0

VPNs can often be useful for obscuring personably identifying information (IP, geolocation, etc.) from remote destination servers.

Traffic is routed through a VPN server and forwarded to the destination. As far as the remote destination servers are concerned, the traffic appears to have originated from the VPN server's IP address.

In this sense, the VPN tunnel/server essentially behaves as a proxy, intermediary, or go-between (not unlike a broker); probably not one of the original design goals for this technology, regardless it can often be desirable to exploit (i.e. take advantage of) it's inherent properties to facilitate such a purpose.


However, the IP address from whence the traffic truly originates, will obviously be visible to the VPN server. What solutions exist for hiding (e.g. disguising, obscuring) this information from an untrusted VPN server?

A few ideas immediately come to mind, but suitability, effectiveness, and implementation details are unclear:

  • Encapsulate the untrusted VPN tunnel within a (secondary) trusted VPN tunnel (or vice versa?) (but how?).
  • VPN router firmware (Tomato, DD-WRT, OpenWRT, etc.) with paid subscription service (e.g. ExpressVPN, Nord, PIA) in conjunction with untrusted VPN client on end-user device.
  • Two VPN connections, untrusted VPN in virtual machine, trusted VPN on physical host.
  • Full-tunnel / split-tunnel manipulation.
  • IPv4 forwarding / iptables type magic.
  • SOCKS Proxy and / or TOR chaining (proxychains or similar) (before and / or after vpn connection? encapsulated? serial? both? unsure).
  • Encapsulating with ssh tunnel or vice versa.
  • Something involving torify, torsocks, tsocks, shadowsocks, etc. (more reading required).
  • Something involving self-hosted proxy or VPN solution (privoxy, squid, nginx, openvpn).
  • Something involving a VPS SaaS.
2

You can't.

Someone has to know your address, because someone needs to be able to reach you. You're essentially just putting ever more proxies between you and the server you effectively want to communicate.

 Direct                 Using a                Using multiple
 Connection             VPN Gateway            VPN Gateways

+---------------+      +---------------+      +---------------+
|               |      |               |      |               |
| Your Computer |      | Your Computer |      | Your Computer |
|               |      |               |      |               |
+-+-------------+      +-+-------------+      +-+-------------+
  |  203.0.113.17        |  203.0.113.17        |  203.0.113.17
  |                      |                      |
  |                      |                      |
  v  151.101.1.69        v  198.51.100.6        v  198.51.100.6
+-+-------------+      +-+-------------+      +-+-------------+
|               |      |               |      |               |
| StackExchange |      | VPN Gateway   |      | VPN Gateway 1 |
|               |      |               |      |               |
+---------------+      +-+-------------+      +-+-------------+
                         |   198.51.100.99      v   198.51.100.99
                         |                     ...
                         |                      |
                         v   151.101.1.69       v   169.254.0.19
                       +-+-------------+      +-+-------------+
                       |               |      |               |
                       | StackExchange |      | VPN Gateway N |
                       |               |      |               |
                       +---------------+      +-+-------------+
                                                |   169.254.0.142
                                                |
                                                |
                                                v   151.101.1.69
                                              +-+--------v----+
                                              |               |
                                              | StackExchange |
                                              |               |
                                              +---------------+

As you can see in the above-mentioned graphic, there is always at least one host which has to know your IP address.

7
  • Obviously you need VPNs all the way down... – Fire Quacker Jan 22 at 14:39
  • i agree, that sounds true enough. but the goal isn't to be a total phantom online, just to withhold personal IP information from a single VPN server. – voices Jan 22 at 14:55
  • The third example in your diagram Using multiple VPN Gateways sounds ideal. I haven't had success implementing it in practice. If you can advise how to do so, that would constitute an acceptable answer. – voices Jan 22 at 15:03
  • @voices You can use TOR, which implements the same thing. Your performance however will be awful. – MechMK1 Jan 22 at 19:44
  • @voices what part are you stuck on – multithr3at3d Jan 22 at 23:15
1

What solutions exist for hiding (e.g. disguising, obscuring) this information from an untrusted VPN server?

Yes, don't use an untrusted VPN server.

If your VPN server is untrusted, no cleartext protocol is safe when you route traffic to it. Plain HTTP traffic can be sniffed, altered, and injected with ads or malware. DNS requests can point to another server. Clear telnet traffic to your SunOS sitting on a basement somewhere can be stolen.

If you really need to access that untrusted VPN server, send your traffic to a trusted VPN server before (to hide your IP), and after (to protect cleartext traffic).

But it's easier to use only one trusted VPN service.

5
  • "If you really need to access that untrusted VPN server, send your traffic to a trusted VPN server before (to hide your IP), and after (to protect cleartext traffic)." That sounds ideal, but actually implementing it in practice is the challenge im confronted with. – voices Jan 22 at 14:41
  • Why you have to use the untrusted VPN? It does not make sense... – ThoriumBR Jan 22 at 15:08
  • Various reasons. Various situations. Most often to access shared resources on a private network. Though I imagine there could be countless reasons to use experimental or unusual networking configurations. – voices Jan 22 at 17:12
  • I don't think there would be various reasons to use an untrusted VPN server when there are lots and lots of trusted VPN servers. – ThoriumBR Jan 22 at 18:26
  • No offense, but your opinion about that is really of no consequence to me. My objective is clear and my reasons are my own. Let's not get bogged down debating it. I don't need help deciding why I want to do a certain thing. I don't need anyone to agree with me. These things are outside of the scope of the question. I just need help to make it happen. Even if you think it's pointless. Let's just accept it's something I need to do. – voices Jan 22 at 19:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.