[dead]
Build your own private WireGuard VPN with PiVPN
171–180 of 235 posts
Re: Build your own private WireGuard VPN with PiVPN
#172[dead]
Re: Build your own private WireGuard VPN with PiVPN
#173The one problem I encounter with Wireguard is the use of UDP. Some publicly accessible Wifi nets at shops don't allow UDP at all, and this effectively breaks use of the VPN. Yeah, there are utilities like setting up udptunnel or udp2raw and similar, but what a headache. I really don't agree with Wireguard's developers justification that it makes speeds terrible. Who cares? It'll be terrible using those utilities anyw…
A little trick for this is to listen on udp/53 which is almost always unblocked, even before captive portals
I once used port 53 for all my communications at a hotel that was charing metering bandwidth by the gb... it was a magical weekend of DNS passthrough with video calls, etc.
53 is my go to port when the network is wonky.
Re: Build your own private WireGuard VPN with PiVPN
#174If you're going this far, might as well do as the author did and add a pi-hole to the mix, issue some credentials to your phone and block ads and/or other stuff via DNS everywhere you go. I also use this to remote into my work computer from wherever I am, using my travel laptop, an iPad or even just my cell phone.
pihole is really lightweight, you could just run it on your local laptop and save yourself the hop to your home network for all DNS requests
I could set up pihole on my local laptop. And on my wife's laptop. And on my kids' phones. And on my work laptop. And...
Or I could just set it up on one tiny server (doesn't have to be a pi, but I happen to have one that isn't doing anything else), point my gateway at it for DNS, and give my whole family + any VPN connections filtering for free.
Re: Build your own private WireGuard VPN with PiVPN
#175Earlier quoted context omitted.
> I run wg-easy https://github.com/WeeJeWel/wg-easy for this sort of thing. I use the docker container, and it's great. "Just works". This looks great, thank you! My current home router(s) fortunately support Wireguard natively, but I'll look into this if I'm ever again forced to use a shitty CPE. > I'm pretty dismissive of ARM chips for homelab stuff at this point. There's super cheap minipcs with "real" processors…
Sure, some stuff doesn't run on ARM, but a lot does. Plus, you can get decent ARM processors for cheap, whereas for the same price the best you'd get would be a Celeron.
The "decent ARM processors for cheap" seem comparable to a Celeron performance-wise, don't they?
Re: Build your own private WireGuard VPN with PiVPN
#176And then you hit CPU bottlenecks whenever you do literally anything bandwidth intensive. The limits of using hobbyist hardware, you get hobbyist level performance. A Raspberry Pi is a horrible solution for running Wireguard. You can get a tiny 1L PC running on an actual Intel or AMD processor with far more perf/$.
I'm not sure what's the max throughput is, but I just tested 50 Mbit down/80 Mbit up passthrough from a cafe Wi-Fi to my 3B with Wireguard (using wg-quick) at home. Seems enough for anything I'd use it for.
My home Internet upload speed is 35 Mbps. A Pi 1 can handle that speed, much less a Pi 3 or 4 :)
But the nice thing is PiVPN works great on any little PC. Or even a VM.
Re: Build your own private WireGuard VPN with PiVPN
#177I have never met Jeff (the author of this blog post), but I come across his work randomly all of the time. Jeff, if you're reading this, I've always been impressed by your efforts, you're a work horse!
Thanks! Didn't think this blog post would hit HN, but apparently it did, while I was on a flight back to the US lol. I figured most of us here are VPN'ed out.
It served me well on my trip and I was able to see all the things from local media that are geo restricted out of the US.
Re: Build your own private WireGuard VPN with PiVPN
#178Before going to a long 3 month trip to Asia last year, I installed WireGuard on my Raspberry Pi 1 (original model B from 2012) which was running at home in US. I found PiVPN to be the easiest way to install Wireguard. I didn't know if I even needed a VPN but I was glad, and I was able to use internet as if I were at home. It was weird, but a lot of sites are blocked oversea, even though it shouldn't. For example, I c…
I also did something similar, plus all my home automation which is 98% local-first|only. My trip was just 3 weeks but on the first day leaving, between one plane and another, my power company had a 4hours extraordinary maintenance cut, my UPS didn't last enough and with that blackout the RPi SD card died, and I was locked out my LAN for all the trip. Lesson learned: configure the UPS to communicate with the servers a…
May or may not work for your usecase, but I have some scripts to prepare read-only raspbian images here:
https://github.com/nolanl/ropi
There are commands to enable/disable read-write mode, so you can still make changes and do upgrades.
I've had 0 problems with SDcard death after I started using it.
Re: Build your own private WireGuard VPN with PiVPN
#179I moved to Tailscale, until I find something simpler, I'm not moving back.
Why would that even look like? When I set it up it promised a 10 minute install time. For me a fair portion of that 10 minutes was trying to work out if it was working as my line speed was higher than I thought possible. It’s scary how quick it is to configure.
Just install tailscale on something in your home network, and start it up advertising as an exit node. On your laptop, select the exit node from the tailscale menu. Now all your internet traffic will go through that machine.
Re: Build your own private WireGuard VPN with PiVPN
#180Earlier quoted context omitted.
> They can tell whatever they want, but it would need to be a US court (in that case) who would do the litigation. Which they won't. That's a pretty incomplete view of how jurisdiction works. You do probably need a US court ruling to enforce a claim against a US entity – but if that entity has any EU subsidiaries or assets, you can bet that European courts will come after those. > Blocking for security is another thi…
> That's a pretty incomplete view of how jurisdiction works. You do probably need a US court ruling to enforce a claim against a US entity – but if that entity has any EU subsidiaries or assets, you can bet that European courts will come after those. I am not sure you read my post in details - I explicitly mentioned that I am talking about local services, without any international footprint. And mentioned that in cas…
The business may be local but the owner or other management or employees may wish to keep all of their travel options wide open without fear of some obscure foreign law that might hold them individually responsible.
The golden days of global network accessibility are closing little by little.