Skip to main content
30 votes
Accepted

What are the advantages of paying for a VPN service as opposed to hosting your own?

VPNs are designed around the concept of trust between 2 or more parties, and were intended for corporate/enterprise use. The popularity of offering "Free VPN" or "Hosted VPN" solutions to the ...
dark_st3alth's user avatar
  • 3,022
30 votes
Accepted

OpenVPN kill switch on Linux

You should use a simple firewall which does nothing more than block all non-OpenVPN client output to the outside. Don't simply whitelist port 1194 or you will allow trivial deanonymization. Instead, ...
forest's user avatar
  • 66.9k
20 votes
Accepted

How to generate a unique and uncopyable VPN certificate/key for a specific client hardware device?

You can generate a virtual smart card on a Trusted Platform Module (TPM). A TPM is like a Hardware Security Module (HSM), except that a TPM is physically attached to a computer's motherboard and thus ...
vrtjason's user avatar
  • 1,125
18 votes

Is there any way to prove that VPN doesn't collect data?

No, there is no way for a VPN provider to prove they don't record any data. They have to process your original traffic at some point and can't prove afterwards that they deleted it without any copies. ...
Arminius's user avatar
  • 44.9k
12 votes
Accepted

Does using a VPN protect against KRACK?

A (properly configured, secured protocol) VPN connection will not protect you from being "forced" to join the malicious access point, but it will prevent your communications from being eavesdropped on....
DKNUCKLES's user avatar
  • 9,217
12 votes
Accepted

Is it possible to detect VPN in the network?

The OpenVPN protocol makes no attempt to hide its presence. The protocol itself is briefly described at the end of the documentation. Note that, even if you manage to obfuscate the protocol itself, it ...
forest's user avatar
  • 66.9k
10 votes

What are the advantages of paying for a VPN service as opposed to hosting your own?

Anonymity If you use the VPN to hide your activity, this is less than ideal. To use it as a proxy, someone else clearly needs to host the exit point. Using a machine registered to you personally ...
J.A.K.'s user avatar
  • 4,853
9 votes

Difference between SSH Tunnel / Proxy and VPN in terms of security

SSH SSH is at its heart a secure shell. It was originally designed as a encrypted successor to telnet. It can, however, do so so much more! For your uses, you are specifically looking at dynamic ...
CaffeineAddiction's user avatar
8 votes
Accepted

Is there any way to set up home-made VPN with encryption so ISP cannot see data?

TL;DR: The answer to your question is no, but you're asking the wrong question. I think you might be a little confused about how Internet servers (including VPN servers) operate. Your ISP can read ...
CBHacking's user avatar
  • 49.2k
8 votes

Difference between SSH Tunnel / Proxy and VPN in terms of security

People often speak of SSH tunneling as a poor man's VPN. It is exactly the same on a feature and security point of view: you establish a secure tunnel between the client and a relay host and let a ...
Serge Ballesta's user avatar
8 votes
Accepted

What are the risks of installing a CA on the same machine as OpenVPN server?

The OpenVPN documentation being referred to is the Getting started How-To on the OpenVPN Wiki. Specifically, this paragraph: BEWARE: One common mistake when setting up a new CA is to place all the ...
Ajedi32's user avatar
  • 4,763
7 votes

How Anonymous Am I?

It depends on what you are doing. If you're running BitTorrent from your laptop, you aren't anonymous at all, for instance, since it publishes your IP. If you log into your email, or your Facebook, ...
returneax's user avatar
  • 572
7 votes
Accepted

Is OpenVPN actually forwarded over TLS?

Openvpn uses TLS for authentication and key exchange but it does not use it for the actual data encyption. When running on UDP openvpn runs the TLS session on top of a custom "reliability layer", i'm ...
Peter Green's user avatar
  • 5,300
7 votes
Accepted

Did I just give away my credentials by trying to connect to the wrong VPN?

No. OpenVPN is constructed in a way that the client and server will mutually authenticate each other, so the credentials is never sent over the wire. Also, in addition to this, the validation is ...
sebastian nielsen's user avatar
7 votes
Accepted

Wireguard: Is it suitable for road-warrior scenarios?

