Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Build your own private WireGuard VPN with PiVPN

jeffgeerling.com

Post reply on HN
Print view View original

81–90 of 235 posts

Re: Build your own private WireGuard VPN with PiVPN

#81

Post by nirav72 »

jrm4 wrote: post #77

Personally, if you're looking for "your own private" thing, I'm a much bigger fan of Tinc. The wireguards and zerotiers seem more appropriate for bigger, more corporate things? I do wish Tinc had a slightly easier onboarding process, but once it's up, there's a great deal of stuff that I see people dealing with that Tinc users don't have to much think about, especially, e.g. the Mesh deal.

Wireguard has a dead simple onboarding process as well. For users you want to grant access - providing a QR code and them installing the wireguard client app on their mobile device is all that is needed. Also wireguard server itself is a easy setup and has very little overhead. Took me like few minutes to install and setup on a raspberry pi 3. Of course, you do have to open up a port on your router. That's the only downside. I've since switched to Tailscale for that specific reason.

Re: Build your own private WireGuard VPN with PiVPN

#82

Post by belthesar »

distantsounds wrote: post #49

And then you hit CPU bottlenecks whenever you do literally anything bandwidth intensive. The limits of using hobbyist hardware, you get hobbyist level performance. A Raspberry Pi is a horrible solution for running Wireguard. You can get a tiny 1L PC running on an actual Intel or AMD processor with far more perf/$.

Jeff does explicitly call this out in his video, but as sibling commenters say, it's really a matter of whether that's enough for you. Even 20 Mbit symmetrical would be more than enough for me to run a stream from a Plex server while serving other web or SSH traffic easy enough. What you do say though brings up a great point though - if you ran this on a Pi and you're not getting the performance you need for your use case, check CPU utilization on the Pi, and consider running your VPN on a device with more oomph.

Re: Build your own private WireGuard VPN with PiVPN

#83

Post by nirav72 »

Toutouxc wrote: post #25

If your main usecase is accessing Home Assistant or exposing a few HTTP endpoints from your home network, you're maybe stuck under several NATs and you don't mind Cloudflare, then I can't not recommend Cloudflare Tunnel. You just run their app on your home server, set up forwarding as if you were setting up nginx or something, click a few buttons in their GUI and your home stuff is online, on HTTPS, with DDoS protect…

Do you have any security cameras configured in Home assistant showing a live feed? Reason I'm asking - it seems that CF has some clauses in their TOS that forbids anything but static content. So audio/video stream is a no-no. I'm also using CF tunnel. Just not for home assistant because of their restrictions. For HASS, I go through tailscale.

Re: Build your own private WireGuard VPN with PiVPN

#84

Post by stzsch »

I keep a pi with wireguard as a way to reboot my homeserver remotely if something goes wrong. A gpio pin connected to an optocoupler acts as second power switch on the motherboard.

Works well for testing stuff remotely or messing with VPN configurations on the server itself without leaving it stranded for good.

Re: Build your own private WireGuard VPN with PiVPN

#85

Post by BrandoElFollito »

otterpro wrote: post #4

Before going to a long 3 month trip to Asia last year, I installed WireGuard on my Raspberry Pi 1 (original model B from 2012) which was running at home in US. I found PiVPN to be the easiest way to install Wireguard. I didn't know if I even needed a VPN but I was glad, and I was able to use internet as if I were at home. It was weird, but a lot of sites are blocked oversea, even though it shouldn't. For example, I c…

> Apparently a lot of US business sites refuse to connect from oversea IP because (...) they just don't want to deal with it

I am French. What I find fascinating is that there are local US newspapers (that server a tiny community) that went through the effort to do a geoblock from the EU and put a page along the lines "we cannot be compliant to Privacy laws in the EU so we must block you".

Why do they care at all? How is the EU law relevant to their small, local business?

Large companies are different - there could be some litigation against their footprint in the EU etc. - but for thosewho just live in the US (or anywhere outside the EU) going the extra mile to block because of non compliance is really weird.

