VPN Guide

VPN stands for "Virtual Private Network." A VPN uses a tunneling technology, such as SSL, through different tunnelling protocols to establish private links through the internet to other computers.

VPN services are being shilled everywhere; torrent tracking sites, privacy-focused forums, obnoxious YouTube channel sponsorships, etc. It doesn't matter what marketing ever says about anything, VPNs only address two aspects of your online signature:

  1. Concealing your WAN IP address from the destination servers/peers.
  2. Obfuscating traffic from network observers (e.g., ISP or other devices on the LAN).

These mere two things allow a multitude of useful applications, including but not limited to:

However, using a VPN is essentially only rotating ISPs towards the correspondent VPN service, so when you connect over one, you're only shifting the trust over from your real ISP to the VPN service (and the laws of the country it's hosted in); the model is trusted, not trustless, and VPN services can only ever be used for privacy, but never anonymity or security. These words have been used so interchangeably over time, even though they're not the same thing:

VPN services still see you connecting from your real WAN IP address (thus we can see the hundreds of reports about some VPN services selling user IP addresses to governments), and constantly remaining on a VPN connection gives out your network activity fingerprint over to some exit point (which can serve to correlate it with where it appears elsewhere, also a very useful surveillance tactic for governments).

For this reason, all bottom-tier VPN services (like NordVPN and ProtonVPN) always depend on discounts and YouTube sponsors in order to exist, simply because they suck very hard; they all were caught surrendering user data to government requests, despite claiming that they'll never spy on their users. The only VPN services worth any trust are IVPN, Mullvad VPN, or RiseupVPN.

Hence, if you seek better anonymity on the clearnet, you should instead use your own personal VPN service with a VPS provider, which guarantees:

  1. Nobody blocking you, because no bad actors have used your VPN's IP address before.
  2. Nobody spying on you, because you're in control of the servers yourself.

Even the cheapest possible VPS server (which can go as low as $3 per month) will suffice. Once set up, log into the server via SSH and change your root password (obviously). Then, you must generate an SSH key for your local computer's user (if you haven't done so yet), and if prompted for input, you simply just skip:

ssh-keygen -t ed25519

Now on your VPS server, paste your public key into the ~/.ssh/authorized_keys file (you can find the generated public key on your local computer at ~/.ssh/id_ed25519.pub). Once that's done, you can disable password-based SSH login in your VPS server by editing the following line in /etc/ssh/sshd_config:

PasswordAuthentication no

After saving the file, restart the sshd service, and you're good to go. Now, to use your VPS as a SOCKS5 proxy, run the following command on your local machine:

ssh -D 7777 -q -C -N -f root@[server-address]

This sets up a SOCKS5 proxy on 127.0.0.1, port 7777, which then you can set in your network manager (or any program that supports proxy configuration). This way, you get your own VPN service that's fully under your control! You may then want to check your IP address (using the ip address command) and test IPv6 support.

Setting up a tunnel is only half the battle; OPSEC on the clearnet (or elsewhere, really) is extremely trivial. To err is human, and as clever as you think you are, all it takes is one connection from your real IP address to de-anonymize you. One day when you're distracted, tired, stressed, drunk, or when something out of the ordinary is happening, you will mess up. Putting up many automated layers of anonymity/security will help protect you from yourself.

For example, you also need to prevent DNS leaks. If your DNS queries are still being handled in the clear by your ISP, your proxy is virtually useless for privacy. You should configure a local resolver (such as dnscrypt-proxy or unbound) and force it to route all queries strictly through your new connection. You can check for DNS leaks on the DNS Leak Test website, for instance.

Furthermore, you must prepare for connection drops. While a dead SSH SOCKS5 proxy will simply cause your configured applications to fail to connect, a dropped system-wide VPN interface (like WireGuard) will quietly default back to your raw WAN and expose your real IP. You must write an iptables or nftables ruleset to drop all outgoing traffic not destined for the tunnel interface (effectively a kill switch). You might also want to disable IPv6 entirely and stick to IPv4, since IPv6 hands out globally unique, un-NAT'd addresses directly to your hardware, making device fingerprinting trivial.

Finally, you'll want to run software that respects your privacy, including operating systems and browsers that don't leak unique fingerprintable data (which you can check on Browser Leaks and Panopticlick), and maintain proper OPSEC practices; never login to the same accounts you use daily (e.g., emails, socials, etc.) and never share identifiable information (even including the way you speak, as many individuals were caught by government agencies through stylometry because of their typos, grammar mistakes, English dialects, punctuation, slang, emoticons, or filthy language). This is common knowledge.

You might read advice online about nesting VPNs or chaining your connection through Tor to "maximize" anonymity, but doing this is terrible security practice. Forcing a custom proxy connection through Tor creates static circuits, brutally bottlenecks your network throughput, and can actually make your traffic signature stand out more to observers (especially since the exit node is always the same IP address, rendering Tor nodes useless). Remember, this guide is strictly for clearnet privacy; if you require anonymity, you might better be using darknets like Tor or I2P.