You Fre dom Y ur F eed m

Use Guide er
A Step By Step In p ntroduction and Refere ence Guide to Your Fre eedom w.your-free edom.net/ http://www
Version 2.1 Releas Date: 201 se 11-01-17
All trademarks used in this guide are trademarks of their respective owners and only used for reference. The most current version of this guide is available from our web page, http://www.your- freedom.net/, in the Documentation section. Please check if there is a later copy available if you encounter problems or you cannot find needed information in this copy. This guide is Copyright 2006-2011 by resolution Reichert Network Solutions GmbH, Zweibrcken, Germany. All rights reserved. You are welcome to copy and distribute this guide in both electronic and paper form as long as you distribute it as a whole and not in parts, you do not modify it in any way, and the reference to the original location is kept intact. Please advise all recipients that distributed copies may not be the latest version of the document, and that they can always download the latest version from our web site.
1 INTRODUCTION..... 5 1.1 WHAT IS YOUR FREEDOM?.... 5 1.2 WHAT IS IT NOT?.... 5 1.3 WHAT CAN I USE IT FOR?.... 5 1.4 HOW DOES IT WORK?..... 6 1.5 IS IT SECURE? IS IT ANONYMOUS? DOES IT COMPROMISE MY SECURITY? CAN I CATCH A VIRUS?.. 7 1.6 WHAT DOES IT COST?.... 8 1.7 IS YOUR FREEDOM SPYWARE OR ADWARE?... 8 1.8 HOW MANY SERVERS DO YOU HAVE? ARE THEY ALL THE SAME?... GETTING STARTED.... 10 2.1 REGISTRATION PROCESS.... 10 2.2 GETTING AND INSTALLING THE CLIENT SOFTWARE.... 10 2.2.1 Users from countries with Internet censorship... 11 2.3 CONNECTING FOR THE FIRST TIME.... 12 2.4 CONFIGURE APPLICATIONS.... 19 2.4.1 Automatically.... 19 2.4.2 Manually..... 21
Setting up Mozilla Firefox..... 23 Setting up Internet Explorer.... 24
2.5 MANUAL CONFIGURATION.... 27 2.5.1 The Your Freedom configuration dialog... 27 2.6 STARTING AND STOPPING THE CONNECTION... 30 2.6.1 Each user may only log in once.... 30 2.7 CHOOSING THE RIGHT SERVER.... 31 2.7.1 Server location..... 31 2.7.2 Protocols.... 31 2.7.3 CGI relays..... CONNECTING APPLICATIONS AND GAMES... 34 3.1 INTRODUCTION.... 34 3.2 USING SOCKSIFIERS.... 34 3.2.1 Windows..... 34
WideCap..... 34 SocksCap..... 34 FreeCap...... 34 ProxyCap..... 35 Proxifier..... 35 HummingbirdSocks..... 35
3.2.2 Linux and other Unix derivates... 35
Dante..... 35 Tsocks..... 35

3.2.3 Mac OS X..... 35

Proxifier..... 35 Tsocks..... 35
3.3 OPENVPN SUPPORT.... 35 3.3.1 Introduction..... 35 3.3.2 Prerequisites.... 35
Administrative rights..... 35 OpenVPN needs to be installed..... 36 You dont need a Your Freedom package, FreeFreedom will suffice..36
3.3.3 Configuration tasks.... 36
Know your networking environment.... 36 Tick the OpenVPN box.... 37
Start the Your Freedom connection.... 37 Relay for others?..... 37 What about the Windows firewall?.... 37
3.3.4 Configure your applications... 37 3.3.5 Troubleshooting.... 38
The OpenVPN tunnel is not coming up properly... 38 The OpenVPN tunnel opens, but then the Your Freedom connection fails... 38 What are these 169.254.xxx.yyy addresses?... 38
4 PLANS: PACKAGES AND VOUCHERS... 38 4.1 FREEFREEDOM (USAGE FREE OF CHARGE).... 38 4.2 PACKAGES AND VOUCHERS.... 40 4.2.1 Vouchers.... 41 4.3 TEST DRIVES..... ADVANCED TOPICS.... 42 5.1 PORT FORWARDS..... 42 5.1.1 Local port forwards.... 42 5.1.2 SIP forwards.... 42 5.1.3 Server port forwards.... 43 5.2 CONNECTION SHARING.... 44 5.2.1 Relaying..... 44 5.2.2 USING OPENVPN and ICS to connect other PCs, Playstations, XBox, etc.. 44 5.3 IPV6..... 44 5.4 FINE TUNING CGI MODE.... 45 APPENDIX A. TROUBLESHOOTING.... 47
Why does my app/game not work?.... 47 Performing a speed test..... 47 Creating a dump file.... 48 Using a packet sniffer.... 48 Updating the client.... 48 APPENDIX B. COUNTRY INFORMATION.... 49

