4

I have red in the discussion forums of VPN services, such as Private Internet Access, that torrent clients should have certain features disabled to ensure security. For example disable "UPnP Port Mapping" and "Nat PMP Port Mapping". To my knowledge these are techniques to get around NAT which interferes with uploading files. Why would these be threats to the VPNs security/anonymity?

From here

UPnP and NAT-PMP are security risks and should be left disabled. They won't affect port forwarding on the VPN.

and here

You should disable UPnP and NAT-PMP, it's not used with the VPN but could leak your IP.

TL;DR how is UPnP or NAT PMP port mapping a threat to the VPN connection?

Improve this question

1 Answer 1

Reset to default
2

These protocols are used for inbound port mapping, not outbound port mapping. Inbound port mapping makes it possible for your machine to listen to unsolicited connections from the Internet. When the Torrent client opens these ports and listens, it may not be aware of the VPN connection and will instead advertise your real IP address.

Even if the VPN IP were to be used, with PIA or similar you're likely behind another layer of NAT which is not in your control, and almost certainly has no awareness of these protocols. I.e., it would be non-trivial to manage a listening port on a shared VPN service with hundreds of users per IP.

"The protocol automatically determines the external IPv4 address of a NAT gateway, and provides means for an application to communicate the parameters for communication to peers. " https://en.wikipedia.org/wiki/NAT_Port_Mapping_Protocol

Improve this answer
4
  • What do you mean "even if"? So it's insecure, but even if it was secure, it would be secure?
    – Det
    Apr 8, 2018 at 21:46
  • I'm not sure what you mean by ".. it's insecure, but even if it was secure, it would be secure?"
    – mgjk
    Apr 9, 2018 at 7:40
  • I mean, "When the Torrent client opens these ports and listens, it may not be aware of the VPN connection and will instead advertise your real IP address. (So that's a negative) → Even if the VPN IP were to be used [...] it would be non-trivial to manage a listening port on a shared VPN service with hundreds of users per IP (So that's a positive(?)... you won't get caught.. but it started with an "even if"?)
    – Det
    Apr 9, 2018 at 11:35
  • 1
    Thanks I mean even if the VPN IP were to be used, it would be likely to be of no use as the UPnP forwarding wouldn't be supported by a VPN provider. At best, this would not do anything. At worst, it would violate your privacy.
    – mgjk
    Apr 9, 2018 at 16:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .