upvote

points

by bradknowles9 hours ago |
comments
upvoteby asdff7 hours ago|
next
[-]
But the isp sits between that no?
reply
upvoteby throwawayffffas6 hours ago|
parent|
[-]
All traffic to the VPN is encrypted, including DNS queries.

All your ISP can tell is you are using a VPN.

reply
upvoteby asdff5 hours ago|
parent|
[-]
What about TLS inspection?
reply
upvoteby Geezus_4212 minutes ago|
parent|
next
[-]
Not unless they can break your VPN's encryption. Which, if your ISP can do that, you have bigger problems.
reply
upvoteby pjc505 hours ago|
parent|
prev|
[-]
What about it? Unless they've hijacked your local cert store somehow (which corporate machines do), they can't see inside the TLS. They can detect that you're connecting to somewhere and probably infer that it's some VPN, but only the most repressive countries actually block VPNs altogether.
reply
upvoteby ozim8 hours ago|
prev|
[-]
So a VPN you set up and run yourself.
reply
upvoteby asdff7 hours ago|
parent|
[-]
Isn’t that the same as no vpn with extra steps? You are tunneling traffic from a computer you own to a computer you also still own. Third party vpn the whole point is I don’t run it.
reply
upvoteby khafra7 hours ago|
parent|
[-]
If you set up a VPN endpoint on a Hetzner box, you're trusting Hetzner not to MITM your DNS queries. They're likely more trustworthy than your local ISP (although that leaves you more identifiable to folks running the servers or snooping on server-side traffic, and Cloudflare will hate you). That threat model tradeoff is good for many people.
reply
upvoteby throwawayffffas6 hours ago|
parent|
next
[-]
Given the OP use case, you are going to get a letter from Hetzner at some point.
reply
upvoteby dspillett4 hours ago|
parent|
next
[-]
Not if they are only using it to route the DNS traffic (though in that case a cheaper VPS might be better), which will work if the ISP is only poisoning DNS replies and not (which is often the case) blocking traffic to the target servers entirely.

The problem with this is you are adding a moving part to your DNS lookups. It might be worth adding two on separate VPS hosts and have your resolver fall back to the second if the first goes down.

Another, usually more minor, problem is that some services (like CDNs) use the source of your DNS query to modify the response so you get sent to a topologically near-by end-point. This means you might notice such services being slower as you are sent to a PoP near your VPN host not one closer to your actual location.

reply
upvoteby ozim4 hours ago|
parent|
prev|
[-]
Oh well OP was doing shady stuff ... then yeah they should continue with using VPN provider. VPN providers are shady AF, I don't think there is VPN provider I would trust more than my local internet provider.
reply
upvoteby asdff6 hours ago|
parent|
prev|
[-]
Well that wouldn’t be running your own vpn. Hetzner is. They’d let you do this? Seedbox is against their tos hard to imagine they’d be a good choice to run a vpn for your linux isos.
reply
upvoteby konart5 hours ago|
parent|
[-]
> They’d let you do this?

Can't speak for Hetzner, but considering VPN use in Russia and China - I'd imagine most EU\US vps providers have someone's 3x-ui, remnawave or naked v2ray installed.

Plus - how are they going to detect your remnawave node sitting on 443 port? For them it's just some traffict.

And if you are worried about the amount (torrents) - you don't really need to torrent though them. You just need an access to a torrect tracker to get your magnet link and meta info.

Most default configs for 'ray have torrents locks for this very reason - you communicate with other people (seeds\peers) directly.

reply
upvoteby gruez4 hours ago|
parent|
[-]
>Plus - how are they going to detect your remnawave node sitting on 443 port? For them it's just some traffict.

What about all the outgoing traffic? That's going to be hard to mask unless you have another VPN for outbound

reply
upvoteby konart3 hours ago|
parent|
[-]
But what's wrong with my VPN talking to, say, youtube (blocked in Russia) or some torrent site (for example to fetch RSS feed of new releases).

Fedora, for example, provides torrent access (including RSS feed) for its releases: https://fedoraproject.org/torrents/45/

reply