Encrypt all the things!

Posted on
Page
of 138
  • Yeah, in comparison... I have a 16-port gigabit switch under my desk and every damn port has a cable coming out of it.

    My electric bill is also fairly nuts.

    For your scenario... just a router is already enough already. You could get by just using PIA on the devices themselves.

  • Last question... Will one PIA account/subscription work across multiple devices?

    Edit: Just found the info, up to five devices... Win!

  • That was easy, just set my MBP and N5 up in moments... Nice... Thanks for the tips!

  • I still haven't got around to customising my nt 66 router. One day... Maybe.

    Deep Web film...

    http://www.deepwebthemovie.com/#land

  • The firmware is really easy to install, and once configured you can save the config and apply it each time you upgrade.

    Solves a whole load of issues too, such as the patch for the heartbleed bug.

    Get the firmware for the RT-NT66U from here: http://www.lostrealm.ca/tower/node/79

    Specifically the changelog is here: http://www.lostrealm.ca/asuswrt-merlin/changelog.txt
    And the downloads are here: https://www.mediafire.com/folder/bkfq2a6aebq68/Asuswrt-Merlin

  • The problem is if it fails, I've got to use my phone to look up fixes and all that guff. Chicken and egg (kinda). Yeah, I know I should do it, but like most people I'm sure I'm reactive not proactive with this kind of thing. I've had that lostrealm url in my todo list since the 21/10 last year! :S

  • It's worth doing just for "LED control - put your Dark Knight in Stealth Mode by turning off all LEDs"

  • Ok, downloaded https://www.mediafire.com/folder/bkfq2a6aebq68/Asuswrt-Merlin#2324w3jh7e4q4.

    Installation (https://github.com/RMerl/asuswrt-merlin/wiki/Installation) says "Just flash it the same way you would flash any regular Asus firmware." except I have no idea how to flash regular Asus firmware. Does it have a USB slot or something?

  • Really happy with the PIA account... Thanks to all for the advice...

  • I got my internet upgraded to 120mbps now... PIA to local place, I loose ... well can't tell. Speed tests come out basically the same even encrypted. That said, that's on my PC which has easily enough grunt to handle it. On my other devices it tops out around 10mbps (as we've previously mentioned). I'm still waiting for some custom hardware I ordered to turn up so I can just VPN the whole flat and be done with it.

    Oh, one other side problem with VPN everything. I've noticed more and more sites are blacklisting PIAs ip addresses. Cyanogenmod is the latest I found. Go to their forums on the Cali IP and I get a banned message. Also google randomly refuses to work saying there's spamming from this IP.

  • Sign in to your hub via the web interface, it's possibly http://192.168.1.1 or something like that.

    On the bottom left there is an "Administration" category, and within that a tab for "Firmware Upgrade".

    You need to extract the .zip you downloaded locally, and using the form on the Firmware Upgrade page pick the .trx file you extracted and upload it.

    Once it has flashed, it will require you to reboot it. When it comes back up, the interface will be slightly different (more recent)... then you configure however you like.

    In future Administration > Restore/Save/Upload Settings will mean that you don't have to config anything again.

  • I've noticed more and more sites are blacklisting PIAs ip addresses. Cyanogenmod is the latest I found. Go to their forums on the Cali IP and I get a banned message. Also google randomly refuses to work saying there's spamming from this IP.

    We do that too.

    But let's be clear, we don't blacklist PIA IP addresses, or Tor addresses. But we, like a hell of a lot of sites, subscribe to IP reputation services. If an IP address is being used to spread malware, hack stuff, send spam, etc... then the IP has a lower reputation and beyond a certain point will be blocked.

    The problem with anonymising VPN services is that they are used by people doing stuff like that, so it harms the reputation of the IP and then services start getting blocked.

    This is why I use PIA the majority of the time but still have iVPN as a backup in case a service is blocked.

  • Cheers. Found what I needed and upgraded the little bugger.
    Not sure what to configure but at least that step has been done.

  • yeah so I plan to do something a little over the top with split tunnels

    PIA main link
    iVPN back up

    If it gets blocked on PIA, add a route to use iVPN instead. If it's blocked there too, maybe add a fall back "ok, just get the page unencrypted" route.

  • I use a Raspberry Pi with iptables masquerading for encrypting some of my traffic. It runs at about 80% CPU with 7Mb/s passing through it. In my case the connection is the bottleneck though :( I have the config (barring credentials) in puppet if anyone wants a copy.

    Something like a bay trail nuc would make a good little replacement if I could ever get a faster connection.

  • You're not going to get better speed with a Pi.

    It's nothing to do with the CPU, but everything else around it. The network interface actually goes over USB, and the south bridge that connects that USB interface to the CPU is particularly poor, as are the Qualcomm drivers that go with it.

    It's adequate enough for HD video, but tops out around 10Mbps which means that it's the interconnects that are your bottleneck and not the CPU.

