Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

AirVPN by default has all ports closed but allows port-forwarding. I think this is required for P2P. Is this a threat to anonymity (e.g. would the person at the other end of the P2P transmission know who you are) with port-forwarding set up?

I noticed other services such as BTGuard and PrivateInternetAccess don't mention port-forwarding yet are designed for P2P. Is this because all thier ports are opened by default?

Let me ask it this way. If you do the following does it allow people to see your real IP?

You provide Remote Port Forwarding, what is it? "Remote port forwarding" forwards traffic coming from the Internet to our VPN server ports to a specified local port of your client.

By default, your account has no forwarded ports, and this is good as long as you don't wish to have a service reachable from the Internet. For example, suppose that you want to run a web server behind our VPN, or that you wish to receive incoming connections to your BitTorrent client in order to improve p2p performance, or to seed a file. Without at least one remotely forwarded port, your service could not be reached from the outside, because our VPN server would reject the proper packets to your service.

Usually this is a good security measure against attacks, but it prevents your services to be reached from the Internet.

When you remotely forward a port, our servers will open that port (TCP, UDP or both, according to your selection) and will properly forward incoming packets to you on that port.

You can forward up to 20 ports simultaneously. You can do that on our website. You can't forward ports lower than 2048. You can map a remotely forwarded port to a different local port: this is useful for a variety of cases, for example when your service listens to a port lower than 2048 or when it is already reserved.

IMPORTANT: do NOT forward on your router the same ports you use on your listening services while connected to the VPN. Doing so exposes your system to correlation attacks and potentially causes uncencrypted packets to be sent outside the tunnel from your client.

share|improve this question
    
The fact you can be identified on the internet has nothing to do with upnp port forwarding. –  Andrew Smith Jun 28 '12 at 23:16
    
@AndrewSmith I think you're answering the converse of the question I'm asking. Can you be identified if you have port-forwarding setup on VPN? –  Celeritas Jun 28 '12 at 23:21
    
@Celeritas you mean to ask can a particular computer behind a NAT be identified? –  ewanm89 Jun 28 '12 at 23:55
    
@ewanm89 no. What's unclear about "Can you be identified if you have port-forwarding setup on VPN?" I'm not expert at this so if my question doesn't make sense say so (but I don't think I'm talking about upnp or NATs) –  Celeritas Jun 29 '12 at 0:02
    
@Celeritas PortForwarding is part of NAT, infact it is how a NAT works, upnp is automatic inbound portforwarding (the app finds it on the router and requests it), –  ewanm89 Jun 29 '12 at 0:30
show 1 more comment

2 Answers

up vote 2 down vote accepted

That's the worst possible advice; and, doesn't answer what the OP wants to really know. If you get a standard VPN provider and you attempt to forward your ports via your Internet router, you're leaving yourself completely exposed to "real" malicious attacks; especially if you forward common ports such as port 80, 443, etc; even if they're SSL'ed! I tested this a few weeks ago.. some very popular VPN services are completely infested with automated vulnerability scanners and respective attacks.

The difference between AirVPN and other VPN providers is that they allow for a much safer way to forward your port (done on their servers instead of on your router); which doesn't completely leave you vulnerable to port-scans and respective attacks. This is particularly useful for people who host web sites and other Internet services.

So, if you're forwarding ports, you had better do it with a VPN that's setup for doing this. Most don't advertise this too well; so, you have to specifically ask for ports to be forwarded for you (these accounts are usually referred to as "dedicated" or "private" VPNs.

share|improve this answer
add comment

You can be identified whether or not you have port-forwarding setup, although not by most people, as they do not have the technical know-how. Many websites store your ip address etc... when you visit them. With Torrents specifically, your ip-address is sent to the peers whether or not you're using port-forwarding, because that's why it's direct p2p. It goes fast that way, but is also somewhat risky.

If you're worried about enabling port-forwarding because you think the government (or hackers), or Government hackers, are tracking you, just don't be too active and you should be fine. Or move to Sweden. If you want to browse freely, without being able to be tracked, use Tor. But you shouldn't use it for Torrents: https://blog.torproject.org/blog/bittorrent-over-tor-isnt-good-idea.

share|improve this answer
2  
1)how does a website know your mac address? 2)the point of a VPN such as those listed above is so a website or peer doesn't have a direct connection with you and doesn't know your IP –  Celeritas Jun 29 '12 at 6:14
    
To reiterate @Celeritas point, your MAC address is a link-level address that is trivial to change/spoof. Your MAC address is only known to computers you directly communicate with; e.g., the router at the other end of your ethernet cable that's connected to the cable modem. When your router then talks to the ISP, it gives your ISP's first connection the routers MAC address. Your computers MAC address is known only to your router. –  dr jimbob Jul 3 '12 at 10:48
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.