Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to build your own VPN if you're wary of commercial options

arstechnica.com

Post reply on HN
Print view View original

21–30 of 117 posts

Re: How to build your own VPN if you're wary of commercial options

#21

Post by greglindahl »

aphextron wrote: post #18
AdmiralAsshat wrote: post #3

The problem with a home-grown VPN is that you lose some of the plausible deniability that's gained from a shared VPN. If you have a VPN connected to a privately-owned AWS instance, the IP coming from that AWS instance is easily traced back to you. Whereas if your external IP is coming from a cluster that is shared by thousands of other people using that VPN, it is more difficult for someone to tie that specifically b…

>The problem with a home-grown VPN is that you lose some of the plausible deniability that's gained from a shared VPN. Yes, but what good is a VPN where you cannot trust your own network? I would have zero trust in any closed source private VPN. There are ways to gain anonymity from your host that wont require setting up a MITM attack vector for your traffic.

I get a lot of value from a VPN that prevents my ISP from spying on my traffic. I see from looking around this conversation that two other people cited this same reason.

I could totally see that many people wouldn't care about this particular thing.

Re: How to build your own VPN if you're wary of commercial options

#22

Post by masmullin »

AdmiralAsshat wrote: post #3

The problem with a home-grown VPN is that you lose some of the plausible deniability that's gained from a shared VPN. If you have a VPN connected to a privately-owned AWS instance, the IP coming from that AWS instance is easily traced back to you. Whereas if your external IP is coming from a cluster that is shared by thousands of other people using that VPN, it is more difficult for someone to tie that specifically b…

> AWS instance is easily traced back to you.

Define "easily" as used in this context. Easy is a product of whom your enemy is.

Is your enemy your ISP? If that's the case, I don't think it's "easy" for them; they would have to pay Digital Ocean or Amazon to get your data, and probably isn't really that valuable to them.

Is your enemy the MPAA? If that's the case, I still don't think it's particularly "easy" for them. Unless you are a MAJOR pirate distributor, the extra effort(money) to track you down isn't worth it.

Is your enemy the NSA or the FBI? If that's the case, then yes, it's trivially easy for them to Subpoena digital ocean or amazon to get your data, but similarly they can use techniques on PIA to get your data too.

In the end, it comes down to whom you trust with your data. And whether you want a managed VPN service, or are willing to put up with the inherent problems of maintaining your own system. will PIA sell your surfing habits to advertisers, will DO sell your surfing habits to advertisers? Who gives faster speeds?

Re: How to build your own VPN if you're wary of commercial options

#23

Post by [deleted] »

greglindahl wrote: post #21
aphextron wrote: post #18

Earlier quoted context omitted.

>The problem with a home-grown VPN is that you lose some of the plausible deniability that's gained from a shared VPN. Yes, but what good is a VPN where you cannot trust your own network? I would have zero trust in any closed source private VPN. There are ways to gain anonymity from your host that wont require setting up a MITM attack vector for your traffic.

I get a lot of value from a VPN that prevents my ISP from spying on my traffic. I see from looking around this conversation that two other people cited this same reason. I could totally see that many people wouldn't care about this particular thing.

[deleted]

Re: How to build your own VPN if you're wary of commercial options

#24

Post by rbritton »

I operate my own VPN endpoint for a couple reasons:

1. I frequently need to connect via open, untrusted local networks, such as those at hotels.

2. Many commercial VPNs (e.g., PIA) end up having some portion of their endpoint IPs end up on blacklists and break a lot of sites.

Anonymity from the government is a lower priority than both of the above, and I acknowledge the lack of it in my risk model.

Initially I started out just running a Streisand[0] server, but its scope and overall speed were unsuited for my wants. Now it's just a barebones VPS with OpenVPN running, and I connect to it primarily through a travel router.[1] Longer term I would like to develop an Ansible playbook so that I can quickly deploy a new endpoint at a close VPS when traveling if the need arises for better speed.

[0]: https://github.com/jlund/streisand

[1]: https://www.amazon.com/gp/product/B01I92T754/ref=oh_aui_deta...