Re: Build your own private WireGuard VPN with PiVPN

#86

Post by digitallyfree »

Severian wrote: post #10

The one problem I encounter with Wireguard is the use of UDP. Some publicly accessible Wifi nets at shops don't allow UDP at all, and this effectively breaks use of the VPN. Yeah, there are utilities like setting up udptunnel or udp2raw and similar, but what a headache. I really don't agree with Wireguard's developers justification that it makes speeds terrible. Who cares? It'll be terrible using those utilities anyw…

This is the reason why I still stick with OpenVPN on TCP 443 for my selfhosted VPN. Yes performance suffers a bit but it works absolutely everywhere including behind campus/corp firewalls as no one blocks TCP 443. I've tried running a seperate UDP instance on a different port for situations where I need higher performance but for my use cases TCP works fine.

From my experience UDP 53 like another commenter suggested does not always work as some firewalls forcibly route all UDP 53 packets to their own local DNS server in order to prevent people from using their own.

As a bonus OpenVPN has the "port-share" option which allows you to share the port with other services like an SSL web server. SSLH is also an option if you want to host both your VPN and a HTTPS site on TCP 443.

Re: Build your own private WireGuard VPN with PiVPN

#87

Post by spaniard89277 »

jrm4 wrote: post #77

Personally, if you're looking for "your own private" thing, I'm a much bigger fan of Tinc. The wireguards and zerotiers seem more appropriate for bigger, more corporate things? I do wish Tinc had a slightly easier onboarding process, but once it's up, there's a great deal of stuff that I see people dealing with that Tinc users don't have to much think about, especially, e.g. the Mesh deal.

I don't think there are a lot of stuff easier to set up than ZeroTier, honestly. For me it has been a godsend.

Re: Build your own private WireGuard VPN with PiVPN

#88

Post by BrandoElFollito »

twodave wrote: post #75

If you're going this far, might as well do as the author did and add a pi-hole to the mix, issue some credentials to your phone and block ads and/or other stuff via DNS everywhere you go. I also use this to remote into my work computer from wherever I am, using my travel laptop, an iPad or even just my cell phone.

This. I started to tunnel my traffic via my Wireguard VPN (when outside) to cut these 30% of connections that are blocked by Pihole.

Pihole is really a great piece of work. It uses standard components (dnsmasq, standard lists) and does it well. I used to have it in a docker container but moved it to the ISP box when I got a new one (a French ISP called Free provides you with an Internet box that has a built-in VPN (WG or OpenVPN) and allows you to create VMs - this is where I ultimately moved Pihole because it is my DNS and DHCP server)

Re: Build your own private WireGuard VPN with PiVPN

#89

Post by ye-olde-sysrq »

I run wg-easy https://github.com/WeeJeWel/wg-easy for this sort of thing. I use the docker container, and it's great. "Just works".

Also, unrelated, I just decided I don't like the sentiment of "PiMyProjectName" branding. I know most projects don't just run on a Pi, and that the intent is to say "you can self-host thing", but at this point if you want to run a home server sort of thing, just buy some cheap 100-200 dollar minipc thing. That's how much you'd pay for a Pi now anyway, and it comes with such great features as:

* just establishing an ssh connection doesn't take multiple seconds

* the ethernet doesn't go over a usb hub

* it doesn't run on an sd card that is going to fail within a year

I'm pretty dismissive of ARM chips for homelab stuff at this point. There's super cheap minipcs with "real" processors that will just destroy even an expensive ARM board.

Pi's shine with their ability to run both a real/full Linux and also do gpio type stuff that otherwise is usually an arduino board. I don't have anything against low-level programming but damn is it just a lot more fun to do in python. I love the Rpi zero w 2 products for this, just enough juice to run wifi and a python loop, plus the gpio pins. Too bad they've been sold out for literally years.

Re: Build your own private WireGuard VPN with PiVPN

#90

Post by [deleted] »

oh_sigh wrote: post #33
tssva wrote: post #30

Earlier quoted context omitted.

If you don't do business in the EU why accept traffic from there and possibly have to deal with GDPR issues.

That's not how GDPR works but it is a common misconception and I can't really blame non-EU businesses for not taking the time to understand a foreign law when blocking is so easy.

[deleted]
Post reply on HN