Country specific plans.... 49 Server availability by country.... 49 Tweaks.... 50 APPENDIX C. THE YOUR FREEDOM CLIENT CONFIGURATION FILE.. 51
Where's my home directory?.... 51 CONFIGURATION OPTIONS.... 51
Yo ur Freedom User Guid m de

Page 5 of 58 e

1 Intro oduction n
1.1 Wh is You Freedo hat ur om?
Is your Internet acc cess someh how restrict ted? Are some web pag not acc ges cessible to you, or y are you unable to r applicat u run tions becau of such restrictions? Then You Freedom is for use ur you. Alt though the t techniques used by Yo Freedom to break through suc restrictions are our m t ch fairly co omplicated, it is not diff ficult to use. Your Fr reedom is a Connectiv Service that allow you to overcome con vity e ws nnectivity restrictions impose upon you by your ne ed u etwork adm ministrators, your provid or your country. der c It also p provides a c certain level of anonym mization, an it hides from your a nd administrato and ors other no people close to you what you are doing on the Inte osy u g ernet. It works by turning your local PC into a w proxy and a SOCK proxy th can be used by s web a KS hat your ap pplications (web browse games, w er, whatever). Instead of connecting directly, c applicat tions can se connec end ction reques to these proxy serv sts vers provid by the client ded c part of t Your Fr the reedom soft tware runnin on your PC, and the client part will then fo ng e t orward these re equests to t server part running on our con the p g nnectivity se ervers throu a conne ugh ection protoco that is sti available to you and through wh ol ill hich the clie part can reach the server ent s part. It t tunnels thr rough firewa web pro alls, oxies, FTP proxies and the like. S d Sounds complic cated? Well it is, but the good new is you do have to worry abou it, thats our job. e ws ont ut o :-)

1.2 Wh is it n hat not?

Your Fr reedom is n a VPN software. It does not provide a connection to a private network not s t p o n but to th Internet. he Your Fr reedom is n a firewa solution it is meant to break th not all n, hrough firew walls, not to be o one. It d does not ma your PC any safer But thats likely not yo concern because ake C r. our n someon is probab protectin you too w anyway ne bly ng well y. Your Fr reedom is n a perfec anonymi not ct izer. The se ervice does provide a c certain level of anonym mization by hiding your IP address Instead, th connecti request appears to come s. he ion o (in fact it does com from one of our con me) e nnectivity se erver IP add dresses. Bu it cannot protect ut m n o applications and protoc cols. you from your own mistakes or flaws in a Your Fr reedom is n in any way enhanc not w cing your connection It does no provide data c n. ot d compre ession and it cannot speed it up in any way; in fact, there is a certain amount of n e n overhea which is dependent on the con ad nnectivity protocol used so things will probab run d, bly slower, not faster.

1.3 Wh can I use it for hat r?
Your Fr reedom can be used to overcome : n o
Protocol re estrictions s. If you cann use certa applicat not ain tions or serv vices becau these ap use pplications cannot connect to the Internet in the usu al way, You Freedom may be ab to help you. For ur ble y example, if your favorite online ga f ame does not work in your place b n y because so omeone decided tha you shou at uldnt play it , then try Yo Freedom Games k our m. known to work well w include: Wo of Warc orld craft, EVE O Online, Cou unterstrike and many ot a thers.

