3

When I'm connected to a OpenVPN server and visit http://ip-api.com/ I get this:

OpenVPN UDP bs128 SHA256

Can somebody explain to me how this is possible and how can I stop this information leak?

0

3 Answers 3

2

It is possible to infer the usage of a VPN from patterns in the communication.

If you are using a tunnelling technology like IPsec, L2TP, or PPTP, your packets are incapsulated inside other packets, so the useful part of the packet might be smaller than in a classic network. MTU and MSS are two important pieces of data about the sizes of the incapsulated packet and the final packet.

Maximum Transmission Unit (MTU) is the maximum data that can be transmitted in one packet. Every network has a MTU value, be it a local network or the internet backbone. The most common value is 1500, but there are some exceptions. When using a VPN, your OS sends smaller packets by setting lower MTU values in order to prevent fragmentation in the network that might reduce bandwidth and latency.

When a web browser or any other software that communicates on the network creates TCP connections, it sets Maximum Segment Size (MSS) value in the TCP header, which informs the receiver of the maximum TCP data size the transmitter can receive without packet fragmentation. This is very similar to MTU.

OpenVPN is a VPN software suite that is more specifically detected because it works in a different way than other VPN software. OpenVPN decreases MSS instead of interface MTU. By decreasing MSS like this, it is possible to further detect the encryption being used because a certain combination of protocol, block size (bs), MAC and compression will generate specific MSS sizes.

Fix this information leak in OpenVPN by changing the mssfix directive in the OpenVPN config file to different values like 1420, 1360 or 0 (experimental).

1

How is that possible ? Well: Firefox and Chrome implement WebRTC that allows requests to STUN servers be made that will return the information you see on sites such as ip-api.com.

Also the ISPs uses for sure Deep Packet Inspection (DPI) techniques to inspect traffic so that is why your OpenVPN is detect.

How to avoid such situations ? Many solutions are available, but the one I like the most and which does not need efforts to use (and does not cost anything) is to run Tails on a USB stick so that you protect your privacy and anonymity.

But if you do not like easy solutions then you can tunnel your OpenVPN via an HTTP proxy.

0

Can somebody explain to me how this is possible...

  • The IP ranges are registered for the company, so a quick Whois can reveal this information. Also a reverse DNS query might reveal the company's URL too.

...and how can I stop this information leak?

  • You could use a another proxy server or TOR to hide that information

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .