4

Using ifenslave on two endpoint Linux servers, it's possible to aggregate (aka bond or team) multiple tun or tap interfaces (e.g., tun0, tun1, ...) into a single link, combining bandwidth (less overhead) and improving reliability. SSH or OpenVPN can provide requisite tun interfaces, and either can be routed through Tor between hidden services.

Four questions come to mind:

  1. Would this work?
  2. If it would, how many such tun interfaces could be aggregated?
  3. Might this be what all those Mevade bots are doing?
  4. Is this hypothesis about Mevade testable?

Edit:

With six OnionCat links and MPTCP, I can transfer (bbcp) at ~50 Mbps. With multiple targets, source servers can push ~200 Mbps. It's obviously not very anonymous. But it's probably more anonymous than using VPN services. That's for servers with gigabit uplinks, by the way. Methods are here.

If you're going to be eating up relay bandwidth, it's only fair to contribute. There's little risk or hassle in running entry guards or bridges, and middle relays. Each of the OnionCat links uses two of each. Or you could contribute to TorServers.

Improve this question
1
  • I've been working on this. I have two Crunchbang VMs. Each VM has two interfaces, and each interface accesses Tor through an OpenWRT VM. One Crunchbang VM runs sshd, which is exposed through two hidden services, one through each interface. The other Crunchbang VM can ssh to either hidden service through either of its interfaces. Next I must learn ssh tunneling and bonding. I could also use help with route loading at boot.
    – mirimir
    Commented Oct 15, 2013 at 6:03

2 Answers 2

Reset to default
2

It might work. Tor transports TCP and as you can do OpenVPN over TCP, you can do OpenVPN over Tor.

Other places document how to bond two tun devices, for instance openvpn bond 2 tap tunnels on stackoverflow.

So, while it could work, I'm not sure if it's worth the trouble and network overhead. Probably depends on what you want from your VPN.

I don't know anything about Mevade, but I doubt they actually do a whole IP based VPN with redundant links. Why would they?

Improve this answer
1
  • Thanks. I'd like to have Tahoe-LAFS grids etc hidden in Tor, and that requires more bandwidth than one circuit can provide. As I was writing the question, I thought of all those Mevade bots doing nothing except accessing hidden services. But I guess that they're probably just bots. Unless, that is, someone has some data about the distribution of their IP addresses, that might suggest multiple NICs.
    – mirimir
    Commented Oct 6, 2013 at 9:18
1

You could try MPTCP over multiple onioncat tun links.

There is also mptunnel, where you could expose one openvpn endpoint multiplexed over multiple tor links.

Improve this answer
2
  • Could you please give a brief explanation of how to do this?
    – Andrew Lott
    Commented Mar 30, 2016 at 8:28
  • I finally got around to testing this. It works. Please see edited question.
    – mirimir
    Commented Jan 24, 2017 at 8:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .