2

First of all, I'm not sure that this is the correct Stack Exchange site to ask this question on. I originally asked this on Information Security but was told that because this question involves a lot of technical details, Super User might be a better fit. If SU is not an appropriate place then please accept my apologies for posting this here and please let me know what other site would be more appropriate.

I am using a slightly modified version of mirimir's dual-VPN isolation system to enhance my privacy and anonymity on the web. Specifically I have put together a system according to the steps detailed in part 2 of his guides, with the exception of not using Tor (I felt that the system, minus Tor, was "good enough" and that Tor would just add too much additional slowness/latency without a significant enough gain in security to justify the additional latency). I am using Ubuntu 12.04 LTS as the OS for both the host and virtual machine. The VPN providers I am using are AirVPN for the external (host) VPN and PrivateInternetAccess for the internal (virtual machine) VPN. I picked these because I was told that they are among the faster VPN providers out there.

The system is working great for general web browsing, email, etc. However I would like the option to be able to use VoIP as well. But when I tried setting up a Linux soft phone and connecting to a VoIP provider, I am having major issues with VoIP. When I make a call, I can hear the other caller fine, however the other caller does not hear me very clearly (they say it "breaks up"), also they hear an echo of themselves. I am using CallCentric as my VoIP provider, however I doubt that's what's at fault here, since I have used this provider in the past (before I set up this dual-isolation system) with no difficulties.

I have tried several different softphones (Twinkle, Zoiper and jitsi). Unfortunately I am getting the same results no matter what softphone I use. Also my host machine is connected directly to the cable modem.

I suspect that connection speed/latency is at fault here. My "naked" internet connection is quite fast (97Mbps down / 7.2 Mbps up / ping 8ms). However when run through the double-VPN system, it slows down quite a bit, and also picks up quite a bit of latency (18 Mbps down / 5 Mbps up / ping 180ms).

One thing I found while researching this is that VoIP connections can often benefit from setting up QoS. My first thought was that this would be impossible, since the VPN connection in essence obfuscates the network data, so by the time the QoS layer sees the data, it doesn't know what type of packets it's dealing with, so it can't prioritize the VoIP traffic. However, just today I found that it is possible to set up OpenVPN to pass through the ToS bit which would allow QoS to work. However, this would only work for one of the VPN "layers" would it not? Or, would setting up ToS passthrough for both the host and VM VPNs work? I'm a little bit confused here as my knowledge of networking protocols, VPNs, etc. is somewhat lacking.

Is there any hope of getting usable VoIP using this type of double-isolation system, or is it a no-go?

0

1 Answer 1

0

You will probably find the problem is coming in due to a combination of the latency and additional bandwidth limitations between your VPN provider and your VOIP provider. 180ms is very, very much on the high end for VOIP. While it can be done, lag will be discernible, and without proper QoS, packet loss becomes more of an issue in most cases.

It would be worthwhile running MTR for a while to see if you get any packet loss, and try and deal to that. It might also be an idea to look at a VPN provider closer to you - if thats an option (I'd imagine its a trade-off).

While the problem with echo might be solved/introduced with soft phones, the rest of the problems are more likely to be bandwidth or "packets per second" related. You might - but probably won't - get better mileage with a different codec. For example, if you are using alaw/ulaw [also known as g711a/u], you will use less bandwidth if you change to gsm or g729. Its still a big ask though.

Might it not make more sense to not use VPN (or at least not use double-vpn) for your VOIP calls, and rely on a combination of single VPN and ZRTP (voip encryption) with your provider to get a better balance between quality and privacy ?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .