IPSEC is broken by (NSA) design. Use Wireguard instead.
https://www.mail-archive.com/cryptography@metzdowd.com/msg12...
Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN
51–60 of 88 posts
Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN
#52I prefer https://github.com/hwdsl2/setup-ipsec-vpn . Shamless blog post on setting it up on a Raspberry Pi 3 - https://blog.elasticbyte.net/setting-up-a-native-cisco-ipsec...
See also https://github.com/jawj/IKEv2-setup for IKEv2 (I made this)
Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN
#53How do you decide what vpn tech to use? I was using openvpn and then switched to wireguard because openvpn was consuming a lot of power on my phone. Why would I want to use Ipsec?
> Why would I want to use Ipsec?
Why wouldn't you?
Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN
#54It’s worth mentioning that it is not, nor does TrailOfBits pretend, that the goal of this project is privacy; it is security. Algo doesn’t and couldn’t care less about your privacy once you reach the endpoint, only about securing the tunnel. You shouldn’t use Algo if you are concerned about surveillance from corporations/governments, you should use Algo if you are concerned about surveillance/attacks from your local…
Governments take the data from ISP too. And hiding your IP behind VPN is good in any case.
That is the parent comment's point. This will protect you from your local ISP. It will not protect you from the government (or the ISP on the other end of the tunnel).
A VPN does not 'hide' your IP address. It merely changes it.
Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN
#55Given this post's HN commentary is full of seemingly well-informed perspectives on the relative merits of several VPN service providers and software packages can anyone comment on Private Tunnel? I've been using it for years, having paid something like $20 for 100GB. No complaints, but interested in expert opinion / insights regarding privacy and security. Thanks!
Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN
#56I once wanted to write an Ansible playbook to install VPN on a server but found out that you cannot just pass parameters via command line like
ansible setup-vpn 1.2.3.4
Ansible expects you to write host address into a file in /etc. So inconvenient. Also, Ansible doesn't support Windows and Cygwin.
It turned out it was easier to write instructions into a Bash program. Sadly, it is non-portable and works only with a specific distribution.
It is also surprising how many files are there in the repository for a relatively simple task. And how complicated installation process is. In PHP everything would be easier, because you can pack your application into a single phar archive like in Java.
They don't support builtin Android client. I remember I installed Strongswan or something like this and it worked with Android out of the box.
I wouldn't recommend Digital Ocean. They don't accept virtual debit card (they want a real card so they can charge you whenever they want) and their VPS are too expensive. $5 per month is too expensive when you can find offers as low as 1 euro/month in Europe with pre-paid system.
Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN
#57Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN
#58Earlier quoted context omitted.
Governments take the data from ISP too. And hiding your IP behind VPN is good in any case.
That is the parent comment's point. This will protect you from your local ISP. It will not protect you from the government (or the ISP on the other end of the tunnel). A VPN does not 'hide' your IP address. It merely changes it.
> That is the parent comment's point.
"You shouldn’t use Algo if you are concerned about surveillance from corporations/governments" --- wrong, because Govs get all ISP data.
> It will not protect you from the government
But it will, because all the government will see (using ISP data) is some VPN traffic from me, nothing more.
VPN does hide my IP address - all further connections are made from VPN IP, used by thousands, and not from my personal ISP IP.
Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN
#59Use Wireguard. It is wonderful and the community is friendly. `wg-quick` is easy to use but if you need it, I believe Streisand supports automatically provisioning a wireguard setup.
I tried using it but unlike IPSEC/SSL VPNs, it doesn't punch through many firewalls.
Not Wireguard fault, but in my case IPSEC worked better. I guess I could encapsulate it, but it's just annoying to do and on some platforms it's just too much trouble.
Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN
#60I once wanted to write an Ansible playbook to install VPN on a server but found out that you cannot just pass parameters via command line like ansible setup-vpn 1.2.3.4 Ansible expects you to write host address into a file in /etc. So inconvenient. Also, Ansible doesn't support Windows and Cygwin. It turned out it was easier to write instructions into a Bash program. Sadly, it is non-portable and works only with a sp…
You can specify inventory on the command line with -i