Hacker News Reader

Comment by BoppreH | Hacker News Reader

I really respect how Mullvad is willing to sacrifice business to give extra security and reliability to the (remaining) customers. I first saw it when they disabled auto-renewal with PayPal, because it'd force them to store PII along with your account.

Unfortunately for me, they made one too many sacrifices, and disabled port forwarding[1]. They don't store any contact information that could be used to warn customers, so my connection mysteriously failed one day and I was left with several months of prepaid service.

I'm a bit bitter for that, but honestly their technical writing and security decisions have earned enough good will from me that I want them to keep the money. As the only VPN that doesn't feel shady, I wish them all the best.

[1] https://mullvad.net/en/blog/2023/5/29/removing-the-support-f...

View on HN

I sincerely apologize for the inconvenience we have caused you.

Announcing the removal of a feature such as this a mere 30 days ahead is not how we like to conduct our business in the general case. I expect those of our customers who relied on this feature to be disappointed by its removal as well as the manner in which it was done.

Nevertheless it was the right thing to do. The manner and extent in which it came to be abused in recent months made it unacceptable for us to continue providing it. This feature should have been removed a long time ago, with a longer grace period. It wasn't - a mistake on our part - and some of our users suffered for it, including you. For this I am sorry.

Affected customers can get their money back for any prepaid service they can not use, of course.

If you used port forwarding to (I) make a service reachable (II) from the open Internet there are plenty of good hosting providers which will happily take your business.

If you used port forwarding to (III) stay anonymous while (I) making a service reachable we can highly recommend Tor's "onion service" feature. It was built with that use case in mind.

If you used port forwarding to (III) stay anonymous while (I) making a service reachable (II) from the open Internet, there are no good options that we can recommend.

Port forwarding needed to be removed on moral grounds. It needed to be removed because it was causing too much of a disturbance to our core mission of making mass surveillance and censorship ineffective.

I hope my explanation has - if not allayed your disappointment - at least provided some clarity.

Best regards, Fredrik Stromberg (cofounder of Mullvad VPN)

What sort of abuses you have encountered when dealing with port forwarding? Was it DMCA'd content hosting or were there other major issues with it? Also how does other VPNs that offer port forwarding (like Proton) function against those sort of abuses?

They give some examples of things bad actors used port forwarding for in the blog post[1] announcing the removal of the feature.

[1]: https://mullvad.net/en/blog/2023/5/29/removing-the-support-f...

Reading between the lines, I'd be very surprised if it wasn't highly undesirable content, i.e. child porn or fraud. This came about a month after a very publicised raid by the Swedish police -- after which they left with nothing [1].

[1] https://www.pcmag.com/news/mullvad-vpn-hit-with-search-warra...

FYI: Our decision to remove port forwarding was not a reaction to the surprise visit by Swedish police. I wish we had been more clear about this in our blog post.

I am highly certain it involved both and more.

For example, say someone wanted to run their botnet distribution server. Now, unless you’re a state actor working for North Korea or some such, that generally gets a rather angry knock on your door in a rather short period of time.

Being able to hide your IP/traffic for $5/mo is going to save you a significant amount of trouble.

I’m certain AWS and other hosting providers keep track of any activity that’s too strange, and the authorities will have your hosting provider give you the boot even if they can’t figure out who you are exactly.

Developing a reputation for allowing, if not quite condoning such behavior will quite quickly get you shut down as a business. Even if they can’t “prove” anything, you’ll get hassled, harassed, and investigated to death because your existence goes from being a nuisance to being a problem.

Some guy torrented a few movies on your VPN? Whatever. Some guy used your VPN to break into their local government’s servers? If they can’t find him, they’ll take it out on you.

VPN port forwarding is, by and large, used for BitTorrent because you can't seed without it. VPNs are used for BitTorrent in general because it's well-known that IPs participating in BitTorrent are monitored and logged by anyone who wants to[0]. I bet it's at least 100 BitTorrent users for every 1 user using port forwarding for any other purpose.