Page 6 of 58 e

You may not use P2P protocols b because someone thinks it is illega ? Most al P2Pclients work nicely with Your Freedom, and you can even get a server port, y a n which gives you a hig id. s gh
Blacklists. You may not visit certa web pag ain ges? Try Yo Freedom It turns y our m. your local PC into an unrestric cted web pr roxy that pr rovides acce to all we pages th are gene ess eb hat erally accessible. Time restr rictions. We have heard from users that th use You Freedom to avoid tim restrictio u hey ur m me ons. In most cases existing connections are not dis s, c s srupted by such restrict s tions, and therefore all they need to do is to start the Yo Freedom client bef d our fore the res striction is in place, and keep it open. The connection between the client an the serve part t e n t nd er is persisten (this depe nt ends on the connection protocol, however). e n h
1.4 Ho does i work? ow it
You nee to run th client par of the You Freedom software on your loca PC. It is written in ed he rt ur m al w Java an should normally run on nearly e nd every PC without the need for adm w n ministrator rights. r We also provide in o nstaller versions that do not require Java to be installed, but you ma need o ay adminis strator rights to install these. s The clie software then connects to one of our serv ent e e vers through a connect h tion protoco that is ol still ava ailable to you. In most cases this w probably be an HTT connectiion through a web c will y TP proxy th you may use, or an HTTPS o FTP conn hat y n or nection. In many place UDP may be m es, used as well. In mo cases all youll nee to provide is the add s ost a ed e dress of a w or an FT web TP proxy (a probably authentic and cation crede entials); the client will ta it from t ake there and fi a ind way to c connect if o exists. one Have a look at the picture belo The bo x on the lef is your PC Lets say the restrictive ow. ft C. firewall wont let yo access hotmail.com and you want to read your privat email from your ou h m w te m workpla ace; fire up the Your Fr reedom clie and let it connect to one of our servers, co ent t r onfigure your we browser to use it as a proxy, an your web browser will be able t connect to eb nd b w to t hotmail.com by connecting to the Your F reedom clie which will forward the request to ent, w ts our rd est otmail.com server. The replies e one of o servers, which will then forwar the reque to the ho from the ehotmail.co server will take the same route backwards om w e s.

Actually this is not e y entirely accurate. Outbou mail sent through Your Freedom is scanned for und t f viruses. We do this t avoid blac to cklisting of ou IP address ur ses, which would make it impossible for our t f users to send email through You Freedom. I does not protect you; it protects oth ur It t hers (and us) from ) you.

Page 9 of 58 e

formation in any other way except for statistic debugging and n w cal, weeks. We do not use this inf ses c violations of our terms, unless req , quired by leg gal accounting purpos and for combating v ties. authorit Also, th here is a con ntrol console on the se ervers that theoretically allows us t see what our y to t users a currently doing. We only use th for troub are y e his bleshooting, and all dat there is tr ta ransient and not stored any t ywhere. The moment y log off it all gone. And believ us; we ha e you ts ve ave better w ways to pass our time than peepin on you. t ng
1.8 Ho many servers do you ha ow d ave? Are they all the same? t ?
This po is subjec to change with relatiive frequenc At the time of writin we have 31 oint ct e cy. ng servers online, in 9 different countries. Alll will be able to support basic web surfing or s c b chatting but some will refuse P2P connec g P ctions (nam mely the one located in the United es n d States). Some can handle mo traffic th an others. Have a look at the live statistics page at n ore H k ww.yourfree edom.net/142/; servers that are not in thep2 server g roup are no s 2p ot http://ww suitable for P2P ap e pplications, servers tha are not in the volum group ar not suitab for at n me re ble large file transfers, and so on youll get the drift. , t ne e s fault group; right now, all servers are in this group, ; g Everyon may use all servers in the defa but this may chang Some se ge. ervers are n available to users connecting f not c from certain n countrie or only a es, available to users conn necting from some countries. The Your Freed m dom client w tell you a will about such restrictions when you connect (au r c uthenticatio not valid for your on country of residenc y ce). If this happens to you, please use anoth server. h e her Also loo at the se ok erver load. The higher t number, the more loaded the s T the server. Loads below are c considered low, loads a above 125000 are cons sidered high We use a traffic h. light sch heme to quickly indicat the serve state. A green light indicates t te er t that the serv is ver fine and can accep your conn d pt nection. A y yellow light would indi icate that th server is up and he running but currently rather bu or alrea slightly overloaded or otherwis in trouble g usy ady se e (connec ctivity proble ems are a possible rea p ason) and probably wont be able to provide the best p t service to you yo are still welcome to use it, and the service may still be pretty goo A ou w e od. ght s erver is dow or otherw wn wise unable to serve yo e ou. red lig indicates that the se

