Hacker News Reader

I agree with the "don't roll your own" VPN suggestion--I personally signed up with Private Internet Access and haven't looked back since.

But I have a question about this: "be sure to firewall your VM from any traffic not to your VPN provider."

Is there a good generic way to do this on Windows? I've looked around and it's never very clear. I think the PIA client has a "VPN kill switch" that should effectively do the same thing, but not all VPN providers have a client.

If you are using a VM like I suggested, you can do this inside the VM instead of messing around with Windows. See this post: https://news.ycombinator.com/item?id=6285837

Unfortunately I don't use Windows, so I don't know how to firewall from it.

Here is a pre-configured VM:

https://www.privateinternetaccess.com/forum/index.php?p=/dis...

Is PIA completely offshore?

FTA

"2. Our company currently operates out of the United States with gigabit gateways in the US, Canada, Germany, France, UK, Switzerland, Sweden, the Netherlands and Romania. We chose the US, since it is one of the few countries without a mandatory data retention law. We will not share any information with third parties without a valid court order. With that said, it is impossible to match a user to any activity on our system since we utilize shared IPs and maintain absolutely no logs."

I view it as defense against hotel or coffee shop wifi hackers.

If you have a threat matrix that includes governments or maybe even large corporations, it's definitely not for you. But c'mon, for $4 a month or whatever, what do you expect?

I have used PIA for 6 months or so, the business being US based has worried me. Speeds have been good so far and the pricing is great. I have a question for Linux users with more experience than I. Has anyone wrote a script that could tell if the openvpn connection has been cut, then just kill eth0 automatically?

Here is a script for linux:

https://www.privateinternetaccess.com/forum/index.php?p=/dis...

Thank you! File hosted on Mega...hah!

Watch out for IPv6 on Windows. I have a PPTP VPN through StrongVPN and the IPv6 interface is unaffected. Unfortunately there doesn't seem to be a way to programmatically disable it.

If you use PIA our Windows (and OSX) app has a feature (on by default) which blocks IPv6 while you're on the VPN.

https://www.privateinternetaccess.com/pages/client-support/#...

Just after I pay for a year of StrongVPN...

I was going to post this link for disabling ipv6 http://support.microsoft.com/kb/929852/en-us then I read the word "programmatically".. then I was going to suggest using "netsh" but it seems you can't use it to disable IPv6, finally I found that you can modify the registry as illustrated here: http://technet.microsoft.com/en-us/library/bb878057.aspx (i.e. with a script launching reg.exe) but then I read that it should require reboot (damn Microsoft..)

With respect to the last item, I just want to make a distinction between security and anonymity. I don't care if my bank knows I sometimes a VPN; I just want protection from bad actors who might MITM me.

Right. VPNs provide security. If you need anonymity, don't use a VPN - use Tor.

I agree on principle, but there are some activities for which Tor isn't an option (for example, sending large files). An offshore VPN that doesn't store logs (or even tunneling through several VPN providers/countries) can provide good enough anonymity for the task at hand.

Be careful: many torrent clients (and no doubt that is what ye speak of here) happily report your real IP to every IP you send or request to and from, regardless of VPN use.

How do you firewall your connection from any traffic not to your VPN provider?

I'd kill for a solid in depth write up if someone is willing to put one together. I don't know anything about this kind of stuff but it's piqued my interest lately.

A lot of people have asked me for pointers to write-ups, but there don't appear to be any comprehensive ones on the Internet. When I setup all of this, I had to learn from piecing together information from various tutorials and reading manuals and what not.

I have been meaning for a while now to make a mini distribution of Linux that works well for VPN usage out of the box. If people are interested in this sort of thing, maybe I could try to make time for it.

Yes, please.

I would love to see a VM that I can just spin up that allows for an IPSec tunnel to terminate to it in a road-warrior config.

FWIW, here is what I have so far. http://superuser.com/questions/553193/how-do-i-configure-dd-...

On Windows, you can use WIPFW and make the appropriate rules.

Works like a charm, and hard as hell to detect using standard windows tools.

