mastouille.fr est l'un des nombreux serveurs Mastodon indépendants que vous pouvez utiliser pour participer au fédiverse.
Mastouille est une instance Mastodon durable, ouverte, et hébergée en France.

Administré par :

Statistiques du serveur :

598
comptes actifs

#mullvad

5 messages5 participants0 message aujourd’hui

With #vpn's being a hot topic in the UK, I recently did some searches to compare the various providers. Most of their web pages loaded ok but not #NordVPN. That just hung. No loading progress, no error. Same on any device at home. Was odd. I ended up going for #Mullvad which seems very good. As soon as I activated it I could view NordVPN's site. So something was previously blocking it. I find that quite disturbing. Makes me wonder what else we're being 'protected' from without even knowing it.

Mein Daten-Umzug nach Europa.
Die Nutzung von Werkzeugen, die keine Telemetrie haben und vorzugsweise aus Europa stammen.

Jetzt braucht es ein #VPN. NordVPN und Co hat jeder, aber wirklich europäische Anbieter gibts wenige.

Ich nutze #Mullvad. Vom Bezahlmodell bis zum Client simpel. Und nein, nicht jeder Streamingdienst geht "durch".

Over the past few weeks I have been switching off of NixOS and going back to the previous OSes and distros I was using. Last week I migrated my VPS back to OpenBSD and I now feel like I can appreciate its simplicity even more. That's not the point of this though.

When migrating I was reminded of something @nemo@camp.crates.im previously said about only allowing ssh access to the IP addresses he know he uses. I thought I should try doing something similar especially because to me pf is way saner to use and manage than iptables.

The addresses I know I'll use are my home IPv4 address and the IPv4+6 addresses of the Mullvad enpoints I am likely to use.
Unfortunately I don't know what those public addresses are before connecting.

A quick script containing something like below (I didn't save it >_<) later, I was able to get all the addresses I needed for passing to pf.
for i in *.conf; do
wg-quick up $i
curl -s4 https://zx2c4.com/ip | sed 1q
# the connect timeout is there because a few of the endpoints had a not-working IPv6 address
curl --connect-timeout -s6 https://zx2c4.com/ip | sed 1q
wg-quick down $i
done
```

Now in my pf.conf I just had to do something like this which didn't seem that complicated after all. I just modelled it after my existing rule that I used for opening ports (I removed ssh from that rule in favour of this one). This can most definitely be made better, but at least it works!

explicitly allow home and vpn ip addresses

ssh_whitelist_ipv4 = "{

ipv4 addresses here

I put my home address at the top as is and then /24 ranges for the mullvad IPs because I was told they may change frequently

}"
ssh_whitelist_ipv6 = "{

ipv6 addresses here from mullvad

I figured that they won't change often so I simply pasted them as is without specifying prefix

}"

...

allow public ssh only to my normal home address and mullvad ips

pass in log on $ext_if inet proto tcp from $ssh_whitelist_ipv4 to ($ext_if) \
port ssh flags S/SA keep state
pass in log on $ext_if inet6 proto tcp from $ssh_whitelist_ipv6 to ($ext_if) \
port ssh flags S/SA keep state

After running for over a day, my /var/log/authlog still only shows my own connections and not some people across the globe spamming connections to invalid users.

saklas$ zgrep preauth /var/log/authlog.0.gz | grep -v vin | wc -l
3918
saklas$ grep preauth /var/log/authlog | grep -v vin | wc -l
1

I was previously using pf-badhost in place of fail2ban due to the latter not being available on OpenBSD, but pf-badhost didn't prevent active attacks while both of them still allowed those (initial) connections in the first place.
There's a much smaller likelihood of an attacker using the same Mullvad endpoints I use, and if they do I probably have bigger problems to worry about. I'm also pretty much always connected to my Wireguard VPN (separate post on my website for this later) and that would let me bypass this anyways. This setup is more of a failsafe if I'm unable to connect through the VPN, and a failsafe of that failsafe if things really go wrong is just using the Hetzner web console I guess.

After writing all this, I think it's better to just post this on my website and syndicate here.

#openbsd #mullvad #pf
Suite du fil

(Linux news in original post)

FOSS NEWS

Mozilla discontinues Pocket and Fakespot to focus on Firefox development:
omgubuntu.co.uk/2025/05/mozill
(Or rather to focus on ToS development lol)

Signal introduces new "Screen security" feature in Windows to prevent Recall from monitoring conversations:
signal.org/blog/signal-doesnt-

New Mullvad VPN loader available for Windows and MacOS to simplify installation:
alternativeto.net/news/2025/5/

GIMP 3.0.4 released with various bug fixes, improvements:
9to5linux.com/gimp-3-0-4-open-

FFmpeg FFV1 Vulkan encoder provides +35% improvement for AMD, +50% for NVIDIA:
phoronix.com/news/FFmpeg-Faste

Luanti 5.12.0 released with SDL2 for window and input handling (enabling touch screen controls on all devices, support for non-QWERTY keyboards, high-DPI screens, IME support for text input, F11 to toggle fullscreen), keybindings can be set in Settings and can be toggled, option to enable dig and place buttons on touchscreens, node textures displayed in inventory, hotbar and hand, Reviews tab for package pages, etc.:
blog.luanti.org/2025/05/24/5.1

OMG! Ubuntu · Mozilla is Shutting Down Pocket to Focus on Firefox - OMG! UbuntuPocket, the popular "read it later" service Mozilla bought in 2017, is shutting down on July 8. Users have until October to export data. Why? Well…
#WeeklyNews#News#FOSS

This #Mullvad add means a lot.

“A society that gives up freedom for safety will lose both.”

Sacrificing personal freedoms for the sake of safety can lead to the loss of both, as it may result in authoritarian control and erode trust within society.

Ultimately, compromising liberties can create an environment that is neither secure nor free.

#VPN#Privacy#EU

This is one of the best #VPN roundups I've seen recently and covers a lot of different uses.

I was surprised the writer thought the #mullvad payment system was unique. If memory serves #ivpn offers something similar.

The really unique thing about Mullvad is how well its #openvpn config files work in my opinion.

This means you don't need to trust any extra software, which I imagine is crucial in repressive regimes.

And I'm not sure #hotspot shield is a good choice based on its ownership history either.

That said, this is generally good advice.

pcworld.com/article/406870/bes

PCWorldI'm a VPN expert and these are my top picksWhich VPN should you use? From speed, to price, to privacy, to security features, this buyer's guide will help you find the best service for your needs.