[0] https://iknowwhatyoudownload.com/

You can still seed/download without port forwarding setup, however the other person you're connected to needs to have port forwarding. Basically either side of the P2P connection needs to be reachable from the open internet, but not both.

So you can still seed, it just won't be as usable.

There were several major issues.

Thanks for the reply. I'm sorry my negative comment got to first spot on what should have been a positive post. I understand why the decision was made, and I think I'd have done the same.

I really hope you guys stick around, Mullvad has exactly the posture that we need from security services.

Thank you. There is no need to be sorry. I'm grateful for the opportunity to clarify things.

I had no idea this even happened. It would have been useful to show a notice within the app itself (like you do for patch notes?). Maybe you did, and I didn't see it, but I just got done paying for another 6mo on your service being none the wiser.

I'm not sure whether we did or not. Please don't hesitate to contact support for a refund of remaining time in case you've decided to switch providers.

Port forwarding doesn't seem to be a problem for long-established independent VPNs like AirVPN (based in Italy but very ingeniously without exit servers in Italy) or AzireVPN (Swedish; added port forwarding -- all mappings in memory, no static records -- just recently [1]). What makes Mullvad's situation different? Is it a question of margins for high traffic port forwarding users (Mullvad is branching out in browsers and search while these two are not) or something else? I used to be a long time user and a huge fan and proponent of Mullvad's but the communication here has been very much opaque. This is especially so as port forwarding removal was announced straight after a raid where police, after Mullvad's explanations, didn't take anything [2].

[1] https://blog.azirevpn.com/port-forwarding/ [2] https://mullvad.net/en/blog/2023/4/20/mullvad-vpn-was-subjec...

It seems pretty evident why they had to turn it off:

> The manner and extent in which it came to be abused in recent months made it unacceptable for us to continue providing it.

Probably the difference between Mullvad and AirVPN/AzireVPN is how popular the service is, which also usually dictates how popular it is for people to try to abuse it.

Maybe 1% of each service's traffic is abuse, which for AirVPN/AzireVPN is not that much, but on Mullvads scale it becomes a whole nother beast.

I'm sorry we haven't been more clear in our communication.

Our decision to remove port forwarding was not a question of margins - it was a moral and practical decision.

Port forwarding is a feature with many legitimate use cases. This year it became clear that we had become popular for use cases we didn't want to support. Undesirable content and malicious services is a good summary. I'm not privy to more details than that as my main focus is research.

Technology is often a double-edged sword, but thankfully it is often also a net benefit to its users and society in general. Privacy online is exactly that kind of technology. Enabling anyone to host any service anonymously on the open Internet is another matter.

I hope AirVPN and AzireVPN somehow succeed with providing that feature while steering clear of its downsides. That would be awesome.

Nitpick: Mullvad is older than both Air and Azire. :)

Thank you! That clarifies :) I'm also glad for all the innovations Mullvad has invented/supported/etc in the VPN space -- anonymous account numbers, multi-server SOCKS proxies, Wireguard over TCP, post-quantum Wireguard, stboot, open APIs, the list goes on.

It feels like VPN for apps is very different than a VPN for browsing. While in both cases I want my traffic to be mixed in with a lot of other people's traffic (so service provider dealing with complaints about neighbors is part of the value proposition), browsing use case is tied to IP reputation (so don't want someone to run a Tor exit on the same IP), whereas the app use case is much less IP reputation-sensitive but definitely benefits from port forwarding (e.g. to anonymously run nodes that powers distributed infrastructure like crypto).

I'd definitely pay premium, with longer commitments up front for "this server might be useless for browsing but run all your anonymous crypto nodes behind forwarded ports" type of service. Maybe if port forwarding is active only if you have 6+ months of outstanding service commitment (and you forfeit the balance if your port gets used for C&C or whatnot) is enough of a deterrent. Some VPNs are doing some traffic segregation already, e.g. having dedicated servers for P2P, though nothing exactly like this.

