NetVM | VPN cascading

[Germayn]

Dear @adw,

thanks for your time and response!

I think it is worth to first clarify this part:

@adw

It’s worth keeping in mind that the Tor Project has had dedicated specialists working on this for years. I repeat the caution that attempting a DIY solution is generally a bad idea, unless you’re just doing it as an experiment for fun (i.e., you can afford for it to fail).

Double VPN / Multi-Hop VPN / Cascading VPN is not a new thing nor experimental. It’s just the basic idea of networking to chain multiple connections, for completely different purposes. It’s done for years with different protocols. So it’s not about an own protocol, like Tor, it’s just about chaining connections. Basically, if you use a SSH jumphost to connect to another SSH server, you already have a “double / multi-hop / cascading” SSH connection.
The same is done with a variety of different protocol (combinations); here it’s about openVPN, but it would also work with IPSec + OpenVPN + whatever one can think of. In short, it’s also the nature of the NetVM concept.
Similar of having VPN → Tor, it’s about having VPN → VPN, or even VPN → VPN → Tor.

This brings me to your next question:

@adw

I think it’s still worth clarifying what your actual goal is. Privacy? If so, what kind of privacy and from whom? For example, if you simply want to hide your traffic from your ISP, you don’t need more than one VPN, so clearly you must want more than that. Do you want to hide your traffic from a nation state? If so, then this will almost certainly not be sufficient (if anything is).

As mentioned, the reason why one would like to do that could differ - but in the context of qubes, for me it’s about security / anonymity / privacy. It’s a feature offered by a lot of different VPN providers for years.
In case of VPN → Tor, you want your ISP not to know you are using Tor, or the Entry Node not to know who you are.
For VPN → VPN → Tor there is a similar use case.
If one would use two different VPN providers and wants the second VPN Provider not know who he is; or he wants the first VPN provider not to know that he is using Tor.
For me personally, just using one VPN provider I “trust”, it’s about the enhanced security against e.g. traffic correlation.

I think the first two links of my second post explains the whole concept/idea and its reasons quite well. It would be nice to take the time to read them (if not done already) since they answer already the whys in more detail. They mention also censorship reasons (I’m not affected of), but just to show that the actual goal depends on the needs - but the technique / method is the same.

@adw

Also, the VPNs are only one piece of the puzzle. You also have to take into account things like browser fingerprinting, VM fingerprinting, VPN leaks, and patterns in your own behavior.

For sure! That’s one of the reasons why I’m using Qubes OS

Best regards
Germayn