Build your own private WireGuard VPN with PiVPN

Up until late 2014 when I occasionally worked at home, I used what I called the poor man's VPN. There was one machine at my company that I had ssh access to from outside and that could reach all the internal machines I needed. Call that machine ssh.example.com.

My requirements for comfortably working from home were:

1. Nothing special needs to be done at work. I don't have to ask for anything new to be installed there, or firewall rules to be changed, or anything like that.

2. I wanted to be able to refer to work machines by the same names they had on the internal network at work, and I wanted to access things on the same ports. A script that worked when run from my office should work with no changes when run from my living room.

3. It only needed to support host:port combinations that were explicitly specified.

Here's what I did. Let's say I've got 3 machines I need to use:

  db.example.com:   MySQL server
  mail.example.com: mail server
  web.example.com:  web server

I need to use MySQL on the first (port 3306), IMAPS on the second (port 993), and HTTP/HTTPS on the third (ports 80 and 443), and I want to use ssh (port 22) on all of them.

I'd ssh to the machine at work that I have ssh access to, with my ssh config file including this:

  Host poor_vpn
    Hostname ssh.example.com
    User tzs
    UserKnownHostsFile ~/.ssh/poor_vpn.hosts
    LocalForward 7777 db.example.com:22
    LocalForward 7778 db.example.com:3306
    LocalForward 7779 mail.example.com:22
    LocalForward 7780 mail.example.com:993
    LocalForward 7781 web.example.com:22
    LocalForward 7782 web.example.com:80
    LocalForward 7783 web.example.com:443

I'd add this to /etc/hosts:

  10.10.10.1 db.example.com
  10.10.10.2 mail.example.com
  10.10.10.3 web.example.com

(My LAN used 192.168.0.x addresses)

Finally, a little ipfw fiddling on my Mac to bring it all together:

  ipfw add 100 fwd 127.0.0.1,7777 tcp from any to 10.10.10.1 22
  ipfw add 101 fwd 127.0.0.1,7778 tcp from any to 10.10.10.1 3306
  ipfw add 102 fwd 127.0.0.1,7779 tcp from any to 10.10.10.2 22
  ipfw add 103 fwd 127.0.0.1,7780 tcp from any to 10.10.10.2 993
  ipfw add 104 fwd 127.0.0.1,7781 tcp from any to 10.10.10.3 22
  ipfw add 105 fwd 127.0.0.1,7782 tcp from any to 10.10.10.3 80
  ipfw add 106 fwd 127.0.0.1,7783 tcp from any to 10.10.10.3 443

On Linux that would have been something like this:

  iptables -t nat -A OUTPUT -p tcp -d 10.10.10.1 --dport 22 REDIRECT --to-port 7777
  iptables -t nat -A OUTPUT -p tcp -d 10.10.10.1 --dport 3306 REDIRECT --to-port 7778
  iptables -t nat -A OUTPUT -p tcp -d 10.10.10.2 --dport 22 REDIRECT --to-port 7779
  iptables -t nat -A OUTPUT -p tcp -d 10.10.10.2 --dport 993 REDIRECT --to-port 7780
  iptables -t nat -A OUTPUT -p tcp -d 10.10.10.3 --dport 22 REDIRECT --to-port 7781
  iptables -t nat -A OUTPUT -p tcp -d 10.10.10.3 --dport 80 REDIRECT --to-port 7782
  iptables -t nat -A OUTPUT -p tcp -d 10.10.10.3 --dport 443 REDIRECT --to-port 7783

That worked great for several years. I've got a script that can take a list of files that describe host:port combination and generate the ssh config, hosts, and ipfw or iptabes rules so it was easy to add or remove machines.

It broke in late 2014 when I switch to MacOS Yosemite. Apple had switched to using PF in Lion in 2011 and deprecated ipfw, and removed it in Yosemite. By then we had an openvpn setup at work and I switched to using that.

Algo project still works well. Very quickly launch a WireGuard VPN to several popular cloud providers, or any Linux instance you already have access to, including your rPi.

https://github.com/trailofbits/algo

Tinc was my goto for years, but there is a non-trivial performance penalty for it's userspace implementation.

If you can enumerate all your endpoints into wireguard, and squint, it'll kinda-sorta act like a mesh.

And if you want to go a little crazy with it, You can run https://github.com/m13253/VxWireguard-Generator + babeld, and get routing around failures in the mesh.

Just have to pay attention and be picky while shopping for the mini pc. Yes most of them are way over 15W but you can find them under 15W. My Quieter3Q for instance is fanless & runs on a Celeron in just 15W. I love it, but one annoyance is, it does not come back on by itself after a power interruption.

> Apparently a lot of US business sites refuse to connect from oversea IP because of too many hacking attempts, or they just don't want to deal with it.

Yes, and it's infuriating. For example, it was (and probably still is) impossible to access the NY MTA's OMNY portal from many, but curiously not all, European countries. The OMNY system itself works using foreign cards, but this makes it very annoying to download receipts for expense reports.

Another fun one was not being able to cancel some streaming service from outside of the US due to the service geoblocking their account management site as well. I actually had to use a VPN to cancel!

There are countless other examples.