Page 10 of 58

2 Gett ting Star rted
2.1 Re egistration process
Your fir step in us rst sing our service is to re egister on our web site You need to o e. d visithttp p://www.you ur-freedom.n and cre net/ eate an acc count there. There is a link underneath the login and password form fields in the red part of the banner f r. On the registration page, choo a usern n ose name (prefe erably one that is not lik kely already used) y and pro ovide a pass sword. Plea make it long enoug this is for your prote ase gh; ection, not ours o (the pas ssword qua ality has influ uence on th encryptio quality). Both userna he on ame and pa assword may contain upper rcase and lo owercase A ASCII letters digits, das s, shes, and u underscores s s p o); aracters ma work as w but it is not a ay well s (spaces in the password are possible too other cha good idea to try. The only othe required field is your email address. Every er ything else is not i tory; please do not fill in rubbish if you do not want to pro e f t ovide the in nformation, leave mandat them em mpty. Once yo have fille everythin in, click o the Create account button. Y will be asked to ou ed ng on You a confirm your details by clicking on Creat account now. If ther is a prob te n re blem with yo data, our red mes ssages will appear telli you wha is wrong; just correct your input and try aga ing at t ain. Within a few minut you should receive an email co tes ontaining an activation link. If your email n n address is protecte by anti-s s ed spam measu ures, please ensure that email sen from the youre nt freedom m.net doma (i.e. end ain ding in @yo our-freedom m.net) is pe ermitted befo you clic on fore ck the Cre eate accoun now link. Activate y nt your accoun by clicking on the link in the ema (or nt g k ail cut & pa aste it into y your browse You can also simply reply to the email, qu er). n uoting it in its entirety If you hav y. vent receive the emaiil or if the lin doesnt work for wha ed nk w atever reason, please send an em to our support staff they can create or ac mail s f, c ctivate the a account for you if you sen them an email to support@you nd ur-freedom.n telling them the us net, t sername. What if you cannot access our web page because it blocked? Well, its a hen and egg t e ts ? problem then. Either ask someone else t create an account fo you (or do it from m to n or o somewh and obtain the cl lient software from ano other source than e here else) a modify it later, or o our serv and use the username unreg ver, e gistered an the passw nd word unreg gistered in it. This account will only provide acce to our w page, however. Alt ess web ternatively, if you are able to a send an email to o custome support, a them to create an account for you. Just write to n our er ask a w support t@your-free edom.net te elling them a about your problem, su p uggest a use ername (ple ease limit you urself to AS SCII letters and number dashes and underscores) and a password If you a rs, d. want to receive the YF client by email jus write a bla email to get@your e b st ank o r-freedom.n net; e w gainst you and you a youll be given further instructions on how to proceed. If all the odds are ag cant ge the client software fr et rom anywhe else we mail you a CD as we ere ll ell.

Theres a lot you c configur here. You might wan to use the wizard to configure a web s can re u nt e proxy b you dont have to, th but heres not m much differe ence but the client will c e check if you ur settings appear to be correct. If you know the details just fill the in. You ll probably need to s w s, em configure the addre (host na ess ame or IP a address) an the port. If you need to authenti nd icate on b in e word as we and if its an NTLM a ell, s authenticated the web proxy, fill i username and passw proxy a the wind add dows domain name as well. (In thi case, use is ername, pas ssword and d bly e at t y domain are probab the same values tha you use to log in to your PC!) ntend to use the FTP connection m e c method and you canno directly FT to serve on d ot TP ers If you in the Inte ernet, there may be an FTP proxy on your network. (Do bother t configure y n ont to e

