12

I just decided to buy a new router that support the OpenVPN protocols called "Linksys E4200". It is a very very good router. I read about Tor Over VPN & VPN over Tor. So my first question is:

  • What the difference between those techniques "Tor Over VPN" & "VPN over Tor"?
  • What is the best methodology to make my connection secured as a rock :) is it Tor over VPN or VPN over tor!? I read about the VPN over Tor is more secured and very good!
  • How to implement the best of them!
  • From the first line I said I will buy a new router that will support the VPN protocols so all my traffic will go through the VPN using my router ... so how could i use that new router to make the best anonymity & privacy for my connection .. i think if i used my new router with active VPN this will be Tor over VPN, right !?
12

Linksys Router

It appears that both dd-wrt and TomatoUSB firmware builds are available for the Linksys E4200. Both dd-wrt and TomatoUSB are Linux-based firmware. Either firmware can run either an OpenVPN client or a Tor client, but not simultaneously.

By the way, while the Linksys E4200 is adequate as a Tor client, it arguably doesn't have enough CPU or RAM to make a good Tor router. Its performance as an OpenVPN client is similarly limited. If you want more than 50 Mbps VPN traffic, you'll need better hardware. And by the way, DO NOT use HideMyAss as your VPN provider. They do not protect their users' privacy! EarthVPN also sells out its users.

Tor Tunneled Through VPN

"Tor tunneled through VPN" means just that. A VPN client running on a local device (computer or router) establishes a virtual private (securely encrypted) network connection (VPN tunnel) to the VPN service's exit server (perhaps through one or more intermediary VPN servers). Instead of seeing your ISP-assigned IP address, Internet observers see the exit server's IP address. It's rather like a virtual NAT router.

The Tor client reaches an entry guard through the VPN tunnel, circuits are established, and so on. Tunneling Tor through VPN is very easy. Both clients can run on the same computer, and the Tor client will connect to entry guards through the VPN. With proper network routing and firewall rules, all applications will connect to the Internet through the VPN tunnel. If the VPN connection dies, there will be no Internet connectivity, for the Tor client or any other application.

VPN Tunneled Through Tor

"VPN tunneled through Tor" is just the reverse. A Tor client running on a local device connects to entry guards and establishes Tor circuits. Then a VPN client connects with a VPN server through Tor. Because Tor can only route TCP traffic, you must run the VPN in TCP mode. Once the VPN tunnel is established, you can route both TCP and UDP traffic through it.

However, the mechanics of tunneling VPN tunnels through Tor is more complicated than tunneling Tor through VPNs. Unless you're a networking expert, the Tor and VPN clients must be on separate machines, or at least on separate virtual machines (VMs). If you run a Tor client on your router, for example, you can run a VPN client on one of your computers, and the VPN will be tunneled through Tor.

Which One To Use?

Which is better, "Tor tunneled through VPN" or "VPN tunneled through Tor", depends on your goals. It may be that you want both, "VPN2 tunneled through Tor, which is tunneled through VPN1". You might even want additional VPN nesting (one VPN tunneled through another) on either side of Tor, in order to further complicate traffic analysis.

With Tor tunneled through VPN, your ISP and associates don't see IP addresses of Tor entry guards. However, Tor traffic can be identified through its fingerprint/signature, and it's possible that it can be detected even though Tor is tunneled through a VPN. However, unless such analysis were performed routinely on all VPN connections, which seems unlikely, Tor users wouldn't be readily identified by ISPs and other local observers. Where discretion is particularly important, users could employ additional obfuscation.

Also, entry guards run by adversaries could not directly see your ISP-assigned IP address. With one VPN, it's not hard to trace users. But nested VPN chains (comprising 2-4 VPNs, tunneled in succession) take more effort to compromise, as long as all of the VPN services have many users, and if there are no money trails linking you to the VPN providers. The risk of compromise can be further reduced by using VPN providers that operate in poorly-cooperating spheres of influence.

With VPNs tunneled through Tor, all of your traffic through Tor exit relays is encrypted by the VPN. However, VPN exits can see any unencrypted traffic, just as Tor exit relays can. Using VPNs tunneled through Tor gives you a stable IP address, and allows you to access sites that block Tor exits. As noted, you can freely use any application over the VPN, as long as the VPN tunnel has been properly secured by routing and firewall rules.

On the other hand, tunneling VPNs through Tor reduces anonymity, because the circuit persists until the VPN connection is interrupted. That can be a long time, because VPN tunnels by design are very persistent and fault tolerant. Also, because traffic through the VPN doesn't interact with the Tor network, you won't be able to access Tor hidden services (except through Internet-to-Tor gateways).

Tunneling a VPN through Tor would be appropriate where you want to establish a persistent online pseudonym, and freely use all Internet resources and protocols, and yet do not want any of that to be linked to your true name and ISP-assigned IP address. In doing that, you're trading full Tor anonymity for usability. Indeed, if you're creating a persistent pseudonym, it's advantageous to create a highly-interconnected graph of Internet usage, because you look more like the rest. Indeed, you can create a complex network of identities, with some (such as mirimir) that seem to be pseudonyms for others (redacted).

Implementation

There are many ways to implement these setups. If you want a VPN or Tor client on the router, you'll probably need to decide which. It may be possible to have both clients installed on the router, and toggle between them at boot. But I don't know whether the Linksys E4200 has enough flash storage for both, or how hard it would be to toggle between them.

In my opinion, it's best to use either no client on the router, or the OpenVPN client. I like the flexibility of connecting directly (no VPN or Tor) for activities under my true name. And I prefer that my ISP and associates see that I'm using a VPN service, rather than Tor. That's because Tor use is arguably less common, and so attracts more attention. I run various VirtualBox host machines, with gateway VMs for VPN services and Tor, Linux workspace VMs and LiveCD VMs, Whonix VMs, and so on. For some work, I use such host machines as multifunction (VPN and Tor) routers for other host machines.

If you want more specifics about implementation, please ask a more specific question.

  • I like you reply but because it is long it is also harder to read especially if I am searching reply for a particular sub-question. Would you please consider adding headers to the text and possibly highlight (by bold font) terms being explained? Thank you. I can imagine these headers: Linksys Router | Tor Over VPN | VPN Over Tor | Which One To Use? | Implementation – pabouk Oct 9 '13 at 20:12
  • Very good answer & very helpful with a lot of good details, thank you so much :) . i think this methodology "VPN2 over Tor over VPN1" will work perfect for me for now, i'll test it after that if i have any other Qs i will tell you. and i'm using cyberghostvpn perfect & not selling users info. but why i can't access Tor hidden services through the VPN !? thanx again :) – user1634730 Oct 10 '13 at 0:17
  • I tried to draw "VPN2 over tor over VPN1" to simplify your idea if there is anything incorrect in the implementation please tell me image hosted on flickr: farm3.staticflickr.com/2861/10179291013_3c9c202577.jpg – user1634730 Oct 10 '13 at 0:56
  • 1
    @user1634730 - You can't access hidden services through the VPN because traffic through the VPN doesn't interact with the Tor network. You would need to use a Web-to-Tor gateway for that. – mirimir Oct 10 '13 at 1:12
  • 1
    1. As an addition to With Tor over VPN, your ISP and associates don't see so easily that you're using Tor, see VPN/SSH Fingerprinting. 2. Can you please comment here what you mean by so easilyin this sentence: and Tor entry guards don't so easily see your ISP-assigned IP address? 3. What do you think about adding user -> VPN -> Tor, user -> Tor -> VPN and user -> VPN -> Tor -> VPN to make it absolutely clear for anyone what Tor over VPN or VPN over Tor is referring to. – adrelanos Oct 10 '13 at 6:46
4

VPN must be considered more of a circumvention tool rather than an anonymity tool. Even for circumvention Tor stands very well in cases that public known entry nodes are blocked, with the use of (obfuscate) bridges.

If you're seeking anonymity Tor is the way to go. Tor is using a three-hop circuit to establish an anonymous path to your destination. No single node is aware of the whole path, thus is unable to identify you and your destination.

When you use Tor over VPN, the VPN provider is able to know that you're using Tor and your entry node. The upside is that you're hiding the fact that you're using Tor from your ISP. Have in mind that various VPN providers have logged and given away users' information, whereas there is not such incident with Tor. That doesn't mean that your adversary is not operating a Tor node. It's just that Tor is designed (see guard nodes) in order to minimize the adversary's power that controls a number of nodes. Using Tor over VPN doesn't not enhance your anonymity, in fact it introduces another "player" in your way to the Internet. Using Tor over VPN would make sense only in extreme cases when Tor's circumvention (bridges) doesn't work due to a high-tech oppressing environment.

When you use VPN over Tor, you are hiding your identity from the VPN provider but that's all you hide. Neither this scheme offers you anonymity, on the contrary VPN provider does know all your exit traffic and at the same time you have lost the advantage of Tor which uses different paths to the destination. VPN over Tor will use pretty much the whole time the same IP address to reach the destination. That enables profiling of your internet habits and degrades your anonymity. Still, there is a use case when VPN over Tor could be used : when you want to reach a service that blocks tor exits.

To conclude, using a VPN does not offer any additional anonymity and should be the last refugee in case (obfs) bridges of Tor don't work.

  • from the first answer "@mirimir" give me a good choice for a new methodology "VPN2 over Tor over VPN1" whats ur opinion about it?, is it will give me more anonymity!? and privacy too from VPN providers & my ISP !? thanx for your reply i'm really appreciate that :) – user1634730 Oct 10 '13 at 0:08
  • 1
    If my ISP knows that I'm using Tor, then it's easy for my government to also know. I don't want that. It's true that the VPN provider sees my Tor traffic. But, if the provider is in a country with better privacy laws, or is prepared to resist compromise, I'm better off. Using VPNs over Tor is useful when Tor alone is unworkable. I agree that it's less anonymous. But it's not necessary to be anonymous all the time. I'm not anonymous as mirimir. But I am not so easy to find. Tor, VPNs, etc are all tools, and each tool has its uses. – mirimir Oct 10 '13 at 1:38
  • 1
    @alaf - Let's say that I want to access, as anonymously as possible, a website that blocks all Tor exit relays. What would you suggest? – mirimir Oct 10 '13 at 1:51
  • 1
    Hiding Tor from your ISP by using a VPN stands on very shaky ground, see VPN/SSH Fingerprinting. – adrelanos Oct 10 '13 at 6:41
  • As I understand it, Xiang Cai and coworkers show that neither VPNs nor Tor can prevent website fingerprinting. Isn't it quite a jump from website fingerprinting to detecting some Tor-specific fingerprint that reveals Tor traffic within VPNs? And even if VPNs can't entirely hide Tor traffic, they hide it better than doing nothing does. Also, I don't see why other approaches for obfuscating Tor traffic couldn't be used together with VPNs. – mirimir Oct 10 '13 at 7:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.