The original Shellfire Box VPN reviewed in this article is no longer available. The firm has now discontinued this VPN and replaced it with a newer versions the Shellfire Box 4K. We will be reviewing the new Shellfire Box 4K shortly, Until then this review is depracated.
Pricing and Plans
The Shellfire Box costs €69.95 (approx. $75.00), with a one year subscription to Shellfire’s PremiumPlus VPN plan. This works out at a very reasonable $6.25 per month.
It is worth noting that this price is only a little less than the $5.60 per month (if paid annually) Shellfire normally charges for its PremiumPlus VPN plan. So if you are going to subscribe to Shellfire, it would be rather silly not to get the router as well.
It is also possible to purchase the Box with a two-year PremiumPlus VPN plan. This works out at around $5.30 per month.
Payment is via PayPal, credit/debit card, bank transfer, Paysafecard, or HiPay. It is possible to pay in bitcoins, but as the router needs to be delivered to a physical address, it is hard to see what privacy advantage this brings.
VPN Features
Please see my Shellfire VPN review for a full look at this provider's VPN service. The PremiumPlus plan provides unlimited bandwidth, but this is only available on selected servers.
PremiumPlus users have access servers in 31 countries, but only 24 of these were available via the Shellfire Box interface. And again, not all of these offer unlimited bandwidth.
Shellfire users are usually restricted to just a single concurrent connection. However, as with all VPN routers, you can connect an unlimited number of devices to the Shellfire Box at once.
If you buy the Shellfire Box, you can also use the regular Shellfire VPN service. But thanks to the single concurrent connection, you cannot use the Box and a software connection at the same time.
Router Hardware Specifications
The tiny Shellfire Box looks very similar to the Anonabox (except that it is white). It measures just 6.5 x 4.5 x 2.8 cm and is feather-light, weighing in at under 30 grams.
Is it possible to fit hardware powerful enough to handle the rigorous processing demands of encrypting and decrypting OpenVPN in such a minuscule box? We shall see.
The full hardware spec is:
- On-chip: MediaTek MT7620n
- CPU Speed: 580MHz
- RAM memory: 64 MB DDR
- Wired network: 2 x Ethernet 100 Mbps (switched)
- Ethernet chip: MediaTek MT7530 (SoC)
- Ethernet switch: MediaTek MT7530 (integrated)
- Wireless network: 2.4 GHz 802.11b/g/n MiMo 2x2:2
- Wireless chip: MediaTek RT5390 (SoC)
This is pretty much on par with similar hardware by the likes of Anonabox, PandaPow, and Betterspot, all of which performed miserably in our speed tests.
The Shellfire Box uses the 300 Mbps 802.11n wireless standard (max). This around three times slower than the current 802.11ac standard.
It is also worth noting that the 100 Mbps Ethernet ports are not only very much slower than the current Gigabit (1 GigE) standard, but are also slower than the 300 Mbps Ethernet ports used by most other devices in its own class.
The Shellfire Box is powered via a micro-USB port (no battery).
Physical Design
It’s a tiny white plastic box with two Ethernet ports and a micro-USB power port in one side. The device also sports a full-sized USB port, although the purpose of this is unclear. A blue LED lights up when plugged into a power source
Also included in the package are a 30cm Ethernet cable, a 1m USB power cable (without mains connector), and a fold-out Quick Installation Guide (in English and German).
Privacy
Shellfire states that, “We don’t log any connection data.” But then again, it also states that, “You’re surfing absolutely securely and anonymously!” I really wish VPN providers would stop saying this.
Shellfire knows exactly who you are via your IP address, and could keep logs any time it chooses to, so you are not in any way anonymous when using the service.
Looking more closely at its privacy policy, Shellfire says that,
“Connection and usage data (for example file transfers, connection times) are only collected if they are required as means of accounting. This is not the case for flat rate tariffs.”
Given that all its VPN plans (including this router) use flat rate tariffs, it does seem that Shellfire is a genuine no logs service. Yay!
Shellfire is based in Germany, which has among the strongest privacy laws in the world. New surveillance and mandatory data retention laws, however, are chipping away at this. Many fear the situation will get worse. Please see here for more details.
As I understand things, though, the new mandatory data retention laws do not currently apply to VPN providers.
In addition to the above issue, the German intelligence service (BND) actively monitors German citizens, and cooperates closely with GCHQ and the NSA.
Germany is therefore usually regarded as not being an ideal location to base a privacy-focused VPN service. However, there is some debate over the issue thanks to the reputation of its privacy laws.
P2P is permitted, but only on the Finland VPN server.
Security
Shellfire uses shared IP addresses.
“We use OpenVPN with AES-256-CBC as our cipher... We use 2048 bit RSA keys and certificates. DHE is used for forward secrecy.”
