What is VPN?
In layman's terms VPN is a way to encrypt all your internet traffic between you and us and pass it out through
us. Those on your local network, whether a public wifi or other unsecure location, will be unable to see what you
do or the data you pass.
In addition, your IP is shielded for everything you do, meaning sites you connect to will be unable to determine
your true physical location. Should you make forum posts, send IM messages, send e-mail, skype, or any other form
of Internet communication the IP shown will be that of the VPN server.
How does it differ from SSH tunneling?
The VPN differs from the SSH tunnels or socks proxies in that those types of proxies only work with TCP traffic
and only with applications you configure to use them. This is why you must change your proxy settings in your browser
when using SSH tunneling.
In addition, some applications are unable to be configured to use a proxy, so you just cannot use those with SSH
tunnels. Even worse, some applications can bypass the proxy deliberately (which is why it is recommended that you
shut off Java and such with the SSH tunnels).
VPN solves these issues. It works with all traffic. You don't have to change settings in anything. It all passes
through an encrypted tunnel from your machine to ours and out our network. No more need to disable java because
it might try to bypass the proxy.
No more issues with some sites not working right. No more issues with some Internet applications not working with
the proxy. Just connect to the VPN and use everything normally, no special proxy settings are needed.
Just as with SSH tunneling, you should continue to use SSL connections (ie. https, imaps, pop3s, smtps, etc), the
VPN is an encrypted pipe only between you and us, SSL is between you and your destination. You still want to be
using encryption where available for that.
Sounds great, what are the drawbacks?
First we have speed. While much more reliably faster than our SSH tunnels, and certainly not slow, it probably
won't be as fast as your ISP connection. Many of you are on fast connections, some 10 Mbit and even 50 Mbit residential
(your ISP is seriously overselling, not to mention likely quoting speeds only found on their internal network and
not available to the outside Internet).
Anyway, you won't see those many megabit speeds through the VPN. That would cost far more than $14.95 a mo. That
would be more like $499-$999 a month (depending upon whether 10 Mbit or 50 Mbit dedicated stream). It will be fast
enough, though. Web pages will be quick, Internet radio will work, Skype will work, video streaming will work,
everything should work.
We cannot guarantee steady HD streaming in all it's glory, that's a lot
of bandwidth and someone steadily using large amounts of bandwidth is going to have an adverse effect on others,
we will have to address heavy bandwidth use. You'll be able to do some (depending upon stability of your route
to us), but not 24 hours a day.
Pretty much anything you run should work and although maybe not optimal, it all will be fast enough to be comfortably
useable. Some of you on DSL and other slower connections will notice no speed drop at all.
To connect to our VPN you will likely be passing through fourteen (14) or so different routers getting from your
ISP to us. If any one of those routers starts experiencing packet loss (such as your local ISP's seriously oversold
links), this will affect your VPN connection. ISPs oversell their residential customers, banking on not everyone
using their bandwidth at once. Unfortunately many do. So they compensate by prioritizing packets, working to keep
the web snappy and customers thinking they are fast.
Unfortunately, prioritizing one type of traffic means you are doing so at the detriment of other types of traffic.
VPN and SSH may be at the low end of what your ISP considers priority traffic. This can cause slow speeds and disconnects.
There may even be times you cannot connect to the VPN (if one router between you and us temporarily has issues
(nothing runs flawlessly forever)).
Connection drops can be dangerous, depending upon why you are using the VPN. They are dangerous because if you
are not paying attention your computer might automatically route the traffic normally again. So if you were trying
to hide your traffic from your ISP, or your location from some site, it might just become visible to them.
SSH handles this better because your application simply stops working if the tunnel drops. With VPN you can always
continue to use SSH within it so that traffic is guarateed to stop if you need to do so. In addition, there are
utilities to monitor your VPN and automatically reconnect if it drops.
Caveat: DNS Leaks
VPN connections, especially PPTP VPN connections, are susceptible to DNS leaks under certain operating systems and configurations. To find out more
visit our page on DNS Leaks.
Tell me more
We offer two types of VPN service, PPTP and OpenVPN. PPTP is so widespread that it is likely that even your phone
supports it. However, it is the weaker of the two. OpenVPN is stronger and works more reliably in blocked locations.
However, support for OpenVPN is not as widespread and there may not be a client for your device or OS, or the
one available may be difficult to install and configure.
PPTP must be correctly configured on the server to be fairly secure. We have configured ours in a secure manner.
It is not a Microsoft VPN server, we run BSD, it does require 128 bit encryption, we do deny mschapv1, it is stateless,
and we do force a longer non-dictionary password (for those of you who do not understand what all of that means,
it means it's configured to be as safe and secure as possible).
That said, a determined attacker with local access to your datastream may be able to capture your encrypted VPN
password hash from the stream and attempt to decrypt it. If he can get the hash, whether or not he can crack it
depends upon your choice of password. A strong password won't be cracked.
What do they get if they do crack your VPN password? Well assuming it is not also the password to everything you
own, they just get access to our VPN server, meaning they can log in as you and use it. In addition, the main weakness
of the encryption is that it uses your password as a key. This means that if you use a stupidly simple password
that can be easily cracked, they can also theoretically decrypt your VPN traffic.
The main issue with a PPTP VPN, as touched on above, is that while it does use 128 bit encryption, it uses your
password as a key to the encryption. In effect, this means that if you use a weak password, you have weak encryption.
If you use a strong one, the encryption is stronger. It is extremely important with PPTP to use a strong password.
If you are going to use a word from a dictionary, you may as well not even bother using PPTP and just connect directly
(this is why we force non-dictionary alphanumeric terms. A word in any
dictionary will have your password hash cracked in less than 10 minutes, a password using just lowercase random
letters may take a half hour, a shorter random upper and lower case password, perhaps a few hours to a day, while
l0phtcrack will just run forever trying to brute force a longer mixed case alphanumeric password.
Addendum: Using numbers for your vowels is old news, a simple regex to run that against dictionary words will crack
those. We recommend that you be more creative).
PPTP VPN is only secure if the drawbacks are understood and countered.
We do expect that you'll still use strong GPG/PGP encryption and SSL within the VPN for your e-mail and other services.
So in that manner it's a big step up in protection from what you are already doing. To be the safest, you may even
continue to use your SSH tunnels within the VPN (although this will slow it down some for you) and have all the
safety of the SSH tunnels with the additional protection and functionality of the VPN.
OpenVPN has none of the weaknesses of PPTP. It is a certificate based
encryption using Blowfish, a strong uncrackable algorythm. It uses a strong TLS authentication. Your password
hash can not be retrieved from it's data stream like with PPTP. It is not as subject to connection issues. Where
PPTP is weak, OpenVPN is strong.
OpenVPN, unlike PPTP can also be proxied via a socks or http proxy. It runs on common ports looking to your firewall
like it is either a https web site, an encrypted e-mail connection, or an encrypted IM connection.
The big drawback of OpenVPN, it can be difficult to install, run, and configure for non Windows users.
With our service you can choose which VPN you want to use and/or bounce between them as needed.