Page 29 of 58 2

n tp nd ) w ull anything if you can use the ft comman line tool!) The port will likely be 21, but you need stname or th IP addres as well ask someo who kn he ss one nows, there are legitima ate the hos needs t use FTP outside web browsers. to The mo common connection scenarios are also co ost n n s overed by th Wizard a he available through the butt on the b ton bottom its the same t s that is run when you st the clien for the fir time w tart rst nt and its described in detail in chapter 2.3 on page 12 c 2. When y are done, click on Save and E you Exit to save your chan e nges, or on Cancel to abort o them. So muc for setting up the connection. Y should now be able to start it u from the Status ch g You n e up panel. T connec The ction indicator (the doo r) should op pen, a ques stion mark s should appe ear while client and se erver negotia and dis ate, sappear afte a few sec er conds. If it d doesnt disa appear, your co onnection se ettings dont work. Hav a look at the Messa t ve ages panel. If you can get. t the connection to w work, check out chapte Appendix A to see how you can help us to help k er x n you. Once yo are conn ou nected, che out your connection profile by clicking on the Account eck r n Profile tab. It shou look som uld mewhat sim milar to this:
Most things in here should be fairly self-e e e explanatory except ma y, aybe for se erver groups and s remote port forwa e ards. Server groups will indicate th groups o servers to which you may conne Multiple r he of o u ect. e permitte groups a separate by comm Everyon will have the defaullt server gr ed are ed ma. ne roup on their pro ofile, meani that you may conne to every Your Freedom server in the def ing u ect y r fault group (a the time of writing, all servers a in this gr at a are roup, but this may chan nge).Some accounts have add ditional serv groups i n their profi dependi on boug package All ver ile, ing ght es. will not show up in customer profiles. p

Page 30 of 58 3

profile has a server ports assign any p ned, they will show up in the rem ote ports w If your p forward ded line. Th numbers there mea n that these ports on th Your Fre he s e he eedom serv will ver be forw warded to yo PC when you are c our connected, and you ma use them in the server port a ay m forward configura ds ation (see below). b

All optio in here can be cha ons anged while the connec ction is activ and will h ve have immed diate effect. If you wish t modify th local port on which your PC be to he ts ecomes a w or SOC web CKS proxy, u uncheck the service firs then cha e st, ange the po number, and tick the box again. If you ort e would li your PC to accept requests fro other PC on the lo ike C r om Cs ocal network and forwa them k ard through your Your Freedom connection, tick the Re h c elay for othe box. No that this will ers ote only have an effect if your pro ofile permits it (check th Relaying permitted line in the s he g Accoun Profile p nt panel as sho own above) ).
2.6 Sta arting and stoppin the co ng onnection n
2.6.1 Ea user m only lo in once ach may og Thats r right. Each user can on log in fro one PC at the same time. If yo try to log in nly om e ou er using th same user account from anothe PC or an he nother instance of the c client, the previous session will be term n minated. Th means th you will always be able to log in, but so will his hat w everyon else who knows you details a he or sh will kick you off. The servers ta to ne o ur and he e alk each ot ther, it does help to just use diff snt ferent serve ers.
We know that the FTP connection code conta w n ains a bug that can be trig ggered if you close the u connectio and re-op it immediiately thereafter. You'll be told that its a duplicate login and th on pen e s e hat your sess sion has bee terminated Just wait a few minutes before reco en d. onnecting, or close the client and start it again6. d
If it was easy to fix t s this, we would have done it already. e

