Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Quick VPN Setup with AWS Lightsail and WireGuard

mcoliver.substack.com

Post reply on HN
Print view View original

31–40 of 78 posts

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#31

Post by tyingq »

Sohcahtoa82 wrote: post #21
tyingq wrote: post #12

Depending on the instance type, Lightsail easily gets throttled into oblivion. The $3.50/month instance allows for 5% utilization before you start eating up burst capacity. Perhaps WireGuard is light enough that it's okay, but thought it worth mentioning.

LightSail instances are burstable t2/t3 instances under the hood. Which...those types of instances have their use. But the fact that AWS kind of hides the whole CPU credit thing in LightSail is a bit misleading.

Yeah, it's documented, but it's fairly buried in a place where you'll only find it if you already know throttling exists for Lightsail. It's irritating when I read blog posts comparing Lightsail to other, normal VPS offerings because it's not very normal :)

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#32

Post by tptacek »

hejcloud wrote: post #17

Question: Assuming PKI is "solved" (whatever that means) isn't mTLS in contrast to sth like a VPN the preferred solution nowadays? Or both? I'm asking because Wireguard itself looks a lot like mTLS to me and I'm curious how HN people currently see that context.

WireGuard is a better, safer protocol than mTLS. If you can use WireGuard, that's what you should use (often you can't, because you don't want IP addressing between your components).

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#34

Post by j45 »

thatcherc wrote: post #14

Fairly off-topic, but I've been having the hardest time finding a Wireguard configuration guide that lets me connect two peers (my phone and an SBC at my house behind my router) to a VPS peer (with a public IP) in a way that routes all the traffic from my phone through the SBC (via WG) and out to the internet via my home fiber connection. All the blog posts and tutorials I've seen have traffic going out through the V…

Would something like AlgoVPN installed at the appropriate point in your hierarchy/network map simplify this?

Unsure if/how/why you want to modify firewalls and iptables.

If you're ok running ubuntu or debian, the commands for ufw as a firewall are pretty straight forward to setup and maintain and can be scriptable.

Algo is a nice install that works just fine installed as a docker image running on a linux VPS. Installing docker and docker-compose are essential for this.

If after reading this you are saying there is no comprehensive step by step article that does this, let me know, and I can see if I have my install notes and the install script I created to put up somewhere.

I think sometimes enough years of linux and looking things up can be at fault for some of the documentation needs.

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#35

Post by j45 »

tyingq wrote: post #12

Depending on the instance type, Lightsail easily gets throttled into oblivion. The $3.50/month instance allows for 5% utilization before you start eating up burst capacity. Perhaps WireGuard is light enough that it's okay, but thought it worth mentioning.

Linode isn't too bad for a VPS instance - best ot make sure the IP isn't on many block lists, take your time logging into all your services through it and the rest can be generally smooth sailing.

More and more cloud providers look for and block vpn's self-hosted with vps providers, in which case, finding access to residential connections (trading) or a provider is a way to go.

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#36

Post by j45 »

mcoliver wrote: post #24
lormayna wrote: post #6

Why not using an Ansible playbook? You can deploy it on any VPS without vendor lock in.

First off...wow. Never expected this to hit front page. Just started writing and trying to get the juices flowing. You could totally use an Ansible playbook. I've used a lot of them over the years. Ansible, Terraform, Salt, Chef, Puppet, etc... As I said at the end of the article I glossed over a lot of things and the beauty of tech is there are lots of ways to do things. Do what works for you. Tradeoffs all over the…

Ansible, etc, are great.

But also one more dependancy.

More and more I'm finding having a bash script that can work on most debian/ubuntu systems is pretty handy to be able to run remotely whether it's a VPS or more.

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#38

Post by harry8 »

Nux wrote: post #16
thatcherc wrote: post #14

Fairly off-topic, but I've been having the hardest time finding a Wireguard configuration guide that lets me connect two peers (my phone and an SBC at my house behind my router) to a VPS peer (with a public IP) in a way that routes all the traffic from my phone through the SBC (via WG) and out to the internet via my home fiber connection. All the blog posts and tutorials I've seen have traffic going out through the V…

What is an sbc and the phone's relation to it?

SBC - Single Board Computer. Raspberry Pi most famous example? https://en.wikipedia.org/wiki/Single-board_computer

In this instance consider the SBC a lightweight, low-power, always on server sitting behind his/her router.

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#39

Post by megous »

renewiltord wrote: post #19
thatcherc wrote: post #14

Fairly off-topic, but I've been having the hardest time finding a Wireguard configuration guide that lets me connect two peers (my phone and an SBC at my house behind my router) to a VPS peer (with a public IP) in a way that routes all the traffic from my phone through the SBC (via WG) and out to the internet via my home fiber connection. All the blog posts and tutorials I've seen have traffic going out through the V…

Wireguard is L3, right? So it behaves like a network layer VPN. That means that you can't switch how traffic is flowing based on application protocol. But I'm not super familiar with VoIP stuff. You can split the tunnel based on IP routing, but I think that's as good as it gets. So if you want to Wireguard specific traffic to your peer then you're fine. For instance, we have our internal cloud network linked to our o…

How about policy routing based on dport? See `ip rule help`.
Post reply on HN