Caught torrenting a thing. What's the best way to stay private online?

[co_co]

A friend of mine recently got two emails from her ISP in rapid succession. Despite using BTGuard as they recommended, her first letter identified a single thingover the BitTorrent protocol. She tightened the encryption she used (set all to "Forced") and made sure everything in her client, Deluge, was set to use a proxy for everything.

Just a little under two days later, a second notice for the same thing appeared in her inbox. She was extremely confused about why.

tl;dr: What settings are best for torrenting safely?


My findings:

The EFF says:

• If a client sees a uDP peer and realizes a proxy cannot connect to it (it's a TCP-only proxy), they may ignore proxy settings!
• libTorrent and uTorrent (likely Deluge and BitTorrent too) can leak your IP address. Granted, they will pass your IP address to other peers anonymously, but you probably didn't want to send it!
• "If the Bittorrent peer communications aren't encrypted, the Tor exit relay you pick can also watch the traffic and do the attack.

What BTGuard says:

• Keep encryption disabled(!) If you don't, uDP connections won't load (uh-oh, this sounds bad).
• DHT, uDP, Peer Exchange... all of the things are safe to keep enabled.
• The warning is even harsher here:

  We DO NOT recommend encryption on the proxy.
  It only works with TCP, which means many torrents will not work because they require UDP. Your IP is still safely hidden without the encryption.

[anon]

I would suggest swapping BTGuard's proxy for a good log-free OpenVPN with port forwarding, plus an updated IP blacklist for added security.

To minimize leaks, she can set a static LAN IP on her "real" connection with no default gateway or DNS servers, then manually add routes for the VPN server(s).

That's what I'd do, although it may not be for everyone as a VPN is for the entire OS (unless you force programs to bind to the physical adapter, etc.).

[co_co]

[QUOTE=anon;3756627]I would suggest swapping BTGuard's proxy for a good log-free OpenVPN with port forwarding, plus an updated IP blacklist for added security.
I suggested both. Right now she's running a VPN service on OpenVPN with BTGuard still enabled (but with its settings relaxed). Both BTGuard and the VPN have been paid up at least a few months in advance.

To minimize leaks, she can set a static LAN IP on her "real" connection with no default gateway or DNS servers, then manually add routes for the VPN server(s).

She's got a static IP address as far as her LAN goes... Windows makes sure of that. As to removing the default gateway and DNS servers, I'm a little lost there. Any links with an explanation, perhaps? It sounds like you've written about this before.

[anon]

Right now she's running a VPN service on OpenVPN with BTGuard still enabled (but with its settings relaxed).

That's overkill But hey, safety first.

As to removing the default gateway and DNS servers, I'm a little lost there. Any links with an explanation, perhaps? It sounds like you've written about this before.

Assuming she's on Windows, the procedure is: open the connection's properties, then go to the TCP/IPv4 settings and wipe the content of the "Default gateway", "Preferred DNS server" and "Alternate DNS server" fields.

Now you have to manually add the route as we spoke before. Open a command prompt as administrator and run NSLOOKUP to find out the server's IP(s):

C:\Users\Username>nslookup vpn.example.com
Server:  localhost
Address:  127.0.0.1

Non-authoritative answer:
Name:    vpn.example.com
Addresses:  234.55.66.77

Then run ROUTE PRINT and you may see something like this (followed by a long route table, scroll up if necessary):

C:\Users\Username>route print
===========================================================================
Interface List
 10...00 17 63 ed b2 e9 ......Brand Name Ethernet Adapter
  1...........................Software Loopback Interface 1
===========================================================================

Note the number immediately at the beginning of the last two lines. That's the interface ID.

Now you can finally add the route. This example assumes there's only one VPN server whose address is 234.55.66.77, while the LAN gateway of her router is 192.168.1.1 and the interface ID is 10 - change accordingly, add lines if there's more than one server.

C:\Users\Username>route add 234.55.66.77 MASK 255.255.255.255 192.168.1.1 IF 10
OK!

Then connect to the VPN as usual. (If it doesn't work, you may have to rewrite the .ovpn file to use the server's IP instead of its hostname, since local DNS can no longer be used to resolve the name.)

Anyway, to use BTGuard through a VPN as you tell me she is doing, you'd have to do this twice - first to create a route from the "real" connection to the VPN, then from the there to BTGuard. The first step we've already discussed; the second is slightly more difficult since you probably can't set a fixed IP in the virtual adapter. Assuming its interface ID is 11 and its name on Network Connections is VPN Service, she'll have to run the following commands as administrator once everything is online:

route delete 0.0.0.0 if 11
netsh interface ip set dnsservers name="VPN Service" static 0.0.0.0 primary

All of this may be a little mind-boggling at first, but once you've got all the server IPs and interface IDs, you can just write a script that does all the work automatically. NetRouteView provides a friendlier way of seeing and controlling routing tables, too.

[smcewa11]

tl;dr: What settings are best for torrenting safely?

Use a cheap seedbox and ftp stuffz instead?

[absent_today]

Why no VPN ?

[crazzyjoe31]

The best way to protect yourself is by investing a little money into your security. First thing is stop using public trackers. Use only priavte trackers. Then, get a seedbox and make sure the FTP transfers allow explicit FTP over TLS. That way your data is encrypted when transferring to your computer. Essentially that is all that's needed. Good luck.

[Hiccup]

Where's a good place to get an updated ip blocklist/blacklist?

[anon]

Where's a good place to get an updated ip blocklist/blacklist?

https://www.iblocklist.com/list.php?...chiveformat=gz

Only the .p2p format is free, but you can use Blocklist Manager to convert it to .dat.

There aren't many good sources these days as far as I have seen, and most require you to pay. If you want to do a search, make sure what you find is 1. updated, 2. not for eMule (those block seedboxes and other dedicated servers).

[koldkane]

Same happened to me...I thought I'd be safe using torrent with Vyprvpn... and giganews wasted no time in throwing me under the bus...