    This is why I bang the drum about better motherboards a lot of the time (get a small form-factor PC over a Pi, or a workstation over a PC, etc)... the CPUs nowadays are all damn powerful for what they are, generally over-powered for their use. But... the north bridge (shifts data from RAM to CPU) is usually not good enough for the kind of RAM we see now (4GB+), and the south bridge (shifts data from everything attached to a motherboard that isn't RAM to and from the RAM and CPU) is usually quite dire.

    The Pi achieved their low chip count by doing such trickery as wiring the RJ45 directly into the USB system, and the USB system is the lowest of all external interfaces and is orchestrated by a Qualcomm chip, for which the drivers aren't great.

    The Pi is wonderful, don't get me wrong... but it's not going to give you more than 10Mbps are a network interface and it's going to get very hot whilst doing that as the south bridge isn't cooled.

  • Oh, and you can confirm this: sudo lshw

    That shows the motherboards view of the world.

    On my workstations the network section looks like this:

            *-pci:4
                 description: PCI bridge
                 product: 82801JI (ICH10 Family) PCI Express Root Port 5
                 vendor: Intel Corporation
                 physical id: 1c.4
                 bus info: pci@0000:00:1c.4
                 version: 00
                 width: 32 bits
                 clock: 33MHz
                 capabilities: pci pciexpress msi pm normal_decode bus_master cap_list
                 configuration: driver=pcieport
                 resources: irq:89 ioport:2000(size=4096) memory:fc000000-fc0fffff ioport:df500000(size=2097152)
               *-network
                    description: Ethernet interface
                    product: NetXtreme BCM5764M Gigabit Ethernet PCIe
                    vendor: Broadcom Corporation
                    physical id: 0
                    bus info: pci@0000:02:00.0
                    logical name: eth0
                    version: 10
                    serial: 00:1f:29:06:d1:41
                    size: 1Gbit/s
                    capacity: 1Gbit/s
                    width: 64 bits
                    clock: 33MHz
                    capabilities: pm vpd msi pciexpress bus_master cap_list ethernet physical tp 10bt 10bt-fd 100bt 100bt-fd 1000bt 1000bt-fd autonegotiation
                    configuration: autonegotiation=on broadcast=yes driver=tg3 driverversion=3.134 duplex=full firmware=5764m-v3.35 ip=192.168.1.9 latency=0 link=yes multicast=yes port=twisted pair speed=1Gbit/s
                    resources: irq:100 memory:fc000000-fc00ffff
    

    Note that the network info hangs under the PCI bridge section and that the card is allocated IRQ under resources... the workstation treats this as a physical extension of the motherboard.

    On the Pi this shows like this:

      *-network:0
           description: Ethernet interface
           physical id: 1
           logical name: eth0
           serial: b8:27:eb:73:6a:f9
           size: 10Mbit/s
           capacity: 100Mbit/s
           capabilities: ethernet physical tp mii 10bt 10bt-fd 100bt 100bt-fd autonegotiation
           configuration: autonegotiation=on broadcast=yes driver=smsc95xx driverversion=22-Aug-2005 duplex=half firmware=smsc95xx USB 2.0 Ethernet link=no multicast=yes port=MII speed=10Mbit/s
      *-network:1
           description: Ethernet interface
           physical id: 2
           logical name: eth1
           serial: 00:80:8e:8a:92:8d
           size: 100Mbit/s
           capacity: 100Mbit/s
           capabilities: ethernet physical tp mii 10bt 10bt-fd 100bt 100bt-fd autonegotiation
           configuration: autonegotiation=on broadcast=yes driver=asix driverversion=22-Dec-2011 duplex=full firmware=ASIX AX88772 USB 2.0 Ethernet ip=192.168.203.115 link=yes multicast=yes port=MII speed=100Mbit/s
    

    Note how both interfaces claim to be USB 2.0 under configuration. The Pi treats this as a proxied piece of plug and play hardware that is managed by the USB controller.

  • You could use the Pi's SPI interface to drive a second Ethernet port.

  • That would definitely eek out a bit more speed.

    Still might want to consider cooling that hot south bridge (or just the whole Pi as some fans are bigger than it!).

  • I use it simply because I am limited to 8Mb/s downstream even without it. Even with my shitty connection it is near it's limits.

  • It is nice having a little USB powered, silent device that I can power via USB on the back of the router though.

    I was waiting and seeing what the situation will be with the TK1 development boards by NVIDIA. They could make really good little network appliances.

  • 17.10.14
    UK PREMIERE
    LIVE FROM BFI LONDON FILM FESTIVAL TO
    70 CINEMAS NATIONWIDE

    https://citizenfourfilm.com/

  • What's the likelihood it ends up with a backdoor for The Man

  • You tell us, CB...
    #CBizworkin4daman

  • Post a reply
    • Bold
    • Italics
    • Link
    • Image
    • List
    • Quote
    • code
    • Preview
About

Encrypt all the things!

Posted by Avatar for Velocio @Velocio

Actions