Hacker News Reader

Comment by IlikeKitties | Hacker News Reader

I strongly suggest that you use something like Network Namespaces through Vopono[0] or Gluetun[1] if you use a commercial VPN for "privacy" or "security" aka torrenting and shitposting. Relying on these clients is always a gamble and if your software (Browser, Torrentclient, etc.) cannot know you public IP only the internal IP of the VPN you are also safe against some exploits and misconfigurations a desktop client won't protect you against.

[0] https://github.com/jamesmcm/vopono [1] https://github.com/qdm12/gluetun

View on HN

Wouldn't blocking IPv6 and using a kill-switch prevent leaking?

In the case of PureVPN, the only way of preventing leaks is by switching to a different provider. There is definitive proof that they keep logs despite their claims to the contrary. I have linked to a federal criminal complaint where the FBI requested logs after the offense and was given them by PureVPN. The relevant portion is on page 22.

https://www.justice.gov/archives/opa/press-release/file/1001...

Block IPv4 as well and you're pretty solid.

No, not in all cases. Imagine your Browser gets 0-dayed and just send all IPs it sees to an endpoint.

Noob here. If this happened, wouldn't any type of layering of network solutions ultimately result in this leaking all the same though?

No. The Browser or torrent prozess is sandboxed and can only see the VPN Network interface. The other interfaces are hidden.

I strongly suggest you disable ipv6, as nothing will break by disabling it but many things break with it enabled.

That's not true anymore.

IPv6 allows for more direct connections for services like VoIP or Tailscale, since UDP hole punching between two firewalled public IPv6 addresses usually just works, but doesn't between two clients both behind a "port-restricted cone" or "symmetric" NAT.

As a result, connections have to be relayed, which increases latency and is just outright infeasible for some non-profit services that don't have a budget for relaying everyone's traffic.

Anecdotally, I've also heard that you can get better routing via IPv6 on IPv4-via-NAT-only providers these days, as the provider's CG-NAT might be topologically farther away than the IPv6 server you're connecting to.

Alternatively, disable ipv4. The same statement holds true.

Unfortunately this is not true, loads of cool techy stuff (Sentry, GitHub) etc still don't work properly on IPv6, less techy stuff really didn't care at all.

You can use nat64 to talk to legacy networks. Ipv6-only networks (with nat64 or 464xlat etc) are becoming increasingly popular. There is also this new concept called "ipv6-mostly network" that is getting rolled out: https://www.ietf.org/archive/id/draft-ietf-v6ops-6mops-02.ht...

Lots of things will break if you disable ipv4, including my work provided zscaler windows laptop (and not break in the good way where it fails open when you block traffic to zscaler nodes on your router)

Very little will break if you disable ipv6

Enterprise malware not doing v6 properly hardly counts, it’s a good day for them when they don’t just bsod your entire network.

A lot of stuff breaks when you run Zscaler.

Absolutely, yet it's a requirement for many people.

That's not really true anymore. I've used a connection with both IPv4 and 6 for the past two years. There's a number of times where my stuff magically works, whiles others have issues, because my traffic is mostly over IPv6. Not once have I had an issue because my setup is dual stacked.

This is still true for ISPs that don't monitor their IPv6 connectivity. I was forced to disable IPv6 recently because of this: https://www.reddit.com/r/ipv6/comments/1nf3ytq/how_do_i_comp...

And before you say "change the ISP": Globe is the only one that does not refuse to provide services to foreigners and does not lock you up into a 24-month non-cancellable contract, which is longer than any available non-resident visa.

That's not really an IPv6 issue, but an ISP issue. My old ISP didn't monitor anything and relies on customers to call them up and explain that their connection is down. Sometimes tell them that their connection to entire towns are down, because they don't know.

I'm fairly fortunate that my ISP not only offers IPv6, but also knows how to run their network. Denmark has plenty of ISP that doesn't provide IPv6, don't know how to run a network or some many cases both.

Reply on news.ycombinator.com