Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Quick VPN Setup with AWS Lightsail and WireGuard

mcoliver.substack.com

Post reply on HN
Print view View original

11–20 of 78 posts

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#12

Post by tyingq »

Depending on the instance type, Lightsail easily gets throttled into oblivion. The $3.50/month instance allows for 5% utilization before you start eating up burst capacity. Perhaps WireGuard is light enough that it's okay, but thought it worth mentioning.

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#13

Post by Nux »

lormayna wrote: post #6

Why not using an Ansible playbook? You can deploy it on any VPS without vendor lock in.

I didn't care about the AWS and zsh aspects of the article, but what vendor lock-in are you talking about and how exactly would an ansible playbook sort it?

All you need is any ubuntu vps - in fact any systemd distro if you ignore the "ufw" commands - and the 50 or so lines following "Wireguard Setup".

It doesn't get more simple than this.

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#14

Post by thatcherc »

Fairly off-topic, but I've been having the hardest time finding a Wireguard configuration guide that lets me connect two peers (my phone and an SBC at my house behind my router) to a VPS peer (with a public IP) in a way that routes all the traffic from my phone through the SBC (via WG) and out to the internet via my home fiber connection. All the blog posts and tutorials I've seen have traffic going out through the VPS peer, with little explanation of how all the firewall and iptables commands might change if I wanted a different configuration. Has anyone seen a configuration like that, or know which networking concepts I should keep searching for to go in the right direction?

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#15

Post by hejcloud »

Nux wrote: post #13
lormayna wrote: post #6

Why not using an Ansible playbook? You can deploy it on any VPS without vendor lock in.

I didn't care about the AWS and zsh aspects of the article, but what vendor lock-in are you talking about and how exactly would an ansible playbook sort it? All you need is any ubuntu vps - in fact any systemd distro if you ignore the "ufw" commands - and the 50 or so lines following "Wireguard Setup". It doesn't get more simple than this.

Well using the aws cli is locking you in to AWS, isn't it? And at least from my experience those "just 50 lines of shell" can get very messy overtime. Eventually, if you add more features (pretty much every project gets more features over time), you will refactor once or twice and end up rewriting it in Python, make it more declarative because it's easier to test and tada, you just reinvented Ansible yourself. I think this question is legit.

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#16

Post by Nux »

thatcherc wrote: post #14

Fairly off-topic, but I've been having the hardest time finding a Wireguard configuration guide that lets me connect two peers (my phone and an SBC at my house behind my router) to a VPS peer (with a public IP) in a way that routes all the traffic from my phone through the SBC (via WG) and out to the internet via my home fiber connection. All the blog posts and tutorials I've seen have traffic going out through the V…

What is an sbc and the phone's relation to it?

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#18

Post by Nux »

hejcloud wrote: post #15
Nux wrote: post #13

Earlier quoted context omitted.

I didn't care about the AWS and zsh aspects of the article, but what vendor lock-in are you talking about and how exactly would an ansible playbook sort it? All you need is any ubuntu vps - in fact any systemd distro if you ignore the "ufw" commands - and the 50 or so lines following "Wireguard Setup". It doesn't get more simple than this.

Well using the aws cli is locking you in to AWS, isn't it? And at least from my experience those "just 50 lines of shell" can get very messy overtime. Eventually, if you add more features (pretty much every project gets more features over time), you will refactor once or twice and end up rewriting it in Python, make it more declarative because it's easier to test and tada, you just reinvented Ansible yourself. I thin…

Question is not legit. Refactor what? Did you guys actually read the article?

Just copy/paste them commands in any linux vps. You don't need aws, at least lightsail is cheap. Ionos (1&1) is cheaper.

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#19

Post by renewiltord »

thatcherc wrote: post #14

Fairly off-topic, but I've been having the hardest time finding a Wireguard configuration guide that lets me connect two peers (my phone and an SBC at my house behind my router) to a VPS peer (with a public IP) in a way that routes all the traffic from my phone through the SBC (via WG) and out to the internet via my home fiber connection. All the blog posts and tutorials I've seen have traffic going out through the V…

Wireguard is L3, right? So it behaves like a network layer VPN. That means that you can't switch how traffic is flowing based on application protocol. But I'm not super familiar with VoIP stuff.

You can split the tunnel based on IP routing, but I think that's as good as it gets. So if you want to Wireguard specific traffic to your peer then you're fine. For instance, we have our internal cloud network linked to our offices via wireguard, but traffic to anything that is not that network goes to the public Internet via our fiber.

But if we wanted to send HTTP requests always through the WG, that is not possible to configure because WG acts as an L3 VPN and Layer 3 has no conception of anything but the network. You couldn't say "Send HTTP requests through my normal fiber, but DNS requests through my VPS peer".

Post reply on HN