{"id":7401,"date":"2018-07-13T09:00:23","date_gmt":"2018-07-13T16:00:23","guid":{"rendered":"https:\/\/www.privateinternetaccess.com\/blog\/?p=7401"},"modified":"2024-01-28T10:31:39","modified_gmt":"2024-01-28T18:31:39","slug":"how-to-use-private-internet-access-and-tor-tor-over-vpn-or-vpn-over-tor","status":"publish","type":"post","link":"https:\/\/www.privateinternetaccess.com\/blog\/how-to-use-private-internet-access-and-tor-tor-over-vpn-or-vpn-over-tor\/","title":{"rendered":"How to Use Private Internet Access and Tor: Tor over VPN or VPN over Tor?"},"content":{"rendered":"

A big question for those who consider internet privacy essential is how to best use Tor in combination with a VPN service provider like Private Internet Access. Should a Tor connection be tunneled inside an already established VPN connection, or should a VPN connection be tunneled inside an already established Tor connection? Before you can answer these questions, however, you must first consider your threat model.
\nTL;DR \u2013 In most situations, you are going to want to use User > VPN > Tor<\/em><\/p>\n

This article assumes that the user is using good operational security that will not out themselves while on the network. Opsec is a set of best practices for remaining private while using anonymity networks. For more information about tor and VPN opsec, see our article next Wednesday.<\/p>\n

Let\u2019s discuss two main threat actors:<\/h2>\n

1. An oppressive regime<\/h3>\n

2. A malicious VPN service provider<\/h3>\n

The first of these is obvious, but the latter is of course ironic. However, we understand you may be in a position where you can\u2019t afford to completely trust anyone \u2013 even us. That\u2019s where equipping you with information can give you the ability use the service effectively without having to trust us with your raw data streams.<\/p>\n

We\u2019ll start with the first threat actor shown above. Oppressive regimes quite commonly have the ability to view traffic as it travels across ISP (internet service provider) infrastructure. If you are connecting to Tor or a VPN service from home, this means an oppressive regime can see your home IP address connecting to an IP address associated with Tor or the VPN. However, since your traffic to Tor or the VPN is encrypted, they theoretically (unless you have already been compromised in some other way) can only observe that you are connecting to Tor\/VPN and not decrypt the actual encrypted traffic itself. Once your traffic has passed through the Tor or VPN connection, it needs to egress to its final destination, like wikileaks.org, perhaps. During that final leg of its trip, the traffic will no longer be tunneled through the Tor or VPN connection. Your traffic is now more susceptible at this point to the snooping of an oppressive regime. Not only will the egress IP address associated with Tor or the VPN service be visible, but the final destination IP address will also be visible. In addition, since your traffic has now egressed from the encrypted tunnel, if you use an unencrypted protocol like HTTP (not HTTPS\/SSL), the oppressive regime can snoop on the full content of your traffic.<\/p>\n

What an oppressive regime could be targeting in this threat model:<\/h3>\n