Mullvad is probably the VPN with the longest track record of not keeping logs. I find it likely that the vast majority of people who hosted immoral content using Mullvad's port forwarding feature solely used Mullvad for this purpose because of their reputation. After Mullvad discontinued port forwarding, IVPN (probably the second most trusted VPN provider) came out a month later and announced that they were also discontinuing port forwarding [1]. I think it is likely other VPN providers will follow suit.

According to Mullvads blog [2] the police raid was related to a blackmail attack in Germany.

[1]https://www.ivpn.net/blog/gradual-removal-of-port-forwarding

[2]https://mullvad.net/en/blog/2023/5/2/update-the-swedish-auth...

So basically no companies wish to provide anonymous unrestricted uncensored information exchange.

be even more hyperbolic why don't ya

This is a very articulately worded and elegant response.

It is wild how good of a company and team you’ve proven to be. The world would be a much better place if everyone operated this way

> They don't store any contact information that could be used to warn customers, so my connection mysteriously failed one day

This situation seems avoidable: what if the payment/signup flow had a big loud warning that you need to configure your own polling of an RSS endpoint using a client capable of pinging you?

That's honestly a great idea for an alternative to newsletters... it would be nice if there was better first-party RSS support (what about in the email client?) since I don't think any OSs have it, because right now that would probably confuse most customers

The likelihood of being confused by rss among mullvad customers can't be very high.

You might be surprised! The Mullvad client is super well designed and usable for newbs, and I'll bet a lot of their business is from people whose more technical friends told them it was a good idea. There's a reason that Tor warns users that posting personal information or using accounts with their regular credentials compromises anonymity.

I wish RSS had more surface area with general computer users, but I reckon even being called RSS makes it unlikely. Folks in tech often forget how intimidating opaque names can be for nontechnical users.

Not being a Mullvad user myself, I wasn't sure if people tend to use a Mullvad client or a generic VPN stack built into their OS, but the Mullvad client could simply display news like this to the former set of users leaving only the latter set to configure a separate RSS client or whatever.

This might be the most HN comment I’ve seen in a while

I’m a network newbie so I have no idea about the importance of this. I have done port forwarding in my router before, mainly so I can access my Plex system outside of my house. I used to setup port forwarding when torrenting but I have realized that I can still get my Linux ISOs without it. I never cared even though I’m a heavy user of their product. When will it start to affect me, or in other words, what use cases am I locked out of when port forwarding is disabled?

You'd need that feature if you desired to host an actual service (a webserver for example) behind the VPN

Oh!! That makes a ton of sense now, I feel dumb for not thinking about that since I was just doing some config changes for Docker services running in my home server. I realized I couldn’t access it from another machine because the Dockerfile didn’t have ports forwarded appropriately. Thank you very much!

Your torrent client probably uses UPnP to have your router selectively open ports to your machine for the duration of the session.

After they disabled port forwarding, I moved to ProtonVPN. They seem like the next best thing, and they continue to state that they have no intention of removing port forwarding (for now, I assume).

I'm glad to read this. We considered switching to them earlier this year (couldn't find the budget) and it was still on the table, but this is a deal breaker. If we'd switched I'd have been in the same situation, with a lot of prepaid service I couldn't use as intended.

To be fair, the announcement came with the option of asking for refunds, and I have no reason to doubt them. My few interactions with their support were pretty good.

Have you found a replacement? I did some light investigation but nothing really felt as solid as Mullvad so I haven't jumped ship yet.

Not that person but I've spinned a 1984 instance paid with bitcoin without KYC. Then setup nat+rdr rules that foward to my service through a wireguard tunnel.

This might be the way I go. Thanks.

Forgive my ignorance, but what’s a “1984 instance”? (Google could not help me.) Thanks!

I googled "1984 vps" and came up with http://1984.hosting/. I have no idea if this is what GP is referring to.

Oh, I think that used to be 1984.is. Nice people, hydro powered, cooled by ice, strong privacy posture.

Why use wireguard? It is trivially to detect by the ISP or government. Every decent VPN should masquerade as HTTP/2 or HTTP/3.

