Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Build your own private WireGuard VPN with PiVPN

jeffgeerling.com

Post reply on HN
Print view View original

61–70 of 235 posts

Re: Build your own private WireGuard VPN with PiVPN

#61

Post by FeistySkink »

distantsounds wrote: post #49

And then you hit CPU bottlenecks whenever you do literally anything bandwidth intensive. The limits of using hobbyist hardware, you get hobbyist level performance. A Raspberry Pi is a horrible solution for running Wireguard. You can get a tiny 1L PC running on an actual Intel or AMD processor with far more perf/$.

I'm not sure what's the max throughput is, but I just tested 50 Mbit down/80 Mbit up passthrough from a cafe Wi-Fi to my 3B with Wireguard (using wg-quick) at home. Seems enough for anything I'd use it for.

Re: Build your own private WireGuard VPN with PiVPN

#62

Post by mmlkrx »

Another simple solution I installed on my existing server in actually 5 min via docker run is https://github.com/WeeJeWel/wg-easy. The interface is very simple, and all in all it took 10 min to have the VPN up and running, download the client applications, and connect to it!

Re: Build your own private WireGuard VPN with PiVPN

#63

Post by xp84 »

distantsounds wrote: post #49

And then you hit CPU bottlenecks whenever you do literally anything bandwidth intensive. The limits of using hobbyist hardware, you get hobbyist level performance. A Raspberry Pi is a horrible solution for running Wireguard. You can get a tiny 1L PC running on an actual Intel or AMD processor with far more perf/$.

There are some cool HP thin clients available on eBay for a fraction of the scarce Pi these days, one of them even has an nVme slot so you can put in a real SSD. If I was doing this today I’d use one of those.

Presently my “home server” is only used for home assistant, and it runs on a 2011 MacBook Pro with a bad keyboard, running Debian. It actually runs so well on Linux that the fan doesn’t even spin, at least not audibly.

Re: Build your own private WireGuard VPN with PiVPN

#64

Post by LeSaucy »

shocks wrote: post #43
briancmoses wrote: post #23

At the price Raspberry Pis are being sold (scalped) for it's discouraging and disappointing to see content creators continually going to that well. You can buy a travel router like the GL.iNet GL-SFT1200 (Opal) for $39.99. All of Gl.iNet's devices run OpenWRT already. Setting up Wireguard on OpenWRT is easy, and using Tailscale is even easier! Edit: Jeff's been creating awesome Raspberry Pi content for a long time an…

Did you read the article? > PiVPN, luckily, runs on any other Pi-like device, though, as long as it's running a Debian or Pi-OS-like distro.

So…Linux?

Re: Build your own private WireGuard VPN with PiVPN

#65

Post by Denvercoder9 »

indeyets wrote: post #57

WireGuard/Tailscale are fine if you don't need to deal with state-wide censorship. They might be blocked quite easily. Outline/Shadowsocks has better chances to keep working (though it is not a true vpn, more like a private proxy) https://getoutline.org/

In what way is WireGuard easier to block than SOCKS?

Re: Build your own private WireGuard VPN with PiVPN

#66

Post by uriah »

OrderlyTiamat wrote: post #26
Severian wrote: post #10

The one problem I encounter with Wireguard is the use of UDP. Some publicly accessible Wifi nets at shops don't allow UDP at all, and this effectively breaks use of the VPN. Yeah, there are utilities like setting up udptunnel or udp2raw and similar, but what a headache. I really don't agree with Wireguard's developers justification that it makes speeds terrible. Who cares? It'll be terrible using those utilities anyw…

VPN over TCP really is quite a bit slower than over UDP, which makes it quite undesirable for me. I think it's quite reasonable of them not to want to complicate the wg project by adding and maintaining the option of UDP over TCP. Remember, wg is supposed to be a minimal project. If you really need TCP traffic, you could always use openVPN. With quic on the way, this problem will diminish with time anyway.

There's complicating the protocol and complicating the client. It would definitely be nice if they would add a solution to this to the official clients, particularly mobile ones. VPN over UDP is quite a bit slower than over TCP when the ISP blocks/throttles the UDP traffic...

Re: Build your own private WireGuard VPN with PiVPN

#67

Post by flas9sd »

blutack wrote: post #2

If your router supports OpenWRT that's a good alternative that doesn't require any additional boxes/boards and is simpler to set up networking-wise. There's a nice UI that generates the QR codes or config files ready for import into client devices. 1: https://openwrt.org/docs/guide-user/services/vpn/wireguard/b...

yes the webui now has some convenience options for generating and importing configs, but there's still a gap (as in default package installed) in client profile management or network management on cli.

What pivpn (and similar tooling wrapping lower level commands) bring along is this client management and even some network topology/routing management : https://docs.pivpn.io/wireguard/ and https://github.com/pivpn/pivpn/tree/master/scripts/wireguard

I think it's a interesting spectrum between wg-cli and tailscale.

Re: Build your own private WireGuard VPN with PiVPN

#68

Post by indeyets »

Denvercoder9 wrote: post #65
indeyets wrote: post #57

WireGuard/Tailscale are fine if you don't need to deal with state-wide censorship. They might be blocked quite easily. Outline/Shadowsocks has better chances to keep working (though it is not a true vpn, more like a private proxy) https://getoutline.org/

In what way is WireGuard easier to block than SOCKS?

that's "shadowsocks"

wireguard is fingerprintable. it's trivial to look at packets and see "this is wireguard". and block the packets

Outline traffic looks much more like noise (pre-shared keys, lack of handshake, …)

Re: Build your own private WireGuard VPN with PiVPN

#69

Post by Denvercoder9 »

indeyets wrote: post #68
Denvercoder9 wrote: post #65

Earlier quoted context omitted.

In what way is WireGuard easier to block than SOCKS?

that's "shadowsocks" wireguard is fingerprintable. it's trivial to look at packets and see "this is wireguard". and block the packets Outline traffic looks much more like noise (pre-shared keys, lack of handshake, …)

> that's "shadowsocks"

I'm not familiar with the software, but according to Wikipedia it's a client to connect to a SOCKS5 proxy:

> Shadowsocks is not a proxy on its own, but (typically) is the client software to help connect to a third-party SOCKS5 proxy, which is similar to a Secure Shell (SSH) tunnel.

Are you saying that's incorrect?

Post reply on HN