On Mac I used this resource to block traffic with the exception of UDP and on the ppp0 interface: http://superuser.com/questions/468919/prevent-outgoing-traff...

On Linux, I use a shell script like this:

   servers=( ip1 ip2 ip3 ... )
   
   # Can fwd over internal network
   iptables -A OUTPUT -s 192.168.0.0/16 -d 192.168.0.0/16 -j ACCEPT

   # Can fwd over loopback
   iptables -A OUTPUT -o lo -j ACCEPT

   # Can fwd over the tunnel
   iptables -A OUTPUT -o tun0 -j ACCEPT

   # Can send packets to VPN
   for server in "${servers[@]}"; do
      echo "Installing rules for $server"
      iptables -A OUTPUT -d $server -j ACCEPT
   done

   # Otherwise drop
   iptables -A OUTPUT -j DROP

Use it with a package like iptables-persistent so you don't have to run this every time at boot.

You can do this without IPtables, just make wlan0/eth0 the host route for $server and then make the default gateway the tunnel interface. Decent OpenVPN clients do this by default.

I guess I don't understand what you are doing. Then VPN is to create a secure link either between your computer and a trusted LAN or from your computer to a better, less-likely-to-be-sniffed exit point than open wifi. It's not to hide who you are from the destination server or from anyone observing the overall WAN traffic (as the NSA can do). People with resources can find out who you are with VPN. Saying one should use VPN for anonymity is a bit like saying that its fine to use 1234 as your password because you've never had a problem before and it keeps people out of your account just fine. The reality is that it seems secure right up until the moment that it isn't.

Anonymity is what something like Tor is made for, and depending on your level of paranoia even that may not be enough on its own.

>If OpenVPN drops its connection, it will fallback to sending packets normally! //

This seems to be a bug in network setups - surely it's highly desirable to be able to control which route traffic takes and whether fallback to a different connection occurs or not.

On Debian 6, the default behavior is to do this. I remember searching high and low at the time to change the behavior, and couldn't figure out how.

If you Google around, a lot of other people seem to have trouble with this as well--there are a lot of tutorials for how to setup iptables to block OpenVPN fallback on dd-wrt and Tomato, for example.

I'd love to be proved wrong though!

The problem is mostly that Openvpn is responsible for setting up the routes that forward all traffic through the tunnel when it starts, and to remove them when it's done. Openvpn only secures your traffic when it's running. When it somehow quits, you're on your own.

My experience is that when it merely loses the connection, Openvpn will try to reconnect, and in the meantime you have no internet. It won't fallback. But sometimes, when the problem is more serious, the openvpn daemon can quit and then it becomes dangerous.

Thoughts on using a Tails VM (https://tails.boum.org/) or generally using Tor over the VPN?

Do not run Tails on a VM if you have an option. VMs are not secure, and the host machine can _always_ monitor the virtual instances.

Of course, running Tails inside a VM is likely slightly safer than running TBB (Tor Browser Bundle) on your normal OS, depending on your threat model. For example, a Firefox exploit that breaks out of its sandbox could access your personal files when you use TBB, but only files within the VM when you use virtualized Tails (without an extra VM or network (fileshare) exploit).

If you're going to use a VM for your Tor browsing, consider Whonix [1] instead, which was developed specifically for that usecase. (Note that this is not developed by the Tor project people!)

But indeed, to get the full benefits from Tails, always use the live boot option whenever you can.

[1] http://sourceforge.net/projects/whonix/

Well the host machine is my laptop in this case so it doesn't matter.

Just to clarify, you don't mean run a VM locally, do you? If your traffic is rolling over the same insecure WiFi, I would imagine your traffic could still be connected and possibly sniffed?

Yes, a local VM with a remote VPN endpoint.

Oh, I see - that makes sense, though why would you need a VM for it? Why not run it locally with a remote endpoint?

I think the idea is that you can firewall the VM so none of the traffic will leak if the VPN connection is dropped. I'm sure there are easier ways to do this, though.

I would say it's more secure to roll your own rather than using a "provider". You can never know what the provider is monitoring/logging.