Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to build your own VPN if you're wary of commercial options

arstechnica.com

Post reply on HN
Print view View original

51–60 of 117 posts

Re: How to build your own VPN if you're wary of commercial options

#51

Post by vbezhenar »

andresgottlieb wrote: post #40
AdmiralAsshat wrote: post #3

The problem with a home-grown VPN is that you lose some of the plausible deniability that's gained from a shared VPN. If you have a VPN connected to a privately-owned AWS instance, the IP coming from that AWS instance is easily traced back to you. Whereas if your external IP is coming from a cluster that is shared by thousands of other people using that VPN, it is more difficult for someone to tie that specifically b…

Vultr ( http://www.vultr.com/?ref=6979836 ) allows you to pay with bitcoin, making it more difficult to trace you

But they are likely to provide IP addresses used to connect to your server. So now you're facing the same problem, if you wanted to hide your IP address.

Re: How to build your own VPN if you're wary of commercial options

#52

Post by [deleted] »

andresgottlieb wrote: post #40
AdmiralAsshat wrote: post #3

The problem with a home-grown VPN is that you lose some of the plausible deniability that's gained from a shared VPN. If you have a VPN connected to a privately-owned AWS instance, the IP coming from that AWS instance is easily traced back to you. Whereas if your external IP is coming from a cluster that is shared by thousands of other people using that VPN, it is more difficult for someone to tie that specifically b…

Vultr ( http://www.vultr.com/?ref=6979836 ) allows you to pay with bitcoin, making it more difficult to trace you

[deleted]

Re: How to build your own VPN if you're wary of commercial options

#53

Post by LinuxBender »

ghotli wrote: post #46
LinuxBender wrote: post #26

Earlier quoted context omitted.

There are use cases that make sense. My home linux router intercepts and sends all DNS and NTP requests, then routes all DNS requests to multiple VPS nodes that in turn, use multiple DNS recursors at each VPS datacenter. I intentionally avoid google and opendns. I override the min-ttl of all requests to avoid some shenanigans and I am well aware of the issues this can cause. At a minimum, my ISP can not see or tamper…

That's really cool. Do you have links to share about that setup?

Sorry, I do not. I set it up manually. While I do have some scripts, they are custom tailored to my network setup. That said, it's really easy to do.

You could use the other github scripts that folks have linked for setting up the VPN. Then you would want to set up recursive DNS servers on your home router and VPS nodes. Then look into iptables mangle to intercept DNS, NTP, etc. HAProxy L4 vip on the router is an easy way to forward some web traffic to Squid running on multiple VPS nodes. Squid has an intercept mode you can use for any traffic you want to throw at it. Unbound DNS can override min-ttl and allows overriding partial or complete DNS zones for block some shenanigans. Calomel.org has some articles on some of these things.

It's probably even better if you research each step yourself so that adversaries have to work harder to generalize attacks around your configuration.

Re: How to build your own VPN if you're wary of commercial options

#54

Post by Psilidae »

TACIXAT wrote: post #4

Alternatively, just use Algo. [1] It's a self-hosted, hardened IPSEC VPN that automates setup on multiple cloud providers. 1. https://github.com/trailofbits/algo

I'm really happy with Algo!

One minor issue I experienced: I have not had a good experience using Digital Ocean for VPNs. I tried manually setting up OpenVPN on it a while ago and got really bad upload speed (admittedly, I could have misconfigured it). With Algo, the speed seemed okay, but I would frequently "disconnect" every hour or two. According to Windows, I was still connected to the VPN, but my traffic wasn't getting out; I'd have to manually reconnect to get Internet access again.

I set up Algo on Azure a month ago and have had no problems at all. I'd highly recommend Algo if you're looking for ISP/untrusted network protection and pseudo-anonymization (3rd parties just seeing a cloud IP rather than your home IP).

Re: How to build your own VPN if you're wary of commercial options

#55

Post by AlexCoventry »

I have no current need for it, but I'd be really interested to read a step-by-step guide on setting up an untraceable server using cryptocurrency, starting from cash. As others have pointed out, the hole in these instructions is that you have to trust Digital Ocean.

Re: How to build your own VPN if you're wary of commercial options

#56

Post by 5_minutes »

andresgottlieb wrote: post #40
AdmiralAsshat wrote: post #3

The problem with a home-grown VPN is that you lose some of the plausible deniability that's gained from a shared VPN. If you have a VPN connected to a privately-owned AWS instance, the IP coming from that AWS instance is easily traced back to you. Whereas if your external IP is coming from a cluster that is shared by thousands of other people using that VPN, it is more difficult for someone to tie that specifically b…

Vultr ( http://www.vultr.com/?ref=6979836 ) allows you to pay with bitcoin, making it more difficult to trace you

With referral link?

Re: How to build your own VPN if you're wary of commercial options

#57

Post by LinuxBender »

kitotik wrote: post #47

I'm surprised that tinc-vpn.org isn't mentioned more in these VPN threads. It's such a pleasure to work with when compared to OpenVPN. You can standup a distributed mesh VPN in minutes.

You should add that it routes in user-space without turning on kernel forwarding, to any node in the network even if they are not directly connected. There are some nice privacy and availability aspects to this.

Re: How to build your own VPN if you're wary of commercial options

#58

Post by kfrzcode »

LinuxBender wrote: post #53
ghotli wrote: post #46

Earlier quoted context omitted.

That's really cool. Do you have links to share about that setup?

Sorry, I do not. I set it up manually. While I do have some scripts, they are custom tailored to my network setup. That said, it's really easy to do. You could use the other github scripts that folks have linked for setting up the VPN. Then you would want to set up recursive DNS servers on your home router and VPS nodes. Then look into iptables mangle to intercept DNS, NTP, etc. HAProxy L4 vip on the router is an eas…

Really easy to do :)

I love HN

Re: How to build your own VPN if you're wary of commercial options

#59

Post by yaantc »

the_common_man wrote: post #38

What's the difference between L2TP/IPsec and OpenVPN?

They are three different protocols allowing to tunnel encrypted traffic between two end points:

- L2TP is the "layer 2 tunneling protocol", where the layer 2 is usually PPP, and an IETF standard;

- IPsec is designed to tunnel IP over IP, and an IETF standard;

- OpenVPN is a specific software and protocol, using TLS. IF memory serves well it can operate at both Ethernet and IP level, although IP is the most common.

Re: How to build your own VPN if you're wary of commercial options

#60

Post by daxorid »

loader wrote: post #43
closeparen wrote: post #28

Earlier quoted context omitted.

The MPAA will serve an automated DMCA notice to your VPS provider, who will terminate your account at the very least.

Amazon's not in the business of terminating accounts the second a copyright request comes in. They want to build trust with their customers that they won't just turn you off on a whim.

I can vouch for this, from the other side. We routinely catch AWS hosts running password-guessing bots against our login forms. Emailing abuse@amazonaws.com doesn't seem to lead to reductions in our fail2ban and custom tarpit logs.
Post reply on HN