None as solid, no. My needs are fairly specific (exit node in a specific country, torrent-friendly, good speed, not too expensive, not too shady, first-party support for my OS'es, doesn't have to be government-proof), so you'll need to do your own research.

For what's worth, I eventually went with Proton VPN, but it's more expensive and gives a used-car-salesman feeling.

> gives a used-car-salesman feeling.

I really don't like the aesthetic direction Proton's been taking in the last few years, from top to bottom. I'm finding their mail apps, both in desktop web browser and on mobile, less and less usable. In addition I get this feeling from their design choices as well. I know their mission is to grow enough to challenge predatory providers like gmail, but it makes me wary and makes me feel as if I won't be using them in 5 more years.

Proton has unfortunately become incredibly bloated over the past few years. Meanwhile ProtonMail doesn't yet support auto-forwarding or (on mobile) email content search.

Becoming well known for always trying to put customers first is a good strategy and probably makes business sense in the long run. I have used mullvad for years. I have no intention of shifting provider. Mainly because the evidence is starting to stack up that they are one of the few good actors in a cess pit of shitty/shady competition. (Though it's a shane mullvad gets blocked by netflix, well the last time I tried it wasn't working).

The only other service I have any brand loyalty to gog.com. For some reason I feel the same about them.

The discontinuation of port forwarding forced me to leave which is unfortunate because they are excellent.

I use IVPN and they also deprecated port forwarding. I believe they didn't cut people off directly but if you stop using it you can restart using it. I wonder if they removed it for the same reason.

What are legitimate use case to use port-forwarding behind a VPN IP? Genuinely curious, I'm not implying anything. The main use-case is hosting something for which you don't want to reveal your IP or circumvent some ISP that block hosting web servers on their residential IPs. I'm sure I'm missing many more use cases.

I have been out of the loop for a while on this, but doesn't BitTorrent require you to set up a port forward? Otherwise you can only connect to peers that do, but not other peers that don't.

I think it is possible to connect using STUN even if both users are behind NAT.

Can be used for hosting libgen/sci-hub.

Basically you have a thin proxy on some not so cheap but ‘anonymous’ Bitcoin payed VM, that then (http) links to your vpn endpoint.

You need the dual setup as using the btc vm for storage of terabytes of data as well as for TB of traffic is too expensive for a volunteer run project.

They still support opening up ports, it’s just randomized instead of dedicated like uPnP.

Oh really? Could you elaborate or point me in the direction of more information on this please?

https://mullvad.net/en/account/wireguard-config

In the wireguard config section of their tutorials, there’s a spot to put a custom port - it’s really unclear from the docs but this allows you to expose out a service within the higher limits of the port ranges, and only on dedicated servers.

Really hard to find but they call this “city ports” over global ports because you have to set them up beforehand.

The "custom port" option in the config creator just sets the endpoint port to use for Wireguard. It has nothing to do with port forwarding.

This isn’t true, Mullvad completely disabled port forwarding earlier this year. See: https://mullvad.net/en/blog/2023/5/29/removing-the-support-f...

I’m confused, the blog post backs up what you say but I can still set custom ports within my account page… And I’m currently running a service that needs to advertise out on a port to work from Mullvad.

I don't want to revoke a key to test but I'm pretty sure that just sets the port in the Endpoint part of the WireGuard config file. (the port you use to connect, for if the regular one is blocked). Are you sure your service behind Mullvad is accepting incoming connections?

Is it a torrent client, by any chance? Those can still work without port forwarding, if the swarm member you're sharing data with (regardless of direction) has an open port on their side.

Try creating a new torrent with some random file, seeding it from a Mullvad device and downloading it from a different Mullvad device. That should only work if you have port forwarding set up (or if you're not actually going through Mullvad - you will see that by the peer IP in the torrent client).

That custom port on the WireGuard config page is not the place where you'd configure port forwarding; that's not what that is. They had a separate port forwarding page for configuring city ports which is now gone. But you say you have it working. My guess is that you're just misremembering where the configuration is, and that Mullvad hasn't removed existing port forwards yet like they said they would.

Reply on news.ycombinator.com