Nym VPN is a decentralized VPN (dVPN) with Mixnet capabilities. It uses cryptocurrency incentives to allow of decentralized VPN experience. The Mixnet has 5 hops per connection and mixes traffic with other nodes. Mixnets also provide cover traffic to ensure consistent packet sizes. This enhances anti-AI detection from network traffic. I am not an expert, please read more here: Noise Generating Mixnet I Nym
Nym does not offer wireguard configuration files by default, so the VPN APP is required to use Nym. To take advantage of mixnet, follow this guide below:
Create standalone VM. Use Debian for template (preferably Trixie). Check off box for provides network
Install Nym VPN:
Follow the instructions from the official site.
i. wget https://apt.nymtech.net/pool/main/n/nym-repo-setup/nym-repo-setup_[VERSIONNUMBER]_amd64.deb -O /tmp/nym-repo-setup_[VERSIONNUMBER]_amd64.deb
ii. sudo dpkg -i /tmp/nym-repo-setup_[VERSIONNUMBER]_amd64.deb
iii. sudo apt install nym-vpn
Dns handling:
i. Create script: sudo nano /usr/local/bin/nym-dns.sh
ii. Insert the following into script:
#! /usr/bin/env bash
update_dns() {
nym_on=$([[ $(grep -v -c "nameserver \+10.139" /etc/resolv.conf) -gt 0 ]] && echo 1 || echo 0)
if [[ $nym_on -eq 1 ]]; then
echo "Nym is on"
nym_dns_ip=$(grep "nameserver" < /etc/resolv.conf | awk '{print $2}' | head -n 1)
sudo nft flush chain ip qubes dnat-dns
sudo nft add rule ip qubes dnat-dns meta l4proto {tcp, udp} ip daddr {10.139.1.1, 10.139.1.2} th dport 53 dnat to "$nym_dns_ip"
else
echo "Nym is off"
nameserver_ips=$(grep "nameserver" < /etc/resolv.conf | awk '{print $2}')
sudo nft flush chain ip qubes dnat-dns
for ip in $nameserver_ips; do
sudo nft add rule ip qubes dnat-dns ip daddr "$ip" udp dport 53 dnat to "$ip"
sudo nft add rule ip qubes dnat-dns ip daddr "$ip" tcp dport 53 dnat to "$ip"
done
fi
}
update_dns
inotifywait -m -q -e close_write /etc/resolv.conf | while read -r; do
update_dns
done
Make script executable: sudo chmod +x /usr/local/bin/nym-dns.sh
Run script at boot: echo "/usr/local/bin/nym-dns.sh &" | sudo tee -a /rw/config/rc.local
MTU issues and killswitch:
i. Check app for killswitch setting
ii. disable ipv6
iii. add the following rule: sudo nano /rw/config/rc.local
#!/bin/sh
/usr/sbin/nft flush chain qubes dnat-dns
/usr/sbin/nft add rule ip qubes dnat-dns meta l4proto {tcp, udp} ip daddr {10.139.1.1, 10.139.1.2} th dport 53 dnat to 1.1.1.1
nft add rule qubes custom-forward oifname eth0 counter drop
nft add rule ip6 qubes custom-forward oifname eth0 counter drop
nft add rule ip qubes custom-forward tcp flags syn / syn,rst tcp option maxseg size set rt mtu
Make script executable if not already: sudo chmod +x /rw/config/rc.local
EDIT: the mixnet is quite slow so be patient. If you are in a censored country, double vpn with QUIC setting turned on should work.
it could be a honeypot just as anything can. If you are interested, the code is open source for both running a node and a client. Most nodes are run by businesses running web3 infrastructure. The founder has an interesting background.
i am on the latest version 1.3. The killswitch option in the app doesnt seem to be functional however, step 6 will address this. I have checked with fast vs mixnet. Both are functional.
As for adding a custom DNS in the app, I was not able to get it to function. May want to see step 3 to setup DNS outside of the app.
EDIT: I have tried this with VMs connected to sys-nym-vpn and it works (except custom DNS). Are you using fedora or debian? Which versions?
I couldnt get anything to work until i set “enable_bridges”: true in the /etc/nym/nym-vpnd.json file. check in the nym-net qube to see if curl -v https://example.com works. if tls issue then this change will likely resolve it. some kind of application level firewalling
ALERT: mixnet as netvm from nym only works from version 1.28 and below!
This setup only works with Nym VPN version 1.28 and below. Starting from Nym VPN 1.29 it starts failing, and mainly 1.30—it’s stopped working…
The author of the script needs to study how to solve this problem and create a new script or warn people here about this problem!
If you can’t use Nym VPN in Qubes as netvm, install version 1.28; maybe 1.29 will work.
There won’t be advanced features of Nym VPN like mixtunning etc… but Nym will work in the previous versions by logging in with your account!
In Qubes, the way is to use older versions of Nym, from 1.28 and below, and your Nym net vm will work as netvm! Thanks for the setup and if is possible fix it for new versions of nym! I ask the author of the post PostedPortal to please give us a new configuration setup! Maybe they have to create another script!