Re: How to build your own VPN if you're wary of commercial options

#26

Post by LinuxBender »

AdmiralAsshat wrote: post #3

The problem with a home-grown VPN is that you lose some of the plausible deniability that's gained from a shared VPN. If you have a VPN connected to a privately-owned AWS instance, the IP coming from that AWS instance is easily traced back to you. Whereas if your external IP is coming from a cluster that is shared by thousands of other people using that VPN, it is more difficult for someone to tie that specifically b…

There are use cases that make sense. My home linux router intercepts and sends all DNS and NTP requests, then routes all DNS requests to multiple VPS nodes that in turn, use multiple DNS recursors at each VPS datacenter. I intentionally avoid google and opendns. I override the min-ttl of all requests to avoid some shenanigans and I am well aware of the issues this can cause.

At a minimum, my ISP can not see or tamper with DNS requests. My VPS nodes are multi-purpose so it isn't really extra cost.

This also gives me the capability to intercept some of my traffic and route it over my VPN using a combination of haproxy and squid. I can do this by source PC, or by destination, or protocol, or any combination thereof.

For me, this has worked great for years and gives me a lot more flexibility, options and control over my data flows. If I want more privacy, I can use my existing tc cbq QoS and rate limited rsync's of random noise to hide some traffic patterns.

Re: How to build your own VPN if you're wary of commercial options

#27

Post by daxorid »

This is odd. The primary point of VPN services (aside from a layer of protection on untrusted networks) is to mix your traffic in with N other random users such that the chance of you being identified as the source of the traffic is 1/N instead of 1/1.

Hosting your own VPN exit node, with you as the sole user, defeats this use case entirely.

Re: How to build your own VPN if you're wary of commercial options

#28

Post by closeparen »

masmullin wrote: post #22
AdmiralAsshat wrote: post #3

The problem with a home-grown VPN is that you lose some of the plausible deniability that's gained from a shared VPN. If you have a VPN connected to a privately-owned AWS instance, the IP coming from that AWS instance is easily traced back to you. Whereas if your external IP is coming from a cluster that is shared by thousands of other people using that VPN, it is more difficult for someone to tie that specifically b…

> AWS instance is easily traced back to you. Define "easily" as used in this context. Easy is a product of whom your enemy is. Is your enemy your ISP? If that's the case, I don't think it's "easy" for them; they would have to pay Digital Ocean or Amazon to get your data, and probably isn't really that valuable to them. Is your enemy the MPAA? If that's the case, I still don't think it's particularly "easy" for them.…

The MPAA will serve an automated DMCA notice to your VPS provider, who will terminate your account at the very least.

Re: How to build your own VPN if you're wary of commercial options

#29

Post by benevol »

AdmiralAsshat wrote: post #3

The problem with a home-grown VPN is that you lose some of the plausible deniability that's gained from a shared VPN. If you have a VPN connected to a privately-owned AWS instance, the IP coming from that AWS instance is easily traced back to you. Whereas if your external IP is coming from a cluster that is shared by thousands of other people using that VPN, it is more difficult for someone to tie that specifically b…

> plausible deniability that's gained from a shared VPN

Browser and device fingerprinting have become very powerful making VPNs not a very solid solution.

Re: How to build your own VPN if you're wary of commercial options

#30

Post by blacksmith_tb »

masmullin wrote: post #22
AdmiralAsshat wrote: post #3

The problem with a home-grown VPN is that you lose some of the plausible deniability that's gained from a shared VPN. If you have a VPN connected to a privately-owned AWS instance, the IP coming from that AWS instance is easily traced back to you. Whereas if your external IP is coming from a cluster that is shared by thousands of other people using that VPN, it is more difficult for someone to tie that specifically b…

> AWS instance is easily traced back to you. Define "easily" as used in this context. Easy is a product of whom your enemy is. Is your enemy your ISP? If that's the case, I don't think it's "easy" for them; they would have to pay Digital Ocean or Amazon to get your data, and probably isn't really that valuable to them. Is your enemy the MPAA? If that's the case, I still don't think it's particularly "easy" for them.…

I agree overall, but PIA has may not be the best example, as they have been shown to not keep any data that could be subpoenaed[1]. One nice thing about running your own (if your client machine is on Linux) is being able to use Wireguard[2], which is quite a bit faster than OpenVPN, for example.

1: https://torrentfreak.com/vpn-providers-no-logging-claims-tes...

2: https://www.wireguard.io/performance/

Post reply on HN