Hacker News Reader

Comment by CommitSyn | Hacker News Reader

I wish more VPN services offered multihop. I know of Mullvad (no more port forwarding), Perfect Privacy (slow), NordVPN (no port forwarding afaik)

Who else offers multihop+port forwarding?

View on HN

Another multi-hop would be the open source tinc-vpn [1] software. It performs dynamic mesh routing in user space. The trade-off is that you and/or your friends would need to run each hop. Some hacker groups did this in the past but they would grow their circle of trust too big and didn't last. It worked great for me for decades and routed around numerous internet outages. It's not as performant as Wireguard but I see no reason the lead developer could not integrate it into wg for the tun device.

[1] - https://www.tinc-vpn.org/

IVPN does, which is where I went after Mullvad. Considerably more expensive though.

It is worth noting that not all implementations of multihop are the same. For example, if multihop is using a dedicated port on the entry node (e.g. connecting to any Mullvad server on port 3438 will give you a multihop through that server to se-sto-wg-001), someone can who observe your traffic to the entry server (e.g., your ISP) can immediately figure out the exit server because entry port<->exit server mapping is public. Double-tunneling (i.e. having a VPN connection inside an outer VPN connection) doesn't have the same problem but reduces MTU.

The mullvad app does multihop in a more secure way than what their help page says for manual wireguard, but it's not documented anywhere else so you have to read the source code of the app. I wish they would make that more clear or add documentation for the more secure way.

Private Internet Access, through a semi-documented API. I have a NixOS module here: https://github.com/tadfisher/flake/blob/main/nixos/modules/p...

Tor.

But running Tor inside a VPN or a VPN inside Tor has unique risk profiles you should be aware of.

Reply on news.ycombinator.com