Page 31 of 58 3

2.7 Ch hoosing t right server the s
2.7.1 Se erver locat tion The YF server sho F ould ideally be close to the YF client or close to the serve you inte to ers end use thro ough YF. Ju think about it as a t ust triangle: the corners are your PC, the service on the e Internet and the Y server on top. The m t, YF n more the tria angle looks like a straig line betw ght ween you and the service (i.e. the flatter it is), t better. d the Let me give you an example. If you are lo n ocated in th US and the service y are using (lets he you u g e bly say you are playing an online game) is a lso US based, a server in Europe will probab be a bad cho oice. The la aws of physi make it impossible for information to trave faster tha the ics el an speed o light7 and putting 20.000 kilome of d eters of additional wires or fibres b s between you and u the serv vice will increase latency. It is idea to use a Y server that is close to yourself Why? Bec al YF e f. cause youd normally use d u more th one ser han rver on the Internet and you canno find a YF server that is topologically I d ot t close to all of them but you may be able to find one that is clos to you. O the other hand, o m, m e se On r for appl lications tha dont care too much about laten (like larg file trans at e ncy ge sfers) the se ervers location is seconda Try the different se n ary. ervers to se which one is good fo you. ee or The YF client will tell you whe the serve is located when you are connec F ere er d u cted (and also in a the connection wiz zard). Unfor rtunately we dont have many serv e e vers outside Europe, si e imply because e red ndwidth ded dicated serv vers are vas stly a) They are unaffordable unmetere high-ban expensive in most plac outside Europe. ces e ers r n m h rs t b) the provide are too restrictive in what you may do with the server and what not we are sick and tired of endless a fruitless discussion with US b k o and s ns based providers and explain ning their dr roid staff wh we do and what we dont do, a why its not hat a e and s illegal, and why its rub bbish that th servers IP appeare in a mediiasentry em he ed mail. ders we wou like to hear from yo But plea conside that h ou! ase er uld If you know about good provid rage Your F Freedom server genera ates betwee 2 and 8 terabytes of traffic per month en f an aver and nee at least 1 GB of RA and a d eds t AM decent CPU. And it sho ould come w Debian Linux. with 2.7.2 Protocols Not all o servers permit8 all protocols. S our Some providers (you got it they are US based)p place protoc restrictio on us a are havi kittens every time t col ons and ing e they believe that e they ha spotted something, and whats even wors they won listen to any argume ave s se, nt ents. So if we wa servers there (and we do, to p ant provide a go ood, responsive service to those of you e o who need it!) we need to restr some pr rict rotocols on them. application doesnt wor as you w rk would expec have a look at the m ct, message win ndow of If your a the YF client. Are y seeing messages about a den you nied protoco It means that youll have ol? s l to use a different s server. Genera speaking use a ser ally g, rver in Euro whenev you can if you are w ope ver worried about protoco restrictions. ol

Page 33 of 58 3

And how do you kn w now about these? Welll, thats ano t other matter entirely. W wont publish r We any lists and we would ask tha you do n either. Why Because we dont w s at y? want these li ists to simply g imported into URL blacklists. B the YF client will so learn ho to find the get But oon ow relays. No, we won say how, figure it ou :-) nt , ut. would like to set up suc a CGI rel ay, you can download the script a o ch n athttp://www w.yourIf you w freedom m.net/ems-d dist/enduring_freedom.php-RENA AME. Have a look at th first lines you he need to choose wh o hich server you would llike to relay to and put the servers name in. Save it y s under a inconspic an cuous name (use the r ight ending if you have to). Then t e e test it please (use your we browser you should see a lon g text page with loads of garbage dont worry, eb e e thats fine). If it works, register it on our w page (h web http://www.y your-freedom m.net/156/) ).Our scripts w test it automatically and if it wo will y orks they will add it to the databas and mak sure w se ke that clie ents can find it (it takes a while tho d s ough, dont expect clien using it immediately). nts Btw. yo are welco ou ome to set up CGI rela ys for your own person use only as well, yo dont u nal y ou have to register the Feel fre to tell oth o em. ee hers about it, and publi the URL if you like. Just if i ish L. you dec cide to regis it, dont publish it. If you have before, sim ster t mply change the name or the e path or set up a co opy. Do that frequently, it helps! Remove very old copies from time to time, t , R y s et red w automatically (but you can do so a well). y c as they ge unregister on our web page a

Page 34 of 58 3

3 Con nnecting applicat tions and games d s

3.1 Int troduction

Apart fr rom browse there are many app ers, plications th can benefit from Yo Freedom and hat our m connect to the Inte ernet. From terminal cli ents, chat and instant messenger (like GTalk, a rs Pandion or Yahoo Messenger P2Ptech nologies (lik BitTorren to game can be n r), ke nt), es configured to conn nect via your-freedom. rs ncepts nece essary to make your pa articular app plication wo ork. This chapter cover some con

3.3 Op penVPN s support

3.3.1 In ntroduction n There is another w to make your applic s way e cations con nnect to the Internet thr rough Your Freedom without th need to configure th he hem in any way! This is pretty welll tested and so far s d has pro oven to be a almost bulle proof vers its socksifier cousin In theory every app et sus ns. y plication that works behind a DSL or ca able router also should work well though Ope d t enVPN mod de. 3.3.2 Prerequisite es The Op penVPN way unfortunately has a f y few prerequ uisites that you need to meet for it to work y o on your PC: r Admini istrative rig ghts Theres no way aro s ound it: you need to be able to ins u e stall OpenVPN and use it, so you need e adminis strative rights (on Unix like system you need to be able to install th OpenVP ms: e PN he binary s setuid root in your path On typica company PCs with domain login you wont have h). al y d n t adminis strative rights.

