[deleted]
Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN
61–70 of 88 posts
Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN
#62I once wanted to write an Ansible playbook to install VPN on a server but found out that you cannot just pass parameters via command line like ansible setup-vpn 1.2.3.4 Ansible expects you to write host address into a file in /etc. So inconvenient. Also, Ansible doesn't support Windows and Cygwin. It turned out it was easier to write instructions into a Bash program. Sadly, it is non-portable and works only with a sp…
Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN
#63Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN
#64It should be noted that if you've setup Algo already that it now supports WireGuard. The WireGuard Android app (which would be great to verify that it is indeed published by www.wireguard.com) is stupid easy to setup and enable on your device.
It already is linked on the installation page:
https://www.wireguard.com/install/#android-play-store-f-droi...
Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN
#65I actually tried running Algo through Azure and Microsoft terminated my Azure account citing I was breaking Terms of Service. I had hosted Algo for all of two and a half days before the takedown. Not sure if anyone else has had luck - that was all I was using Azure for was to test Algo out so had nothing else running on Azure at the time. I also ran into a few snags trying to deplay Algo onto Azure so haven't bothere…
I have been running my algo VM (with wireguard) in Azure for 2-3 months now without issue. For me it is nice because there is an Azure region pretty close to me so I don't take a _huge_ hit traversing the country.
I do work at MSFT but my algo VM is inside of my personal account.
Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN
#66Given this post's HN commentary is full of seemingly well-informed perspectives on the relative merits of several VPN service providers and software packages can anyone comment on Private Tunnel? I've been using it for years, having paid something like $20 for 100GB. No complaints, but interested in expert opinion / insights regarding privacy and security. Thanks!
My choice is typically between "should I use a hosted provider" vs "should I host my own." IMHO there is not a vast amount of difference between hosted VPN providers. They all suffer from generally the same issues.
Here are some reasons you might want to self-host:
https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-th...
Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN
#67Earlier quoted context omitted.
That is the parent comment's point. This will protect you from your local ISP. It will not protect you from the government (or the ISP on the other end of the tunnel). A VPN does not 'hide' your IP address. It merely changes it.
> That is the parent comment's point. "You shouldn’t use Algo if you are concerned about surveillance from corporations/governments" --- wrong, because Govs get all ISP data. > It will not protect you from the government But it will , because all the government will see (using ISP data) is some VPN traffic from me, nothing more. VPN does hide my IP address - all further connections are made from VPN IP, used by thous…
Where would your VPN be? What makes you think the government doesn't monitor traffic flows there? They don't even need to monitor traffic flows at your home's ISP, since they can see both legs of the connection just by watching the network your VPN server is on.
If you're in a FVEY country, you can't count on any real network metadata privacy protection (against your own country's government) for near-realtime communication. Multiple hops (e.g. tor) makes it more difficult for them, but also makes your internet connection slow and unreliable, and your traffic becomes even higher priority for them to investigate; if they happen to have flow data on each of the nodes you use, you're probably unmasked.
Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN
#68Use Wireguard. It is wonderful and the community is friendly. `wg-quick` is easy to use but if you need it, I believe Streisand supports automatically provisioning a wireguard setup.
I tried using it but unlike IPSEC/SSL VPNs, it doesn't punch through many firewalls. Not Wireguard fault, but in my case IPSEC worked better. I guess I could encapsulate it, but it's just annoying to do and on some platforms it's just too much trouble.
WireGuard supports persistent keepalives to punch through most firewalls[0].
If your firewall blocks UDP packets in general, you're in a world of pain either way, since TCP over TCP is pretty bad.
[0] https://www.wireguard.com/quickstart/#nat-and-firewall-trave...
Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN
#69I once wanted to write an Ansible playbook to install VPN on a server but found out that you cannot just pass parameters via command line like ansible setup-vpn 1.2.3.4 Ansible expects you to write host address into a file in /etc. So inconvenient. Also, Ansible doesn't support Windows and Cygwin. It turned out it was easier to write instructions into a Bash program. Sadly, it is non-portable and works only with a sp…
Ansible works on Windows
https://www.ansible.com/integrations/infrastructure/windows
I don’t get the Ansible hate, it’s great.
Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN
#70I once wanted to write an Ansible playbook to install VPN on a server but found out that you cannot just pass parameters via command line like ansible setup-vpn 1.2.3.4 Ansible expects you to write host address into a file in /etc. So inconvenient. Also, Ansible doesn't support Windows and Cygwin. It turned out it was easier to write instructions into a Bash program. Sadly, it is non-portable and works only with a sp…
>Ansible expects you to write host address into a file in /etc. So inconvenient.
When I was first learning ansible, I was very frustrated about things like this. I came to learn, though, that it is very flexible, and this behavior, as well as other weirdness is completely overrideable.
Two ways to override this behavior, with the inventory.ini file in the same directory as the project:
1) ansible.cfg in the project directory that points to the inventory file (you can also override other default behaviors using this file.)
2) pass in a -i argument with the path to the file.
I usually just go with option 1, because I like overriding many of the default behaviors (like making cowsay random, or turning it off sometimes), or setting up my ansible vault.