - chefandy 3y ago
    You might be surprised! The Mullvad client is super well designed and usable for newbs, and I'll bet a lot of their business is from people whose more technical friends told them it was a good idea. There's a reason that Tor warns users that posting personal information or using accounts with their regular credentials compromises anonymity. I wish RSS had more surface area with general computer users, but I reckon even being called RSS makes it unlikely. Folks in tech often forget how intimidating opaque names can be for nontechnical users.
    - hunter2_ 3y ago
      Not being a Mullvad user myself, I wasn't sure if people tend to use a Mullvad client or a generic VPN stack built into their OS, but the Mullvad client could simply display news like this to the former set of users leaving only the latter set to configure a separate RSS client or whatever.
3y ago

pixelatedindex 3y ago

I’m a network newbie so I have no idea about the importance of this. I have done port forwarding in my router before, mainly so I can access my Plex system outside of my house. I used to setup port forwarding when torrenting but I have realized that I can still get my Linux ISOs without it. I never cared even though I’m a heavy user of their product. When will it start to affect me, or in other words, what use cases am I locked out of when port forwarding is disabled?

duozerk 3y ago
You'd need that feature if you desired to host an actual service (a webserver for example) behind the VPN
- pixelatedindex 3y ago
  Oh!! That makes a ton of sense now, I feel dumb for not thinking about that since I was just doing some config changes for Docker services running in my home server. I realized I couldn’t access it from another machine because the Dockerfile didn’t have ports forwarded appropriately. Thank you very much!
deleted 3y ago
[deleted]
treyd 3y ago
Your torrent client probably uses UPnP to have your router selectively open ports to your machine for the duration of the session.

riley_dog 3y ago

After they disabled port forwarding, I moved to ProtonVPN. They seem like the next best thing, and they continue to state that they have no intention of removing port forwarding (for now, I assume).

kfreds 3y ago

I sincerely apologize for the inconvenience we have caused you. Announcing the removal of a feature such as this a mere 30 days ahead is not how we like to conduct our business in the general case. I expect those of our customers who relied on this feature to be disappointed by its removal as well as the manner in which it was done. Nevertheless it was the right thing to do. The manner and extent in which it came to be abused in recent months made it unacceptable for us to continue providing it. This feature should have been removed a long time ago, with a longer grace period. It wasn't - a mistake on our part - and some of our users suffered for it, including you. For this I am sorry. Affected customers can get their money back for any prepaid service they can not use, of course. If you used port forwarding to (I) make a service reachable (II) from the open Internet there are plenty of good hosting providers which will happily take your business. If you used port forwarding to (III) stay anonymous while (I) making a service reachable we can highly recommend Tor's "onion service" feature. It was built with that use case in mind. If you used port forwarding to (III) stay anonymous while (I) making a service reachable (II) from the open Internet, there are no good options that we can recommend. Port forwarding needed to be removed on moral grounds. It needed to be removed because it was causing too much of a disturbance to our core mission of making mass surveillance and censorship ineffective. I hope my explanation has - if not allayed your disappointment - at least provided some clarity. Best regards, Fredrik Stromberg (cofounder of Mullvad VPN)

treesciencebot 3y ago
What sort of abuses you have encountered when dealing with port forwarding? Was it DMCA'd content hosting or were there other major issues with it? Also how does other VPNs that offer port forwarding (like Proton) function against those sort of abuses?
- alwyn 3y ago
  They give some examples of things bad actors used port forwarding for in the blog post[1] announcing the removal of the feature. [1]: https://mullvad.net/en/blog/2023/5/29/removing-the-support-for-forwarded-ports/ https://mullvad.net/en/blog/2023/5/29/removing-the-support-f...

darkwater 3y ago

What are legitimate use case to use port-forwarding behind a VPN IP? Genuinely curious, I'm not implying anything. The main use-case is hosting something for which you don't want to reveal your IP or circumvent some ISP that block hosting web servers on their residential IPs. I'm sure I'm missing many more use cases.

morpheuskafka 3y ago
I have been out of the loop for a while on this, but doesn't BitTorrent require you to set up a port forward? Otherwise you can only connect to peers that do, but not other peers that don't.
- codedokode 3y ago
  I think it is possible to connect using STUN even if both users are behind NAT.
rand846633 3y ago
Can be used for hosting libgen/sci-hub. Basically you have a thin proxy on some not so cheap but ‘anonymous’ Bitcoin payed VM, that then (http) links to your vpn endpoint. You need the dual setup as using the btc vm for storage of terabytes of data as well as for TB of traffic is too expensive for a volunteer run project.

pipes 3y ago

Becoming well known for always trying to put customers first is a good strategy and probably makes business sense in the long run. I have used mullvad for years. I have no intention of shifting provider. Mainly because the evidence is starting to stack up that they are one of the few good actors in a cess pit of shitty/shady competition. (Though it's a shane mullvad gets blocked by netflix, well the last time I tried it wasn't working). The only other service I have any brand loyalty to gog.com. For some reason I feel the same about them.