Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN • Hacker News Board

Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN

#71

Post by auslander » Wed, Aug 22, 2018, 1:57 PM UTC

harshreality wrote: post #67

auslander wrote: post #58

Earlier quoted context omitted.

> That is the parent comment's point. "You shouldn’t use Algo if you are concerned about surveillance from corporations/governments" --- wrong, because Govs get all ISP data. > It will not protect you from the government But it will , because all the government will see (using ISP data) is some VPN traffic from me, nothing more. VPN does hide my IP address - all further connections are made from VPN IP, used by thous…

Where would your VPN be? What makes you think the government doesn't monitor traffic flows there ? They don't even need to monitor traffic flows at your home's ISP, since they can see both legs of the connection just by watching the network your VPN server is on. If you're in a FVEY country, you can't count on any real network metadata privacy protection (against your own country's government) for near-realtime commu…

> your traffic becomes even higher priority for them to investigate

You use tor, your ISP marks it, it triggers priority for them to investigate you. You use VPN to access tor, it triggers nothing.

Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN

#72

Post by cpach » Wed, Aug 22, 2018, 2:03 PM UTC

codedokode wrote: post #56

I once wanted to write an Ansible playbook to install VPN on a server but found out that you cannot just pass parameters via command line like ansible setup-vpn 1.2.3.4 Ansible expects you to write host address into a file in /etc. So inconvenient. Also, Ansible doesn't support Windows and Cygwin. It turned out it was easier to write instructions into a Bash program. Sadly, it is non-portable and works only with a sp…

Are there any specific VPS hosts you would recommend in Europe?

Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN

#73

Post by geofft » Wed, Aug 22, 2018, 2:03 PM UTC

auslander wrote: post #63

JshWright wrote: post #57

Earlier quoted context omitted.

Based on what evidence?

I just think being cautious is wise, given how new WG is. And, AFAIK it is userland only, like OpenVpn, not in linux kernel, think performance.

There is a WireGuard kernel module, and it also seems weird to me to say "This is a mess" when what you actually mean is "Nobody yet knows if it is a mess or not and I have no evidence either way."

Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN

#74

Post by ishanjain28 » Wed, Aug 22, 2018, 2:51 PM UTC

auslander wrote: post #53

ishanjain28 wrote: post #35

How do you decide what vpn tech to use? I was using openvpn and then switched to wireguard because openvpn was consuming a lot of power on my phone. Why would I want to use Ipsec?

> Why would I want to use Ipsec? Why wouldn't you?

I don't know. I briefly used IPsec when I stopped using OpenVPN and I was looking for alternatives. The setup for IPsec on the server was slightly annoying. I used a Github project that sets up everything for me but the script didn't do everything.

And I have observed(from just using IPsec and wireguard on my phone) that wireguard is quite good(maybe even better) than IPsec at not annihilating internet bandwidth.

Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN

#75

Post by ishanjain28 » Wed, Aug 22, 2018, 2:53 PM UTC

ReverseCold wrote: post #36

ishanjain28 wrote: post #35

How do you decide what vpn tech to use? I was using openvpn and then switched to wireguard because openvpn was consuming a lot of power on my phone. Why would I want to use Ipsec?

> Why would I want to use Ipsec? It's already built into your phone. (Probably)

It is. But just one tiny app for VPN isn't too bad if that VPN does not ruin internet bandwidth.

Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN

#76

Post by azinman2 » Wed, Aug 22, 2018, 3:08 PM UTC

auslander wrote: post #71

harshreality wrote: post #67

Earlier quoted context omitted.

Where would your VPN be? What makes you think the government doesn't monitor traffic flows there ? They don't even need to monitor traffic flows at your home's ISP, since they can see both legs of the connection just by watching the network your VPN server is on. If you're in a FVEY country, you can't count on any real network metadata privacy protection (against your own country's government) for near-realtime commu…

> your traffic becomes even higher priority for them to investigate You use tor, your ISP marks it, it triggers priority for them to investigate you . You use VPN to access tor, it triggers nothing.

Evidence?

Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN

#77

Post by alchemism » Wed, Aug 22, 2018, 3:10 PM UTC

Also is great. I extend this script and use it as a quick-and-easy way of managing my dev team’s vpn into our clouds.

Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN

#78

Post by whisk3rs » Wed, Aug 22, 2018, 3:50 PM UTC

m-p-3 wrote: post #59

eximius wrote: post #31

Use Wireguard. It is wonderful and the community is friendly. `wg-quick` is easy to use but if you need it, I believe Streisand supports automatically provisioning a wireguard setup.

I tried using it but unlike IPSEC/SSL VPNs, it doesn't punch through many firewalls. Not Wireguard fault, but in my case IPSEC worked better. I guess I could encapsulate it, but it's just annoying to do and on some platforms it's just too much trouble.

Try Wireguard on port 4500; this is usually allowed by any firewall/filter that allows ipsec.

Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN

#79

Post by aaronmdjones » Wed, Aug 22, 2018, 3:58 PM UTC

auslander wrote: post #63

JshWright wrote: post #57

Earlier quoted context omitted.

Based on what evidence?

I just think being cautious is wise, given how new WG is. And, AFAIK it is userland only, like OpenVpn, not in linux kernel, think performance.

I'm not sure where you're getting your information; the /de facto/ primary WireGuard implementation is a Linux kernel module.

Re: Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN

#80

Post by aaronmdjones » Wed, Aug 22, 2018, 4:01 PM UTC

mistaken wrote: post #39

eximius wrote: post #31

Use Wireguard. It is wonderful and the community is friendly. `wg-quick` is easy to use but if you need it, I believe Streisand supports automatically provisioning a wireguard setup.

Wireguard is awesome, but the kernel module is so far a mess. If you're paranoid I wouldn't rely on it until the code has been cleaned up and perhaps audited.

Ordinarily I would appreciate comments calling for an audit of security-critical software, but spoken with such derision and apparently ignorant of the fact that the author audits code for a living I can't get behind. As for "cleaned up", LKML's only objections to it so far are formatting; think variable declarations, line wrapping (or lack thereof), et al.