19

This question is kind of asked already but it was asked with different context:

Say I am using DD-WRT flashed router which connects as a client to VPN server #1.

If I setup my machine that's behind the DD-WRT router, using a software VPN client to connect to VPN server #2, will I get 'doubled' anonymity (i.e it's harder to get logs from several VPN providers)? Will such a setup work?

Can I chain this (VPN-1 router behind VPN-2 router ... behind VPN-N) assuming that speed and latency is of no concern?

UPDATE: just to clarify my question: did anyone try this setup? I would like to have some confirmation from the person who used such setup or something similar.

1

4 Answers 4

11

I've had this working on my home router for a few months with no issues. DD-WRT is configured as an openVPN client to a PrivateInternetAccess account so that all PCs are forced to use it for Internet traffic. Then I tunnel each PC using openVPN to a different service. Performance definitely takes a hit but it's still quite usable and there are no routing problems.

1
  • 3
    Thanks for the input. Would you be so kind to share what performance hit you get? Jan 12, 2015 at 8:34
11

I know this question is over a year old but I thought my input might be useful as I use a similar technique.

I use a Linux desktop machine which is set-up to use an openvpn client connection to Private Internet Access. That PIA account was paid for using a Walmart gift card that was bought for cash whilst on holiday over 1000 miles from where I live. Furthermore, the card was kept for 6 months before it was used in order to further erode the money trail.

The next line in the anonymity defence is that I run a second Linux desktop machine as a virtual machine on the first desktop. The network on that VM is set up as a NAT so it doesn't share the same subnet as the host nor any of my other internal clients. In addition, that VM is also running a LEAP based VPN that is provided free of charge by an organisation of which I am a member. That VPN was set up with a false name and a one time use email address.

I only use this set up when exchanging data with other activists and I have to say it is not used for illegal purposes. I go to these lengths because I know how to and I value my privacy.

My network is provided by fibre and the slow down caused by the two overheads is tolerable enough to still be able to stream youtube videos.

Note, if you are using any VPN at all you have effectively punched a hole through your broadband router's firewall. You must use a software firewall on the client. I have a firewall running on both the host and virtual machine.

I could add a third VPN layer by setting up the router to connect to a third VPN provider but that might be overkill.

The point of doing this is that it makes the technological challenge of sniffing the traffic much harder. Also, as stated by executifs above, the more important point is that it makes the legal battle to get logs way harder. Especially as both VPN providers claim not to keep logs.

My inner VPN provider uses a signed warrant canary (https://en.wikipedia.org/wiki/Warrant_canary) on their website. If that file is not updated in a signed manner every month then every user is to assume that they have been served with a gagging order by law enforcement.

Hope this helps

2
  • 1
    Thanks for the input. I have tried similar setup and can confirm that it works. Nov 24, 2015 at 12:43
  • Would they automatically notify you if the warranty canary is not updated or you have to constantly monitor that?
    – VMMF
    Feb 29, 2020 at 13:39
6

In theory, you can do it. It's all just packets, after all. It would probably not work if you were trying to establish both VPN tunnels from the same machine, but since one goes from your laptop and one from your router...

But you are adding complexity (usually a bad idea) and gaining very little anonymity.

6

I disagree with Graham Hill. This setup should work as you expect, and I believe that it will increase your anonymity.

An alternative would be to connect to the VPN through Tor: this way, the provider wouldn't know where the connections originate from, and the Tor nodes would only see encrypted packets.

In any case, mind the money trail: if you pay for both VPN accounts with your credit card, the (possible) connection logs won't matter.

I should also point out that the choice of the provider matters: some will sell you out quicker than others. Check out this enlightening TorrentFreak article for more info!

5
  • 1
    Tor's bandwidth is already not great and if you include the overhead caused by the VPN it'll probably be almost unusable.
    – user42178
    Jun 12, 2014 at 16:55
  • 1
    But it works, "assuming that speed and latency is of no concern" as OP said. And it's less slow than you might think.
    – executifs
    Jun 13, 2014 at 7:39
  • 1
    Actually you agree with me that it will work and will increase anonymity. My point was that it increases anonymity by a very, very tiny amount ("I'm safe so long as the FBI agent in charge only has one subpoena form left...") and consequently is unlikely to be worth the cost/complexity overhead/risk of introducing new vulnerabilities. Jun 13, 2014 at 11:48
  • 2
    This isn't about the FBI agent having just "one subpoena left": it's not as if he could fill them all at once an send them to your VPN providers (since he discovers them one after the other). This makes the legal process extremely long, maybe impossible if you bounce around countries which do not cooperate (judicially) with the country which is looking for you. So what I'm saying is that it is very worth the risk!
    – executifs
    Jun 13, 2014 at 14:27
  • 1
    I believe this should work too but I am seeking some info from anyone who did it before. Good point about money trail. I would upvote if I had enough reputation Jun 20, 2014 at 14:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .