Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Build your own private WireGuard VPN with PiVPN

jeffgeerling.com

Post reply on HN
Print view View original

141–150 of 235 posts

Re: Build your own private WireGuard VPN with PiVPN

#141

Post by AnthonyMouse »

jmole wrote: post #108
ye-olde-sysrq wrote: post #89

I run wg-easy https://github.com/WeeJeWel/wg-easy for this sort of thing. I use the docker container, and it's great. "Just works". Also, unrelated, I just decided I don't like the sentiment of "PiMyProjectName" branding. I know most projects don't just run on a Pi, and that the intent is to say "you can self-host thing", but at this point if you want to run a home server sort of thing, just buy some cheap 100-200 do…

I’ve been curious about the performance gap here – you can open htop on a pi 4 and see that CPU utilization is relatively low, ~33% out of 400%, something like that, and yet some operations seem like they take 5-6x longer than they ought to on a “normal” computer. Is it all down to the file system? Is the CPU just in interrupt overload all the time? I wish I had a better understanding of the issue here.

CPU load metrics are averages, typically over e.g. a second. Many operations take less time than that. If something takes 300ms on a Pi and 50ms on a PC, the Pi is six times slower in observed latency but will still only show The small boards also typically have much slower I/O and less memory. On a PC with 16GB of RAM running as a server, usually the whole OS will end up cached in memory. A Raspberry Pi with less RAM is more likely to have to evict from the page cache, and then read it back from a slow SD card.

Re: Build your own private WireGuard VPN with PiVPN

#142

Post by tssva »

moffkalast wrote: post #111
Entinel wrote: post #39

Earlier quoted context omitted.

They are an American business that does not deal with other countries outside North America. Why would they care about the world outside of "ol' Merica?"

Well if they don't want the rest of the world's money, that's alright. Someone else will get it instead.

And they are fine with that just like large numbers of retail chains in Europe, Africa, Asia, South America, Australia, New Zealand, etc. which don't have a presence in the US or other countries outside their own or their own economic region. Home Depot does operate stores outside the US in Mexico and Canada.

Re: Build your own private WireGuard VPN with PiVPN

#143

Post by computershit »

firstlink wrote: post #96
chaxor wrote: post #24

Base wireguard is pretty easy to setup, especially with wg-quick, so idk why anything would be required to make it easier. Also, Rosenpass is quite great and easy to use, which really improves the security further. Hopefully Rosenpass will become part of the base implementation at some point.

After skimming both the GitHub and the protocol specification for rosenpass, I still have no idea what benefit it provides on top of wireguard and therefore why I should use it.

It's below the fold on rosenpass.eu but:

> Rosenpass is a key-exchange protocol using techniques that are secure against attacks from quantum computers. It achieves the same security guarantees as WireGuard, using two strong post-quantum key exchange methods – Classic McEliece and Kyber.

> To use Rosenpass, you don't have to get rid of WireGuard; Rosenpass handles post-quantum security, WireGuard handles pre-quantum security and high-speed data transmission.

Re: Build your own private WireGuard VPN with PiVPN

#144

Post by FredPret »

lxgr wrote: post #127
FredPret wrote: post #34

Earlier quoted context omitted.

I have a US-and-Canada based business and I ban customers from elsewhere in my T’s and C’s. Simply because I don’t know their laws. I don’t outright block them because I myself travel, and some foreign laws apply to their citizens wherever they are. I can completely see why you might want to ban overseas IP connections though, and I’ll probably do it soon.

Banning new signups/sales from overseas IPs can make sense for legal, tax, and shipping reasons – but please do provide some way for existing customers to access their subscriptions/orders/accounts from abroad. International travel is a thing.

I know! This is why I have it enabled - for me. I'm still worried about breaking some EU law without ever knowing it though.

Re: Build your own private WireGuard VPN with PiVPN

#145

Post by AnthonyMouse »

victor106 wrote: post #115
ye-olde-sysrq wrote: post #89

I run wg-easy https://github.com/WeeJeWel/wg-easy for this sort of thing. I use the docker container, and it's great. "Just works". Also, unrelated, I just decided I don't like the sentiment of "PiMyProjectName" branding. I know most projects don't just run on a Pi, and that the intent is to say "you can self-host thing", but at this point if you want to run a home server sort of thing, just buy some cheap 100-200 do…

> I'm pretty dismissive of ARM chips for homelab stuff at this point What about Mac Mini? The latest version runs on M2

The cheapest M2 Mini is $600. That's generally overkill for personal servers. They also have an unknown reliability record, and the older Mac Minis had a tendency to eat storage devices by limiting "fan noise" until temperatures were at the upper threshold of the spec. In the new ones the storage is permanently attached, which is... worrying.

One of the better options if you don't need a lot of internal storage is old laptops. They're cheap, low power, have a built-in monitor and keyboard and you don't need a separate UPS (who cares if the internal battery "only" lasts an hour).

Re: Build your own private WireGuard VPN with PiVPN

#147

Post by AnthonyMouse »

yonatan8070 wrote: post #109
ye-olde-sysrq wrote: post #89

I run wg-easy https://github.com/WeeJeWel/wg-easy for this sort of thing. I use the docker container, and it's great. "Just works". Also, unrelated, I just decided I don't like the sentiment of "PiMyProjectName" branding. I know most projects don't just run on a Pi, and that the intent is to say "you can self-host thing", but at this point if you want to run a home server sort of thing, just buy some cheap 100-200 do…

The Pis shine primarily in terms of power consumption, under load, a mini PC could cosume 50W, where a Pi (and other ARM boards) will do an absolute maximum of 15W. And if you have multiple devices that run 24/7, that could be a significant saving

The trouble there is if you're actually compute bound, the Pi's performance is also a lot worse, and if you're not, you should be comparing the idle power consumption. There are plenty of PCs that idle at under 10W.

PCs also support arbitrary amounts of memory, so you can often avoid needing multiple devices by using virtualization.

Re: Build your own private WireGuard VPN with PiVPN

#148

Post by [deleted] »

fasthandle wrote: post #129
indeyets wrote: post #68

Earlier quoted context omitted.

that's "shadowsocks" wireguard is fingerprintable. it's trivial to look at packets and see "this is wireguard". and block the packets Outline traffic looks much more like noise (pre-shared keys, lack of handshake, …)

Shadowsocks is defunct now. Has been for a while; a connected server's IP can be detected and blocked within hours. That means Outline's defunct in a lot of places too. What's currently 'hot', in large part, is v2ray [1], be that vless, vmess, trojan, etc. [1] https://zh.m.wikipedia.org/wiki/V2Ray

[deleted]

Re: Build your own private WireGuard VPN with PiVPN

#149

Post by blipvert »

Taking an opportunity here for a completely shameless plug for an enterprise-y wg based corporate VPN. Uses mTLS for device auth, wg (obvs), OIDC to authenticate users/set up firewall access (Azure AD and Keycloak tested). Runs as a redundant cluster and can be hooked in via BGP.

Very early and no docs to speak of yet, but raise an issue if interested. Works with standard WireGuard app on computers/phones, but an integrated app using the API might be in the works …

https://github.com/davidcoles/gpn

Re: Build your own private WireGuard VPN with PiVPN

#150

Post by sedatk »

vanilla_nut wrote: post #136
yonatan8070 wrote: post #109

Earlier quoted context omitted.

The Pis shine primarily in terms of power consumption, under load, a mini PC could cosume 50W, where a Pi (and other ARM boards) will do an absolute maximum of 15W. And if you have multiple devices that run 24/7, that could be a significant saving

Additionally, my home Pi4 sits in a metal case that acts as a heat sink so I don't have to use a fan at all. That translates to: - additional energy savings - more or less eliminated need to clean out dust or eventually replace a fan - no fan noise, a massive boon if you live in a small apartment and don't have a closet or basement you can toss the server into for noise insulation I suppose if I did serious number cr…

There are fanless mini PCs too: https://news.ycombinator.com/item?id=35831087
Post reply on HN