The handshake is probably HMAC SHA-1, which is fine. These encryption settings are nothing to get very excited about, but do match our minimum recommendation for a “secure” VPN connection, which should be resistant against any known form of attack for the foreseeable future.
For more information on this subject, please see here.
The Website
I have seen prettier website themes, but Shellfire’s gets the job done. There is not a great amount of information on the website, however. The English-language version (the site is also available in German and French) is clearly not written by a native speaker, but is nevertheless easy enough to understand.
Support
In addition to the Quick Installation Guide provided with its packaging, a demonstration video is available, which runs you through the setup process. All such instructions are Windows-only. But to be honest, setup is so easy that this should not really matter.
Other than that, support boils down to emailing Shellfire. This can be done via web form, email, Facebook, or Twitter. A forum is available where you can ask questions, but at present almost all the content is in German.
Shellfire responded to my questions fairly quickly (within a few hours), and its answers were knowledgeable and helpful.
The Process
Signing Up
Ordering the Shellfire Box requires providing full contact details. As already noted, delivery requires a physical address, so there is little point being evasive here, anyway.
Delivery to Germany takes two to three days (expect longer if outside of Germany, and especially if outside the EU).
Connecting to the Shellfire Box
The router comes pre-configured for the Shellfire PremiumPlus service. To use, simply plug it into your modem via an Ethernet cable (provided) and power it on using a USB plug or power supply. You can then connect devices to the Box via its Ethernet port or WiFi, as per connecting to a normal router.
It really could not be easier (but remember to plug the WAN port into your modem, not the LAN one as I did at first!).
The Router Interface
As with most VPN routers, the Shellfire Box is managed via a web interface. Simply log on to the specified web page in your browser, and use the password provided.
The OpenWRT interface really is as simple as can be. The server list can be sorted by location and type (speed).
You can choose between OpenVPN over UDP or TCP. “Hidden TCP Connection” almost certainly means using TCP port 443. Please see How to Bypass VPN Blocks for information on this.
WiFi Performance
The Shellfire Box uses the 2.4Ghz band with dual MIMO spatial streams. This gives it a theoretical maximum speed of 300 Mbps. I tested local network WiFi performance using the WiFi Speed Test app for Android, with the phone placed next to the routers. Range was about five meters.
Shellfire Box VPN Performance (Speed, DNS, WebRTC, and IPv6 Tests)
All tests were performed using my UK 50 Mbps/3 Mbps fiber connection connected to the Shellfire Box. I used UDP mode. For a comparison with the results I achieved using the software-based Shellfire VPN service, please see my Shellfire VPN review.
The graphs show the highest, lowest and average speeds for each server and location. See our full speed test explanation for more detail.
You can expect to see around 85-90% download speed loss when using the Shellfire Box. This is entirely in line with other devices in the same class, and clearly shows that the hardware in these tiny boxes is simply not powerful enough to process a VPN signal at any speed.
Note that the Shellfire software VPN results I achieved were disappointing anyway, but I firmly believe underpowered hardware to be the main problem with the Box.
I detected no IPv4 DNS leaks or WebRTC leaks while using the Shellfire Box, which is great! Note that my ISP (Virgin Media UK) does not support IPv6, so I cannot test for IPv6 leaks. Hopefully, this situation will change in the near future.
Note that WebRTC did detect my internal network address (which also shows that the router uses a NAT gateway, hence the [RFC1918] Private Address). This cannot be used to identify me, though, so does not constitute an IP leak.
I was able to access both BBC iPlayer and US Netflix using the router.
Other Platforms
As already noted, any internet-capable device can benefit from the VPN, simply by connecting to the router.
Shellfire Box Review: Conclusion
I liked:
- Tiny and lightweight (although this has important consequences)
- Only a few dollars per year more than paying for the software-only plan
- No logs (at all)
- No IP leaks
- BBC iPlayer and US Netflix work
- Good encryption with perfect forward secrecy
I wasn’t so sure about:
- Germany is probably not an ideal location
I hated:
- Very sloooowww
- Limited number of PremiumPlus (full speed) servers
The main problem with the Shellfire Box is the same problem that plagues all similar devices. You simply cannot fit the hardware needed to process a VPN connection at speed into such a tiny and low-cost box. The result is a 85-90% download speed loss.
For day-to-day use, this will be unacceptable to most users. That said, if you plan on buying the Shellfire VPN PremiumPlus plan anyway, the Shellfire Box is a no-brainer. After all, it costs less than $6 more than buying the PremiumPlus plan on its own!
Other than speed issues, the Shellfire Box works well. It is ridiculously easy to set up, and does not leak your IP address. It could, therefore, be useful as travel router, which can keep you safe while performing undemanding tasks on the internet.