Hacker News

points by bradknowles 3 days ago | 0 comments

Another reason to use a VPN you can trust, across your entire network and at all times.

So a VPN you set up and run yourself.

Isn’t that the same as no vpn with extra steps? You are tunneling traffic from a computer you own to a computer you also still own. Third party vpn the whole point is I don’t run it.

[–] khafra 3 days ago

If you set up a VPN endpoint on a Hetzner box, you're trusting Hetzner not to MITM your DNS queries. They're likely more trustworthy than your local ISP (although that leaves you more identifiable to folks running the servers or snooping on server-side traffic, and Cloudflare will hate you). That threat model tradeoff is good for many people.

[–] throwawayffffas 3 days ago

Given the OP use case, you are going to get a letter from Hetzner at some point.

[–] dspillett 2 days ago

Not if they are only using it to route the DNS traffic (though in that case a cheaper VPS might be better), which will work if the ISP is only poisoning DNS replies and not (which is often the case) blocking traffic to the target servers entirely.

The problem with this is you are adding a moving part to your DNS lookups. It might be worth adding two on separate VPS hosts and have your resolver fall back to the second if the first goes down.

Another, usually more minor, problem is that some services (like CDNs) use the source of your DNS query to modify the response so you get sent to a topologically near-by end-point. This means you might notice such services being slower as you are sent to a PoP near your VPN host not one closer to your actual location.

[–] cowlevel 2 days ago

Not for DNS lookups. Hetzner forwards complaints from copyright holders, they don't proactively snoop traffic to make sure you don't access 1337x at all. It's legal to access the site.

[–] ozim 3 days ago

Oh well OP was doing shady stuff ... then yeah they should continue with using VPN provider. VPN providers are shady AF, I don't think there is VPN provider I would trust more than my local internet provider.

[–] asdff 3 days ago

Well that wouldn’t be running your own vpn. Hetzner is. They’d let you do this? Seedbox is against their tos hard to imagine they’d be a good choice to run a vpn for your linux isos.

[–] konart 3 days ago

> They’d let you do this?

Can't speak for Hetzner, but considering VPN use in Russia and China - I'd imagine most EU\US vps providers have someone's 3x-ui, remnawave or naked v2ray installed.

Plus - how are they going to detect your remnawave node sitting on 443 port? For them it's just some traffict.

And if you are worried about the amount (torrents) - you don't really need to torrent though them. You just need an access to a torrect tracker to get your magnet link and meta info.

Most default configs for 'ray have torrents locks for this very reason - you communicate with other people (seeds\peers) directly.

[–] gruez 3 days ago

>Plus - how are they going to detect your remnawave node sitting on 443 port? For them it's just some traffict.

What about all the outgoing traffic? That's going to be hard to mask unless you have another VPN for outbound

[–] konart 2 days ago

But what's wrong with my VPN talking to, say, youtube (blocked in Russia) or some torrent site (for example to fetch RSS feed of new releases).

Fedora, for example, provides torrent access (including RSS feed) for its releases: https://fedoraproject.org/torrents/45/

[–] asdff 3 days ago

But the isp sits between that no?

[–] throwawayffffas 3 days ago

All traffic to the VPN is encrypted, including DNS queries.

All your ISP can tell is you are using a VPN.

[–] asdff 3 days ago

What about TLS inspection?

[–] pjc50 3 days ago

What about it? Unless they've hijacked your local cert store somehow (which corporate machines do), they can't see inside the TLS. They can detect that you're connecting to somewhere and probably infer that it's some VPN, but only the most repressive countries actually block VPNs altogether.

[–] Geezus_42 2 days ago

Not unless they can break your VPN's encryption. Which, if your ISP can do that, you have bigger problems.

[–] thesuitonym 2 days ago

A VPN just moves the attack vector from the ISP to the VPN provider, it doesn't protect you from this in any way at all. Better to use an ISP you trust, though that's difficult to find.

I don't trust any public VPN provider because they all start off by lying about what their product does.