Page 36 of 58 3

sta, so e n F e With Vis you als need to explicitly run the Your Freedom client with ad ministrative privilege (right-clic "Run as administra es ck, s ator").Alternatively, righ ht-click on th link in the start he menu, c choose "Pro operties", cl on the lick Compatibility" tab, then tick the "r as run adminis strator" chec ckbox -- this will fix it o s once and for all, as long as you alw r g ways use th link his to run th YF client. he OpenV VPN needs to be insta alled OpenVP is Freew PN ware and Open Source (but please consider donating). I you have the e If ability to install sof o ftware on yo PC, go t http://ope our to envpn.net/download.ht and dow tml wnload OpenVP It needs to be at le PN. east2.1_rc2 newest release should do. For Windows there is 20, r an insta aller, others need to co s ompile Open nVPN from source or maybe it s r ships with yo our OSs distribution? In any way, if you open a command shell and type open , n d nvpn you should see hun ot, ndreds of lin of instru nes uctions; if no its not properly inst p talled. Open nVPN need to ds install a tunnel inte erface on yo PC; on W our Windows its called TAP- WIN32, on Linux this , would b tun0. be For use of Windo ers ows Vista, Windows 7 and above its recomm W mended to c configure the e openvp pn.exe executable to ru under ad ministrative privileges. Go to "C:\P un e Program Files\OpenVPN\bin right clic on the op n\", ck penvpn exe ecutable, se elect Prope erties, atibility, and mark the Run as Ad d dministrator checkbox. This will en o Compa nsure the openvpn process gets launc s ched with th necessar privileges he ry s.

Befo making use of OpenV ore u VPN please make sure yo compute is properly m our er prot tected and no infected by some virus ot y s/worm or a Trojan. Ensu that it is not T ure n part of a bot net. If you don't our servers might have to close dow your accou t t wn unt to protect our sy ystems. If you do not have a proper se u e ecurity suite installed on your PC please open Internet Exp plorer now an visit this web page for a free check (it nd w r is a Microsoft too and will th erefore only work in Internet Explorer ol r): ve.com/site/e en-US/default.htm http://onecare.liv We strongly adv vise that you repeat this from time to time. It is for your own t tection! If you haven't got other protec u t ction conside installing fr protectio er free on prot softw ware like Mic crosoft Secu rity Essentia Avira Antivir or avast. als,
You do ont need a Your Freedom packa age, FreeFr reedom wil suffice ll Thats r right. Our O OpenVPN su upport is no only availa ot able to payi users. A ing Although run nning an Ope enVPN tunnel endpoint uses consiiderably mo resource than just forwarding ore es t g connections; we de ecided to of it to eve ffer eryone for fr ree. Althoug we know that it wou gh w uldnt be much fu with 64k. un 3.3.3 Configuratio tasks on Know y your netwo orking envi ironment If you a behind a firewall and need to b able to re are be each server that have Internet IP rs e P address but are not reachable from the Internet, you need to add route e ses e y o exclusion lines to your co onfig file (see Appendix YF client c x: configuratio file). on

