5 ms·
I use a VPN for much of my private traffic. Here is where I differ from the article's recommendations, and why: - I don't recommend rolling your own on EC2: pi
by chrismonsanto 13y ago
I use a VPN for much of my private traffic. Here is where I differ from the article's recommendations, and why:
- I don't recommend rolling your own on EC2: pick a VPN with a good reputation and a policy of not retaining logs. See: http://torrentfreak.com/vpn-services-that-take-your-anonymity-seriously-2013-edition-130302/ http://torrentfreak.com/vpn-services-that-take-your-anonymit... (you don't have to use torrents to need a VPN, btw!!)
- I recommend using a Debian VM w/ OpenVPN for your private traffic. That way, 'am I using my VM?' is a quick test for whether your traffic is private or public.
- I can't stress this enough: _be sure to firewall your VM from any traffic not to your VPN provider_. If OpenVPN drops its connection, it will fallback to sending packets normally! At least if you firewall, your connection will just die, instead of potentially sending private traffic in the clear. The article doesn't mention this, and it should.
- Be sure not to log in to your usual services on your VPN, or there is a possibility that someone can connect your real traffic and your VPN traffic. I use LastPass with random passwords to manage all of my accounts, so I solve this problem by simply not installing LastPass on my VM, which makes logging in a very deliberate action on my VM.
- IvyMike 13y agoI agree with the "don't roll your own" VPN suggestion--I personally signed up with Private Internet Access and haven't looked back since. But I have a question about this: "be sure to firewall your VM from any traffic not to your VPN provider." Is there a good generic way to do this on Windows? I've looked around and it's never very clear. I think the PIA client has a "VPN kill switch" that should effectively do the same thing, but not all VPN providers have a client.
- chrismonsanto 13y agoIf you are using a VM like I suggested, you can do this inside the VM instead of messing around with Windows. See this post: https://news.ycombinator.com/item?id=6285837 https://news.ycombinator.com/item?id=6285837 Unfortunately I don't use Windows, so I don't know how to firewall from it.
- rasengan 13y agoHere is a pre-configured VM: https://www.privateinternetaccess.com/forum/index.php?p=/discussion/1389/pia-tunnel-a-virtual-machine-vpn-tunnel https://www.privateinternetaccess.com/forum/index.php?p=/dis...
- cheeze 13y agoIs PIA completely offshore?
- arthulia 13y agoFTA "2. Our company currently operates out of the United States with gigabit gateways in the US, Canada, Germany, France, UK, Switzerland, Sweden, the Netherlands and Romania. We chose the US, since it is one of the few countries without a mandatory data retention law. We will not share any information with third parties without a valid court order. With that said, it is impossible to match a user to any activity on our system since we utilize shared IPs and maintain absolutely no logs."
- IvyMike 13y agoI view it as defense against hotel or coffee shop wifi hackers. If you have a threat matrix that includes governments or maybe even large corporations, it's definitely not for you. But c'mon, for $4 a month or whatever, what do you expect?
- mehmehshoe 13y agoI have used PIA for 6 months or so, the business being US based has worried me. Speeds have been good so far and the pricing is great. I have a question for Linux users with more experience than I. Has anyone wrote a script that could tell if the openvpn connection has been cut, then just kill eth0 automatically?
- rasengan 13y agoHere is a script for linux: https://www.privateinternetaccess.com/forum/index.php?p=/discussion/1151/pia-iptables-manager-new/p1 https://www.privateinternetaccess.com/forum/index.php?p=/dis...
- mehmehshoe 13y agoThank you! File hosted on Mega...hah!
- voltagex_ 13y agoWatch out for IPv6 on Windows. I have a PPTP VPN through StrongVPN and the IPv6 interface is unaffected. Unfortunately there doesn't seem to be a way to programmatically disable it.
- coderrr 13y agoIf you use PIA our Windows (and OSX) app has a feature (on by default) which blocks IPv6 while you're on the VPN. https://www.privateinternetaccess.com/pages/client-support/#ipv6leak https://www.privateinternetaccess.com/pages/client-support/#...
- voltagex_ 13y agoJust after I pay for a year of StrongVPN...
- Ecio78 13y agoI was going to post this link for disabling ipv6 http://support.microsoft.com/kb/929852/en-us http://support.microsoft.com/kb/929852/en-us then I read the word "programmatically".. then I was going to suggest using "netsh" but it seems you can't use it to disable IPv6, finally I found that you can modify the registry as illustrated here: http://technet.microsoft.com/en-us/library/bb878057.aspx http://technet.microsoft.com/en-us/library/bb878057.aspx (i.e. with a script launching reg.exe) but then I read that it should require reboot (damn Microsoft..)
- sillysaurus2 13y agoHow do you firewall your connection from any traffic not to your VPN provider?
- rfnslyr 13y agoI'd kill for a solid in depth write up if someone is willing to put one together. I don't know anything about this kind of stuff but it's piqued my interest lately.
- chrismonsanto 13y agoA lot of people have asked me for pointers to write-ups, but there don't appear to be any comprehensive ones on the Internet. When I setup all of this, I had to learn from piecing together information from various tutorials and reading manuals and what not. I have been meaning for a while now to make a mini distribution of Linux that works well for VPN usage out of the box. If people are interested in this sort of thing, maybe I could try to make time for it.
- newman314 13y agoYes, please. I would love to see a VM that I can just spin up that allows for an IPSec tunnel to terminate to it in a road-warrior config. FWIW, here is what I have so far. http://superuser.com/questions/553193/how-do-i-configure-dd-wrt-to-forward-ipsec-traffic-to-an-internal-server-to-supp http://superuser.com/questions/553193/how-do-i-configure-dd-...
- kefka 13y agoOn Windows, you can use WIPFW and make the appropriate rules. Works like a charm, and hard as hell to detect using standard windows tools.
- _rs 13y agoOn Mac I used this resource to block traffic with the exception of UDP and on the ppp0 interface: http://superuser.com/questions/468919/prevent-outgoing-traffic-unless-openvpn-connection-is-active-using-pf-conf-on-ma http://superuser.com/questions/468919/prevent-outgoing-traff...
- pbhjpbhj 13y ago>If OpenVPN drops its connection, it will fallback to sending packets normally! // This seems to be a bug in network setups - surely it's highly desirable to be able to control which route traffic takes and whether fallback to a different connection occurs or not.
- chrismonsanto 13y agoOn Debian 6, the default behavior is to do this. I remember searching high and low at the time to change the behavior, and couldn't figure out how. If you Google around, a lot of other people seem to have trouble with this as well--there are a lot of tutorials for how to setup iptables to block OpenVPN fallback on dd-wrt and Tomato, for example. I'd love to be proved wrong though!
- Wilya 13y agoThe problem is mostly that Openvpn is responsible for setting up the routes that forward all traffic through the tunnel when it starts, and to remove them when it's done. Openvpn only secures your traffic when it's running. When it somehow quits, you're on your own. My experience is that when it merely loses the connection, Openvpn will try to reconnect, and in the meantime you have no internet. It won't fallback. But sometimes, when the problem is more serious, the openvpn daemon can quit and then it becomes dangerous.
- borski 13y agoJust to clarify, you don't mean run a VM locally, do you? If your traffic is rolling over the same insecure WiFi, I would imagine your traffic could still be connected and possibly sniffed?
- silentOpen 13y agoYes, a local VM with a remote VPN endpoint.
- borski 13y agoOh, I see - that makes sense, though why would you need a VM for it? Why not run it locally with a remote endpoint?
- arthulia 13y agoI think the idea is that you can firewall the VM so none of the traffic will leak if the VPN connection is dropped. I'm sure there are easier ways to do this, though.
- deleted 13y ago[deleted]
- snowwrestler 13y agoWith respect to the last item, I just want to make a distinction between security and anonymity. I don't care if my bank knows I sometimes a VPN; I just want protection from bad actors who might MITM me.
- agwa 13y agoRight. VPNs provide security. If you need anonymity, don't use a VPN - use Tor.
- chrismonsanto 13y agoI agree on principle, but there are some activities for which Tor isn't an option (for example, sending large files). An offshore VPN that doesn't store logs (or even tunneling through several VPN providers/countries) can provide good enough anonymity for the task at hand.
- chakalakasp 13y agoBe careful: many torrent clients (and no doubt that is what ye speak of here) happily report your real IP to every IP you send or request to and from, regardless of VPN use.
- reinhardt 13y agoThoughts on using a Tails VM (https://tails.boum.org/ https://tails.boum.org/) or generally using Tor over the VPN?
- yuvadam 13y agoDo not run Tails on a VM if you have an option. VMs are not secure, and the host machine can _always_ monitor the virtual instances.
- computer 13y agoOf course, running Tails inside a VM is likely slightly safer than running TBB (Tor Browser Bundle) on your normal OS, depending on your threat model. For example, a Firefox exploit that breaks out of its sandbox could access your personal files when you use TBB, but only files within the VM when you use virtualized Tails (without an extra VM or network (fileshare) exploit). If you're going to use a VM for your Tor browsing, consider Whonix [1] instead, which was developed specifically for that usecase. (Note that this is not developed by the Tor project people!) But indeed, to get the full benefits from Tails, always use the live boot option whenever you can. [1] http://sourceforge.net/projects/whonix/ http://sourceforge.net/projects/whonix/
- reinhardt 13y agoWell the host machine is my laptop in this case so it doesn't matter.
- Nux 13y agoI would say it's more secure to roll your own rather than using a "provider". You can never know what the provider is monitoring/logging.
- chakalakasp 13y agoI guess I don't understand what you are doing. Then VPN is to create a secure link either between your computer and a trusted LAN or from your computer to a better, less-likely-to-be-sniffed exit point than open wifi. It's not to hide who you are from the destination server or from anyone observing the overall WAN traffic (as the NSA can do). People with resources can find out who you are with VPN. Saying one should use VPN for anonymity is a bit like saying that its fine to use 1234 as your password because you've never had a problem before and it keeps people out of your account just fine. The reality is that it seems secure right up until the moment that it isn't. Anonymity is what something like Tor is made for, and depending on your level of paranoia even that may not be enough on its own.