Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Setup a Secure VPN Server on Raspberry Pi or DigitalOcean

blog.hsp.dk

Post reply on HN
Print view View original

11–20 of 47 posts

Re: How to Setup a Secure VPN Server on Raspberry Pi or DigitalOcean

#11

Post by sshtunnels »

fauigerzigerk wrote: post #6

Using a socks 5 tunnel over ssh seems like an interesting ad hoc alternative for web browsing only: https://www.digitalocean.com/community/tutorials/how-to-rout... But crucially you'd want to make your browser use the tunnel for DNS as well: http://superuser.com/questions/103593/how-to-do-dns-through-... Careful if you're using this for something dangerous. I'm not a computer security expert by any stretch and I don'…

Yeah, I use SOCKS5 over SSH all the time, although I didn't follow that particular guide. I am also not an expert but after making sure DNS requests were tunneled, I wasn't able to see any cleartext at all using Wireshark.

It is not a Tor replacement or anything. I think it should be effective at simple things like: masking personal browsing at work[0], masking browsing habits from your ISP.

[0] Obviously if you use a company computer, you could be keylogged/monitored in other ways. Use your judgement.

Re: How to Setup a Secure VPN Server on Raspberry Pi or DigitalOcean

#13

Post by TuringNYC »

tyingq wrote: post #9
noarchy wrote: post #7

Regarding DigitalOcean VPNs, I think enough people have been doing this that it is starting to show in unpleasant ways. While using my DO VPN I've encountered captchas while using YouTube, of all sites, likely because of abuse they've seen at the hands of DO VPN users. I've also seen my DO IP range outright banned by other sites.

Probably similar for any other popular VM provider. Many webmasters, for example, block AWS IP ranges because there tends to be a lot of abusive traffic, crawlers, etc, from there. Going with a smaller company for a VPS intended for use as a VPN is a good idea.

Any suggestions on smaller companies that are flying under the radar so far?

Re: How to Setup a Secure VPN Server on Raspberry Pi or DigitalOcean

#16

Post by freestockoption »

I prefer to use layer2 bridging in OpenVPN with a separate hardware device (openwrt on a wallwart router, rackmount atom board). This way my client machines have no idea they are on a VPN and everything gets tunneled though the VPN (no DNS leaks unless my router is misconfigured).

In OpenWRT, it's basically:

-setup OpenVPN with a TAP device

-create a VLAN, assign some ports on the switch (optionally, a wifi SSID for VPNed wifi)

-bridge VLAN with TAP device

Re: How to Setup a Secure VPN Server on Raspberry Pi or DigitalOcean

#17

Post by sigmar »

hedora wrote: post #8

Is there an easy way to enable DNS over OpenVPN? That appears to be the biggest hole in this tutorial. Untrusted networks get to observe/spoof DNS, and the clients can't use the LAN DNS server to find stuff behind the firewall. (Or am I missing something?)

This tutorial includes configuring it as a "redirect-gateway" which will include all DNS traffic.
Post reply on HN