Page 37 of 58 3

o A rnet IP addr resses are 99% of all users wont have to configure excludes. All non-Inter atically exclu uded anywa (this cove 10.0.0.0 172.16. ay ers 0/8,.0.0/12, automa 192.168 8.0.0/16).Ne etworks tha are alread routed on your PC are excluded as well. at dy n a d For all o others, add an openvp pn_exclud line per IP or network as descri de ribed in App pendix C, e.g. openvpn_ _exclude 1.2.3.openvpn_ _exclude 2.3.0.255.255.0 0.0 Note that Your Fre eedom is cle ever enough to automa h atically exclu all IP a ude addresses th it hat needs t be able to reach in order to maiintain the co to o o onnection to the Your F o Freedom se erver. Tick the OpenVPN box N Go to th Ports panel and tick the OpenV he k VPN checkb box. Leave the port num mber as it is s, unless t there are re easons why you need t use a diff y to ferent port. Start th Your Fre he eedom con nnection The con nnection se et-up should look like us d sual, but ap pproximately 10 second after the door y ds e opens, it should op a bit mo The m pen ore. message log should tell you as we when it ell ns. ook r ng r then type ro oute happen Have a lo at your PCs routin table (in Windows, run cmd, t print; U Unix users type netstat rn or ro oute n); yo should see a whole bunch of ro ou outes there al going to s ll some 169.25 54.xxx.yyy a address. Th hese routes cover the w s whole Internet address space min the exclusions men s nus ntioned abo ove. We can nnot replace your PCs default e s route; th would v hat very likely cu you off fro your loc network and make t Your Fr ut om cal the reedom server u unreachable e. Relay f others? for ? Yes, yo can and y may. But unless yo PC mas ou you our squerades the other PC they nee to t Cs ed run thei own Open ir nVPN sessi ion. When y start the connection, the Your Freedom client you e r c creates some conf files in yo home d irectory (ple s fig our ease see Ap ppendix C f location details) for all starting with client or ser rver; copy t them to their PCs into some direct tory, edit client.o ovpn and re eplace 127.0.0.1 with y your PCs in nternal IP address, the right-click on the en k client.o ovpn file an choose the second option (Start OpenVPN with this c nd N config file). Of course they need t install Op to penVPN firs st!

Yes, thi can be use to protect a more expe is ed t ensive packa from exp age piring.

Page 42 of 58 4

5 Adv vanced T Topics

5.1 Po Forwards ort

5.1.1 Lo ocal port fo orwards One po ossibility to a allow an application to connect to a service on the Intern via Your net r net. Freedom is to mir rror a port on the Intern Just im o magine there a server out there with a es r w certain IP address and its listening to SS connecti SH ions. You would like to SSH to the server w o e nt s OCKS. In this case you would simp configure a ply but your SSH clien does not support SO ort similar to this one: local po forward s
Now ins stead of con nnecting via SSH to so a y ome.host.somewhere on port 22 , you simply instruct your SSH c client to con nnect to loc calhost on port 2222. Your Freed dom will put the t connection through for you. Note howeve that if the remote host is unreac h N er e chable the SSH S will onnection, b it will tim out quickly. but me client w still see a working co This is j just one of many exam mples how y can use this feature Generally speaking, if your you e e. y applicat tion needs t only conn to nect to a pa articular hos on a particular port, llocal port fo st orwards are the right choice e. 5.1.2 SIP forwards s Yes, tha true! Yo can use SIP phones with Your Freedom as well! We have seen reports ats ou s a that aud only worked in one direction. O dio Once we ca find the ti an ime well co ontinue to work on w it. Note however th this is st in early b hat till beta phase and it may not work pr roperly; in any OpenVPN m mode will like work. ely case, O If youd like to give it a try, her is what y need to do. Assume you are u e re you using a SIP server.de on port 5060, the w t well-known port for SIP If you con P. IP called sip.sipgate. nfigure a SI port d one forward likes this o
it will turn your local PC into a mirror im mage of the SIP server. So instea of configuring e ad gate.de in your SIP ph hone, config gure localh host. Disable STUN if y can, its s sip.sipg you meaningless in this context (b will only make thing slower). s but gs

All these values only a e apply to the CGI uplink code If there is a keepalive frame in the que C e. eue, mindelay is used -i.e. value below maxd es delay/mindelay should not b used -y be
Yo ur Freedom User Guid m de Page 58 of min_post_siz ze post_m Minimum size of a POST request. m single e Nev lower th ver he maximum POS size ST belo this limit It could ow t. starve the uplink path. (De efault: 3000)
The cgi_? options were specif fically adde to help us ed sers to twea the cgi re ak elay mechanism. For exa ample, if ma assive and frequent PO f OSTs were undesirable users coulld set u e maxdelay=3000, m mindelay=10 000, urgentd delay=500 and thresho old=0. POS will be fe STs ewer ger and tivity wont be discreet. but larg and the impact on throughput a interact