3

I have red in the discussion forums of VPN services, such as Private Internet Access, that torrent clients should have certain features disabled to ensure security. For example disable "UPnP Port Mapping" and "Nat PMP Port Mapping". To my knowledge these are techniques to get around NAT which interferes with uploading files. Why would these be threats to the VPNs security/anonymity?

From here

UPnP and NAT-PMP are security risks and should be left disabled. They won't affect port forwarding on the VPN.

and here

You should disable UPnP and NAT-PMP, it's not used with the VPN but could leak your IP.

TL;DR how is UPnP or NAT PMP port mapping a threat to the VPN connection?

2

These protocols are used for inbound port mapping, not outbound port mapping. Inbound port mapping makes it possible for your machine to listen to unsolicited connections from the Internet. When the Torrent client opens these ports and listens, it may not be aware of the VPN connection and will instead advertise your real IP address.

Even if the VPN IP were to be used, with PIA or similar you're likely behind another layer of NAT which is not in your control, and almost certainly has no awareness of these protocols. I.e., it would be non-trivial to manage a listening port on a shared VPN service with hundreds of users per IP.

"The protocol automatically determines the external IPv4 address of a NAT gateway, and provides means for an application to communicate the parameters for communication to peers. " https://en.wikipedia.org/wiki/NAT_Port_Mapping_Protocol

  • What do you mean "even if"? So it's insecure, but even if it was secure, it would be secure? – Det Apr 8 '18 at 21:46
  • I'm not sure what you mean by ".. it's insecure, but even if it was secure, it would be secure?" – mgjk Apr 9 '18 at 7:40
  • I mean, "When the Torrent client opens these ports and listens, it may not be aware of the VPN connection and will instead advertise your real IP address. (So that's a negative) Even if the VPN IP were to be used [...] it would be non-trivial to manage a listening port on a shared VPN service with hundreds of users per IP (So that's a positive(?)... you won't get caught.. but it started with an "even if"?) – Det Apr 9 '18 at 11:35
  • 1
    Thanks I mean even if the VPN IP were to be used, it would be likely to be of no use as the UPnP forwarding wouldn't be supported by a VPN provider. At best, this would not do anything. At worst, it would violate your privacy. – mgjk Apr 9 '18 at 16:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.