ipleak.net can expose airvpn tunneled via ssl or ssh?

[uldch 0]

Hello,

 

i wonder why ipleak.net is able to show that i am using the airvpn service although my vpn protocol is set to SSH / SSL.

 

so is this statement wrong -> "OpenVPN typical fingerprint can not be detected anymore. Useful if you live in a country which tries to disrupt OpenVPN connections when detected." or do i miss something?

 

Best regards

 

 

[Staff 10022]

Hello,

 

i wonder why ipleak.net is able to show that i am using the airvpn service although my vpn protocol is set to SSH / SSL.

 

so is this statement wrong -> "OpenVPN typical fingerprint can not be detected anymore. Useful if you live in a country which tries to disrupt OpenVPN connections when detected." or do i miss something?

 

Best regards

 

It compares your system IP address with all the Air VPN servers exit-IP addresses.

 

Kind regards

[pr1v 36]

If I remember well, http://www.browserleaks.com/whois always exposed that I was using Openvpn too, when using ssh or ssl. But I can´t be totally sure, you can test it.

[Staff 10022]

If I remember well, http://www.browserleaks.com/whois always exposed that I was using Openvpn too, when using ssh or ssl. But I can´t be totally sure, you can test it.

 

 

That's based on the detected "fingerprint" by the final service, when packets are all out of the tunnel. It is a different issue than hiding OpenVPN between your node and the VPN server (typically where your ISP observes you). See WITCH for the original code http://witch.valdikss.org.ru/

 

At the moment you can make WITCH unable to recognize OpenVPN usage in UDP by selecting unusual mssfix parameters.

 

Interesting to compare with this:

https://airvpn.org/topic/17709-netflix-how-to-accessuse-it-when-vpn-is-connected/

 

Kind regards

[uldch 0]

It compares your system IP address with all the Air VPN servers exit-IP addresses.

 

so if you live in a country which tries to disrupt vpn technology, the state just needs to cache all exit ip adresses of popular vpn services and you are done, right?

[zhang888 1066]

 

It compares your system IP address with all the Air VPN servers exit-IP addresses.

 

so if you live in a country which tries to disrupt vpn technology, the state just needs to cache all exit ip adresses of popular vpn services and you are done, right?

 

Explain what do you mean by that. They can probably buy accounts on most popular VPN services and scrape their IP and block them.

This never happened before and I am not aware of any country that permanently blocks access to Air's servers on a country scale.

Some ISPs tamper with the OpenVPN protocol using DPI, and this is why SSL/SSH comes to help.

Nevertheless, they are not able to decrypt your traffic in any mode, even without using SSL/SSH.

[uldch 0]

Explain what do you mean by that. They can probably buy accounts on most popular VPN services and scrape their IP and block them.

This never happened before and I am not aware of any country that permanently blocks access to Air's servers on a country scale.

Some ISPs tamper with the OpenVPN protocol using DPI, and this is why SSL/SSH comes to help.

Nevertheless, they are not able to decrypt your traffic in any mode, even without using SSL/SSH.

 

I agree. Thank you all for your responses

[Staff 10022]

 

It compares your system IP address with all the Air VPN servers exit-IP addresses.

 

so if you live in a country which tries to disrupt vpn technology, the state just needs to cache all exit ip adresses of popular vpn services and you are done, right?

 

No: blocking exit-IP addresses would have an impact only on services inside that country, but would allow a citizen to connect to our VPN servers and go out on the rest of the world. They would need to harvest different IP addresses (entry-IP addresses of course, and many other ones that of course we will not mention here). Additionally, you can easily imagine a way to circumvent even this block if you think about all the connection abilities of OpenVPN, even cited in this thread...

 

Kind regards