Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Poor man's VPN (pay for only what you need)

github.com

Post reply on HN
Print view View original

41–50 of 106 posts

Re: Poor man's VPN (pay for only what you need)

#41

Post by andai »

sokoloff wrote: post #38
tzs wrote: post #22

Earlier quoted context omitted.

If a non-EU site finds itself subject to GDPR because of Article 3(2), they need to then worry about whether or not Article 27(2) applies to excuse them from Article 27(1). If not then they have to deal with the hassle and expense of hiring a representative in the Union. If they are indifferent to EU visitors but happen to get enough of them that 27(2) won't excuse them from 27(1), then it may be worth blocking EU vi…

Just reading this comment makes me inclined to block visitors from the EU from my hobby sites. (Work is compliant; hobby/personal stuff isn’t worth the bother of even reading what Article 3(2) is.)

I feel the same, and I live in the EU.

The silver lining of my aversion to collecting user data is that it aligns nicely with my beliefs about privacy and minimalism (ie. coming up with ideas for web applications that don't even need a backend).

Re: Poor man's VPN (pay for only what you need)

#42

Post by tzs »

sokoloff wrote: post #38
tzs wrote: post #22

Earlier quoted context omitted.

If a non-EU site finds itself subject to GDPR because of Article 3(2), they need to then worry about whether or not Article 27(2) applies to excuse them from Article 27(1). If not then they have to deal with the hassle and expense of hiring a representative in the Union. If they are indifferent to EU visitors but happen to get enough of them that 27(2) won't excuse them from 27(1), then it may be worth blocking EU vi…

Just reading this comment makes me inclined to block visitors from the EU from my hobby sites. (Work is compliant; hobby/personal stuff isn’t worth the bother of even reading what Article 3(2) is.)

Article 3(2) is short. Here it is:

> 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

> (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

> (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

Recital 23 includes an elaboration on (a):

> In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.

Probably nothing to worry about for a hobby site.

Re: Poor man's VPN (pay for only what you need)

#43

Post by somerando7 »

j1elo wrote: post #18

Since basically always, I'm still using PiVPN https://www.pivpn.io/ Is that out of favor nowadays, given new technologies like Wireguard have become mainstream? Would I be better off using this, or the Algo scripts that another commenter mentioned? ( https://github.com/trailofbits/algo )

how do you grab new IPs for your pi?

Re: Poor man's VPN (pay for only what you need)

#45

Post by daxuak »

gibs0ns wrote: post #40

I've generally considered an SSH tunnel as a poor man's VPN. If you're going to the effort to spinup a machine, and use SSH anyway, i find it much easier to use `ssh user@server.com -D 4444` then I can set my browser's proxy settings to use localhost:4444 as a SOCKS5 proxy. For those apps that don't have native proxy support, I use proxychains to force them over a proxy connection. Ofcourse this is only useful for a…

Second this. I haven't tried proxychains. iptables with redsocks[1] for redirection works pretty nice.

[1] https://github.com/darkk/redsocks

Re: Poor man's VPN (pay for only what you need)

#46

Post by [deleted] »

gibs0ns wrote: post #40

I've generally considered an SSH tunnel as a poor man's VPN. If you're going to the effort to spinup a machine, and use SSH anyway, i find it much easier to use `ssh user@server.com -D 4444` then I can set my browser's proxy settings to use localhost:4444 as a SOCKS5 proxy. For those apps that don't have native proxy support, I use proxychains to force them over a proxy connection. Ofcourse this is only useful for a…

[deleted]

Re: Poor man's VPN (pay for only what you need)

#47

Post by ignoramous »

NavinF wrote: post #39
yjftsjthsd-h wrote: post #13

Earlier quoted context omitted.

> why bother Last I checked, wireguard had much better performance than sshuttle. May or may not matter for your use case, but it's a reason.

Yes! Last time I used sshuttle (bypassing content blocks in India by tunneling to a server in the US), my bandwidth dropped from 10mbps to 1mbps. Back then wireguard didn’t exist, but IPSEC could easily saturate the 10mbps link. I suspect it’s a combination of TCP-over-TCP and a horrible default buffer size that makes sshuttle unusably slow.

You don't need VPNs to bypass censorship blocks in India. Well, at least in my experience.

Apps that manipulate TCP packets locally to break fingerprinting [0] like GoodbyeDPI (Windows) [1], GreenTunnel (cross platform CLI) [2], Intra (Android) [3] have been adequate.

[0] https://nitter.net/vinifortuna/status/1304189371688660992 (https://twitter.com/vinifortuna/status/1304189371688660992)

[1] https://github.com/ValdikSS/GoodbyeDPI

[2] https://github.com/SadeghHayeri/GreenTunnel

[3] https://github.com/Jigsaw-Code/intra

Re: Poor man's VPN (pay for only what you need)

#48

Post by rkeene2 »

gibs0ns wrote: post #40

I've generally considered an SSH tunnel as a poor man's VPN. If you're going to the effort to spinup a machine, and use SSH anyway, i find it much easier to use `ssh user@server.com -D 4444` then I can set my browser's proxy settings to use localhost:4444 as a SOCKS5 proxy. For those apps that don't have native proxy support, I use proxychains to force them over a proxy connection. Ofcourse this is only useful for a…

That is a SOCKS5 proxy (as you said), however SSH can pass IP packets or Ethernet frames:

https://rkeene.org/viewer/tmp/ssh-ip-tunnel.txt.htm

Re: Poor man's VPN (pay for only what you need)

#49

Post by suifbwish »

gibs0ns wrote: post #40

I've generally considered an SSH tunnel as a poor man's VPN. If you're going to the effort to spinup a machine, and use SSH anyway, i find it much easier to use `ssh user@server.com -D 4444` then I can set my browser's proxy settings to use localhost:4444 as a SOCKS5 proxy. For those apps that don't have native proxy support, I use proxychains to force them over a proxy connection. Ofcourse this is only useful for a…

Haha I came here to say just that. Using NAT and routing you can setup the machine initiating the client ssh connection to act as an internet gateway for the clients that have its IP set as their gateway. Did this with a raspberry pi before.

Re: Poor man's VPN (pay for only what you need)

#50

Post by Osiris »

julienb_sea wrote: post #20

My cyberghost vpn is under 3$/mo and has unlimited usage. It's hard to imagine any pay-as-you-go scheme coming even close from a cost perspective.

I used to use a very cheap NAT VPS as an OpenVPN server but after it got terminated I found CyberGhost. It is a lot more flexible and usable across multiple devices with the downside of not being able to open incoming ports.
Post reply on HN