Yes, WireGuard does an extremely good job at preserving your connections even if your local IP keeps changing. Wireguard connections are also super fast to establish, such that if you suspend your ...
mricon's user avatar
  • 6,538
7 votes

What is the impact of OpenVPN SECLEVEL=0?

From man 1 ciphers: The cipher string @SECLEVEL=n can be used at any point to set the security level to n, which should be a number between zero and five, inclusive. See SSL_CTX_set_security_level ...
Joseph Sible-Reinstate Monica's user avatar
6 votes

Why does OpenVPN have reneg-sec on 3600?

Shorter key lifetime = less time for an attacker to a) capture known-plaintext packets and b) somehow crack the key. Also, a leaked key will only help an attacker gain access to your communication for ...
Marcus Müller's user avatar
6 votes

Is it safe to provide others with a VPN server at home?

You can do it mostly safely with combination of technologies. You will be able to mitigate most of the issues except the illegal activities one. Their outbound traffic will be originating from your ...
EvilTorbalan's user avatar
5 votes
Accepted

Is it okay to use random OpenVPN config files?

A VPN endpoint is able to read and manipulate all your traffic (a Tor exit node too). Thus using some .ovpn file you just found on the internet means that you offer all your traffic to some unknown ...
Steffen Ullrich's user avatar
5 votes
Accepted

How are DNS requests sent when using OpenVPN? Are they encrypted?

In a default configuration, all traffic (including DNS) should be routed through an OpenVPN tunnel. However OpenVPN in itself does not provide mechanisms to enforce all traffic being routed via its ...
techraf's user avatar
  • 9,139
5 votes
Accepted

Does TLS authentication encrypt username as well as password?

If I'm reading your question correctly, you're connecting to your VPN using a combination of TLS client authentication and username / password combination. In this case a MitM attacker can read the ...
SEJPM's user avatar
  • 9,780
5 votes
Accepted

Suspicious about no-log VPN policy - anyone care to prove me wrong?

The system can see how many concurrent sessions you are running, that's the nature of the system you're using, but they don't record that information anywhere for archival purposes. So they can't, ...
Ryan Kelso's user avatar
  • 1,220
5 votes
Accepted

Why does OpenVPN use two channels and not just TLS?

There's some truth in the other answers, but the primary reason is different: because OpenVPN was designed as IP-over-UDP, while TLS runs over TCP. Futhermore, the initial versions of OpenVPN did ...
Steffan Karger's user avatar
5 votes

Can personal VPN help protecting my behavior on the company laptop?

Yes. You should use the device you own to privately do anything. Apple Configurator 2, which is used to configure corporate owned Apple devices, is able to ensure that the users’ web traffic ...
John Doe's user avatar
  • 124
5 votes

Why do most VPN protocols work on the Transport Layer and not on the Network Layer instead?

I think you are confusing what the VPN is using to transport the encrypted data vs. what the VPN provides. You look at the first while you should instead look at the second. A VPN provides a virtual ...
Steffen Ullrich's user avatar
4 votes

How can OpenVPN be free?

OpenVPN is a piece of software that you can install on your machine, not server you can connect to. There are of course certain sites that offer free VPN services using OpenVPN and those could indeed ...
Julie Pelletier's user avatar
4 votes

Is it okay to use random OpenVPN config files?

Based on a blog post responding to your question I guess it's not OK even for the file itself, which can contain remote code execution instructions, not talking about a third-party able to sniff your ...
ascobol's user avatar
  • 201
4 votes

OpenVPN's new tls-crypt option

The tl;dr reply is: Yes, your understanding is correct. In TLS mode, OpenVPN establishes a TLS session to perform a key exchange over that TLS session to obtain the keys used to encrypt/authenticate ...
Mecki's user avatar
  • 643
4 votes

OpenVPN vs. Closed Source

OpenVPN is a trusted well used open source vpn application as you know. At the end of the day if your third party doesn't want to use it and you have no contractual power to decide the use of OpenVPN ...
ISMSDEV's user avatar
  • 3,280
4 votes
Accepted

VPN profile working in Iphone

Your base assumption is correct, your VPN provider is very literally a MitM and can use that position to conduct all the questionable snooping and tampering an attacker can normally do. As you said, ...
dFrancisco's user avatar
  • 2,731

Only top scored, non community-wiki answers of a minimum length are eligible